fix: Enable branch protection on .github and bmad-bgreat-suite #28

Activity

1. don-petry

   added

   bugBug reportsBug reports

   securitySecurity-related PRs and issuesSecurity-related PRs and issues

   claude

   and removed

   claude

   on Apr 6, 2026
2. claude commented on Apr 6, 2026

   

   claudeBot

   on Apr 6, 2026 – with Claude

   Last edited by claude

   Contributor

   More actions

   Claude finished @don-petry's task in 5m 48s —— View job • claude/issue-28-20260406-0321 • Create PR ➔

   ---

   Implementation Complete

   • Gather context (read AGENTS.md, repo structure, standards)
   • Understand branch protection requirements
     • Standards require rulesets (pr-quality + code-quality), not classic branch protection
     • .github required checks: Lint, ShellCheck, Agent Security Scan, SonarCloud, claude
     • bmad-bgreat-suite required checks: SonarCloud, Analyze, claude (see note below)
   • Create scripts/setup-branch-protection.sh to create rulesets via GitHub API
   • Update standards/github-settings.md compliance status (added .github deviation, referenced script)
   • Commit and push to claude/issue-28-20260406-0321
   • Create PR

   What was implemented

   scripts/setup-branch-protection.sh — new script that creates or idempotently updates two rulesets via the GitHub REST API on both repos:

   • pr-quality: 1 required approving review, stale review dismissal, code owner review, last-push approval, thread resolution required, squash-only, no force-push, no deletion
   • code-quality: required status checks (strict, branch must be up-to-date)
     • .github: Lint, ShellCheck, Agent Security Scan, SonarCloud, claude
     • bmad-bgreat-suite: SonarCloud, Analyze, claude

   standards/github-settings.md — updated compliance status table to list .github as a deviation, and added a "Remediating Missing Rulesets" section with usage instructions.

   After merging

   An admin runs:

   GH_TOKEN=<admin-pat> bash scripts/setup-branch-protection.sh

   Note: The bmad-bgreat-suite check names (SonarCloud, Analyze, claude) should be verified against that repo's actual CI workflow job names before applying. The script supports --dry-run to preview changes.
3. github-actions

   added a commit that references this issue on Apr 6, 2026

   fix: add branch protection ruleset setup for .github and bmad-bgreat-…

   ...

   This issue will close once commit 4c59ddf is merged into the 'main' branch.

   4c59ddf
4. don-petry

   added

   claude

   and removed

   claude

   on Apr 6, 2026
5. claude commented on Apr 6, 2026

   

   claudeBot

   on Apr 6, 2026 – with Claude

   Last edited by claude

   Contributor

   More actions

   Claude finished @don-petry's task in 5m 6s —— View job • claude/issue-28-20260406-0341 • Create PR ➔

   ---

   Implementation complete for issue #28

   • Read CLAUDE.md and gather context (no CLAUDE.md; used AGENTS.md + standards docs)
   • Review existing scripts and CI check names
   • Create scripts/setup-branch-protection.sh
   • Update standards/github-settings.md compliance status for .github repo
   • Commit and push changes
   • Create PR: petry-projects/.github#66
   • Self-review PR — no bugs or issues found; script follows patterns from apply-repo-settings.sh
   • CI check (in progress — requires manual verification)
   • Code owners: no CODEOWNERS file exists; tagging issue author @don-petry for review

   ---

   What was implemented

   scripts/setup-branch-protection.sh — new script that creates/idempotently updates two rulesets via the GitHub REST API:

   • pr-quality: 1 required review, stale review dismissal, code owner review, last-push approval, thread resolution, linear history (no merge commits), no force-push, no deletion
   • code-quality (strict — branch must be up-to-date):
     • .github: Lint, ShellCheck, Agent Security Scan, SonarCloud, claude
     • bmad-bgreat-suite: SonarCloud, Analyze, claude

   standards/github-settings.md — added .github to the compliance deviations table and added a "Remediating Missing Rulesets" section with --dry-run and apply commands.

   After merging

   DRY_RUN=true GH_TOKEN=<admin-pat> bash scripts/setup-branch-protection.sh --default
   GH_TOKEN=<admin-pat> bash scripts/setup-branch-protection.sh --default

   Verify bmad-bgreat-suite check names match actual CI job names before applying.
   • claude/issue-28-20260406-0341
6. github-actions

   added a commit that references this issue on Apr 6, 2026

   fix: enable branch protection rulesets for .github and bmad-bgreat-suite

   ...

   This issue will close once commit 13799fe is merged into the 'main' branch.

   13799fe
7. don-petry commented on Apr 7, 2026

   

   don-petry

   on Apr 7, 2026

   ContributorAuthor

   More actions

   Resolved by creating branch protection rulesets on both repos:

   petry-projects/.github — ruleset protect-branches (id 14759907)

   • Required status checks: Lint, ShellCheck, Agent Security Scan, SonarCloud, Analyze (actions)

   petry-projects/bmad-bgreat-suite — ruleset protect-branches (id 14759908)

   • Required status checks: SonarCloud, Analyze, AgentShield, Validate

   Both rulesets enforce:

   • PR required (no force-push, no deletion)
   • Stale review dismissal on push
   • Required review thread resolution
   • Admin role bypass (matches pattern from other org repos)
   • 0 required approving reviews (solo-dev pattern matching org standard)

   Created directly via REST API rather than via the script in closed PR #66, mirroring the existing ruleset structure on petry-projects/google-app-scripts.
8. don-petry

   closed this as completedon Apr 7, 2026