Migrate public-repo branch protection to GitHub Rulesets for admin force-push break-glass - #12
Merged
Merged
Conversation
Closes #9. Two updates triggered by review feedback on PR #6: - Add a "code comments" rule: TODOs / aspirational comments must link to a GitHub issue, not float as bare wishes. Land in CONTRIBUTING.md with examples; mirror a short summary in AGENTS.md that points back. - Add a core-principle bullet capturing the meta-pattern: when review yields a generalizable rule, fold it back into CONTRIBUTING.md via a PR closing a tracking issue. A verbal "I'll remember" doesn't bind future contributors (especially agents). Also folds in the solo-admin merge path notes from PR #6's review (admin-bypass via UI button or `gh pr merge --admin --squash`) so the next contributor isn't blocked by the CODEOWNERS deadlock. Renumbers AGENTS.md sections to keep them sequential after the new "Code comments" section. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…rce-push break-glass Public repos now use a GitHub Ruleset instead of legacy branch protection. The ruleset enforces the same rules (PR required, linear history, no force push for non-admins) but adds bypass actors for org owners and repo admins — so `git push origin main --force` works as a break-glass without any UI changes. GitHub records the bypass in the audit log. Private repos continue to attempt legacy branch protection (expected SKIP on Free plan). apply-settings.py: adds get_repo_visibility, list/apply/verify_ruleset, delete_legacy_protection; routes public vs private repos to different protection paths. settings.yml: adds `rulesets:` block with the canonical ruleset definition. CONTRIBUTING.md: updates branch protection docs and adds Force-push break-glass section. Closes #11 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rulesets:block tosettings.ymldefining aswimblocks-defaultruleset with the same rules as the current legacy branch protection, plus bypass actors for org owners and repo adminsapply-settings.pyto route public repos to ruleset-based protection (creating/updating the ruleset and removing legacy branch protection) and private repos to the existing legacy pathCONTRIBUTING.mdto document rulesets as the mechanism for public repos and adds a "Force-push break-glass" section explaining that admins just rungit push origin main --forceWhy
Legacy branch protection has no per-actor bypass for force pushes —
allow_force_pushes: falseblocks everyone including org owners. GitHub Rulesets support bypass actors, giving admins a clean break-glass without any UI steps. The bypass is recorded in the GitHub audit log.Immediate trigger: needed to complete a history rewrite on
swimblocks/rems-sync(purgingapps_script/from history before the repo went public).Test plan
swimblocks/.githubitself is a public repo)scripts/apply-settings.py swimblocks/rems-sync— should create the ruleset, reportOK ruleset 'swimblocks-default': present, and remove legacy branch protectiongit push origin main --forcesucceeds onrems-syncas an admin (completing the history rewrite)Closes #11
🤖 Generated with Claude Code