Customize the policy-bot PR title to enable wildcard matching on branches

[mglazer]

On a repository which I maintain, we have to keep a release branch system, so our release branches are named:

• release/3.19.10.1
• release/3.19.10.2
• release/3.19.10.3
• ...

In order to get status checks working in Github, I create a pattern branch protection pattern:

release/.*

Which allows me to add checks for everything, except for Policybot, which uniquely names every check as:

policy-bot: release/3.19.10.1
policy-bot: release/3.19.10.2
...

The Github UI unfortunately does not allow me to match on wildcard status checks, so I need the status check name to be constant, which for Policy bot it's not.

[jamestoyer]

The name of the branch in the status check is intentionally to prevent cases where a policy could be updated on a less secure branch without being properly approved. See this comment in #57 for a better explaination

[mglazer]

So is the only solution for me to manually go to every release branch in GHE (and remember to do this forever into the future when we cut release branches) and ensure that the status check requirement is checked?

[mglazer]

I'm open to other solutions too, I just proposed the first one that came to mind since it was clearly the most obvious one.

[andrey-bolduzev]

I'm curious if there has been any development in this area. This seems like a pretty major issue for any repository that happens to cut release branches.

[dermyrddin]

@jamestoyer I understand security concerns, but maybe check name could be made configurable - to contain branch or not? We have about 30 repos with up to 10 hotfix-x.x branches. Right now there is a wildcard filter in the protection rule, it will be quite hard for us to create new rules with every release when we create a new hotfix branch in every repo. And our developers are pretty honest to not do magic with retargeting PRs.

[dermyrddin]

I'm not sure if @jamestoyer still actively contributing here.

@bluekeyes maybe you can share your thoughts? Is the idea to add an option to remove branch from check name sounds reasonable and if yes - is there a possibility that this could be added in near future?

[asvoboda]

Its configurable at the server level by using the post_insecure_status_checks option.

policy-bot/server/handler/base.go

Lines 67 to 70 in 3e22bd4

	// PostInsecureStatusChecks enables the sending of a second status using just StatusCheckContext as the context,
	// no templating. This is turned off by default. This is to support legacy workflows that depend on the original
	// context behaviour, and will be removed in 2.0
	PostInsecureStatusChecks bool `yaml:"post_insecure_status_checks"`

Given that this issue is a pretty easy hole to exploit, we're likely not looking to make this option easier to foot gun.

[dermyrddin]

Thanks @asvoboda, will give it a try.