Skip to content

Compliance: ruleset-drift-pr-quality-require_last_push_approval #409

Closed
#432
Closed
Compliance: ruleset-drift-pr-quality-require_last_push_approval#409
#432
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Jul 17, 2026

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-require_last_push_approval

Detail

Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/broodly to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    dev-leadFor dev-lead agent pickup
    on Jul 17, 2026

  2. don-petry commented on Jul 17, 2026

    @don-petry
    don-petry
    on Jul 17, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #409 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

    Scope

    The codified remediation script scripts/apply-rulesets.sh already sets the pr-quality ruleset parameter require_last_push_approval: true, matching the standard's source of truth. The live-GitHub convergence itself is performed by the org admin apply script (petry-projects/.github) outside this repo's PR flow and requires an administration:write token. The in-repo deliverable is a regression test that guards the codified pr-quality parameters so the script can never silently drift from the standard again — mirroring the existing guard tests/scripts/apply-repo-settings.test.sh for the sibling settings script.

    Implementation Checklist

    • Add tests/scripts/apply-rulesets.test.sh — runs scripts/apply-rulesets.sh in --dry-run --force with a mocked gh CLI and asserts the codified pr-quality payload sets require_last_push_approval: true plus the other codified pull_request parameters (required_approving_review_count: 1, dismiss_stale_reviews_on_push: true, require_code_owner_review: true, required_review_thread_resolution: true).

    Tests to Write

    • tests/scripts/apply-rulesets.test.sh — regression guard for pr-quality ruleset parameters (drift demonstrated by temporarily flipping the value to confirm the test fails, then restoring).

    Test Command

    bash tests/scripts/apply-rulesets.test.sh (plus bash tests/scripts/apply-repo-settings.test.sh and bash .dev-lead/scripts/dev-lead-lint.sh for full verification)

  3. don-petry commented on Jul 17, 2026

    @don-petry
    don-petry
    on Jul 17, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Confirmed the codified remediation script scripts/apply-rulesets.sh already sets the pr-quality parameter require_last_push_approval: true (line 104), matching the standard's source of truth.
    • Added tests/scripts/apply-rulesets.test.sh — a regression guard for the codified pr-quality ruleset parameters, mirroring the existing tests/scripts/apply-repo-settings.test.sh pattern.
    • TDD: demonstrated the guard fails when the codified value drifts to false, then confirmed it passes with the correct true.

    Note on scope

    The live-GitHub ruleset convergence (expected true, actual false) is applied by the org admin script in petry-projects/.github via scripts/apply-rulesets.sh --repo petry-projects/broodly, which requires an administration:write token and is out of band for this repo's PR flow. This repo's contribution to compliance is the codified apply-rulesets.sh, which was already correct. The added test prevents the codified source from silently drifting from the standard in the future.

    Test Results

    ===== RED (temporarily flipped codified value to false) =====
not ok - codifies pr-quality param "require_last_push_approval": true (output missing: "require_last_push_approval": true)
FAIL — see assertions above

===== GREEN (codified value restored to true) =====
ok - emits the pr-quality ruleset
ok - codifies pr-quality param "require_last_push_approval": true
ok - codifies pr-quality param "required_approving_review_count": 1
ok - codifies pr-quality param "dismiss_stale_reviews_on_push": true
ok - codifies pr-quality param "require_code_owner_review": true
ok - codifies pr-quality param "required_review_thread_resolution": true
---
PASS — 6 assertion(s) passed

===== sibling regression (tests/scripts/apply-repo-settings.test.sh) =====
PASS — 7 assertion(s) passed

===== .dev-lead/scripts/dev-lead-lint.sh =====
  [lint] shellcheck on 2 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

===== shellcheck --severity=warning -x tests/scripts/apply-rulesets.test.sh =====
shellcheck-clean

    Files Changed

    • tests/scripts/apply-rulesets.test.sh (new): Runs scripts/apply-rulesets.sh in --dry-run --force with a stubbed gh CLI and asserts the codified pr-quality payload sets require_last_push_approval: true plus the other codified pull_request parameters.

    Notes

    • No production code changed; scripts/apply-rulesets.sh was already compliant and remains byte-for-byte unchanged.
    • The new shell test is a standalone guard (runnable via bash tests/scripts/apply-rulesets.test.sh), consistent with the sibling apply-repo-settings.test.sh, which is likewise not wired into the jest/go CI jobs.
    • Phase 2 TDD was demonstrated by temporarily flipping the codified value; the flip was reverted before completion.
  4. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jul 21, 2026

  5. don-petry commented on Jul 21, 2026

    @don-petry
    don-petry
    on Jul 21, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #409 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

    Scope

    Lock in the codified pr-quality ruleset standard by adding regression tests that assert scripts/apply-rulesets.sh sets require_last_push_approval: true, so this repo's codified source-of-truth mirror can never silently drift back to false.

    Findings

    • The live GitHub pr-quality ruleset has require_last_push_approval: false (the drift). Converging the live state requires an admin to run scripts/apply-rulesets.sh with an administration:write token — that is a live GitHub API operation outside this agent's scope and is called out in the completion report.
    • The codified payload in scripts/apply-rulesets.sh:104 already sets require_last_push_approval: true, matching the org standard. It currently has no test coverage (unlike its sibling apply-repo-settings.sh).

    Implementation Checklist

    • Add tests/scripts/apply-rulesets.test.sh — plain-bash test (mirrors apply-repo-settings.test.sh) mocking gh and asserting the pr-quality dry-run payload contains require_last_push_approval: true and the other required pull_request review parameters.
    • Add tests/integration/apply-rulesets.bats — bats integration test mirroring apply-repo-settings.bats conventions for the same assertions.

    Tests to Write

    • pr-quality ruleset codifies require_last_push_approval: true
    • pr-quality ruleset codifies required_approving_review_count, require_code_owner_review, required_review_thread_resolution
    • dry-run makes no mutating (POST/PUT) API call

    Test Command

    bash tests/scripts/apply-rulesets.test.sh (plain bash) and bats tests/integration/apply-rulesets.bats (bats, run in CI)

  6. don-petry commented on Jul 21, 2026

    @don-petry
    don-petry
    on Jul 21, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Investigated the drift: the codified pr-quality payload in scripts/apply-rulesets.sh:104 already sets require_last_push_approval: true (matches org source of truth) — but had no test coverage, unlike its sibling apply-repo-settings.sh.
    • Added tests/scripts/apply-rulesets.test.sh (plain-bash, mirrors apply-repo-settings.test.sh).
    • Added tests/integration/apply-rulesets.bats (bats, mirrors apply-repo-settings.bats).
    • TDD verified: temporarily flipping the codified value to false makes the test FAIL (red); restoring true makes it PASS (green).

    Test Results

    # tests/scripts/apply-rulesets.test.sh
ok - pr-quality codifies require_last_push_approval: true
ok - pr-quality codifies required_approving_review_count: 1
ok - pr-quality codifies dismiss_stale_reviews_on_push: true
ok - pr-quality codifies require_code_owner_review: true
ok - pr-quality codifies required_review_thread_resolution: true
ok - dry-run made no mutating API call
PASS — 6 assertion(s) passed

# tests/integration/*.bats (bats-core)
1..7
ok 1 applies check-suite preferences via the plural check-suites/preferences endpoint
ok 2 never targets the non-existent singular check-suite/preferences endpoint
ok 3 dry-run makes no PATCH call
ok 4 pr-quality ruleset codifies require_last_push_approval: true
ok 5 pr-quality ruleset never codifies require_last_push_approval: false
ok 6 pr-quality ruleset codifies the required review parameters
ok 7 dry-run makes no mutating (POST/PUT) API call

# lint
.dev-lead/scripts/dev-lead-lint.sh — all checks passed
shellcheck --severity=warning -x tests/scripts/apply-rulesets.test.sh — OK

    Files Changed

    • tests/scripts/apply-rulesets.test.sh (new): plain-bash regression test asserting the codified pr-quality dry-run payload contains require_last_push_approval: true plus the other required pull_request review parameters, and that dry-run performs no mutating API call. Stubs gh so it runs offline.
    • tests/integration/apply-rulesets.bats (new): bats equivalent of the same assertions, including an explicit guard that the payload never codifies require_last_push_approval: false.

    Notes

    • No source change was required. The codified ruleset (scripts/apply-rulesets.sh), which is this repo's mirror of the org source of truth (standards/rulesets/pr-quality.json), already sets require_last_push_approval: true. This change adds the missing regression coverage so the codified value can never silently drift back to false.
    • Live-state convergence is out of this agent's scope. The compliance finding is about the live GitHub ruleset (actual: false). Converging it requires an org admin to run GH_TOKEN=<administration:write> scripts/apply-rulesets.sh against petry-projects/broodly — a live GitHub API mutation this agent does not perform. Once run, the live pr-quality ruleset will match the codified true.
    • TS/Go workspace suites (pnpm run test) were not run: the toolchain is not provisioned in this environment and the change is isolated to shell test files under tests/, touching no TypeScript or Go source.

  7. don-petry commented on Jul 24, 2026

    @don-petry
    don-petry
    on Jul 24, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-07-24)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/broodly to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  8. don-petry commented on Jul 31, 2026

    @don-petry
    don-petry
    on Jul 31, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-07-31)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/broodly to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  9. don-petry
    added 2 commits that reference this issue on Aug 4, 2026

    feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-req…

    cd80f99

    feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-req…

    13c7eba

  10. don-petry commented on Aug 7, 2026

    @don-petry
    don-petry
    on Aug 7, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-08-07)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/broodly to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  11. don-petry commented on Aug 14, 2026

    @don-petry
    don-petry
    on Aug 14, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-08-14)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/broodly to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  12. don-petry
    closed this as completedin #432on Aug 18, 2026
  13. don-petry
    added a commit that references this issue on Aug 18, 2026

    feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-req…

    9f9be35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions