From fd99a5911764349a8fe93a70b489bc7138fadf37 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:34:44 +0000 Subject: [PATCH 1/3] =?UTF-8?q?feat:=20implement=20issue=20#480=20?= =?UTF-8?q?=E2=80=94=20Compliance:=20ruleset-drift-pr-quality-require=5Fco?= =?UTF-8?q?de=5Fowner=5Freview?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tests/scripts/apply-rulesets.test.sh | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/tests/scripts/apply-rulesets.test.sh b/tests/scripts/apply-rulesets.test.sh index 6d411302..ae0e38d1 100755 --- a/tests/scripts/apply-rulesets.test.sh +++ b/tests/scripts/apply-rulesets.test.sh @@ -2,9 +2,11 @@ # Test: scripts/apply-rulesets.sh codifies the pr-quality and code-quality # rulesets required by the org github-settings standard. # -# Focus: the pr-quality `pull_request` rule must set -# dismiss_stale_reviews_on_push = true (compliance check -# ruleset-drift-pr-quality-dismiss_stale_reviews_on_push). +# Focus: the pr-quality `pull_request` rule must set the compliance-critical +# boolean parameters to true — dismiss_stale_reviews_on_push (compliance check +# ruleset-drift-pr-quality-dismiss_stale_reviews_on_push) and +# require_code_owner_review (ruleset-drift-pr-quality-require_code_owner_review). +# These are asserted as strict booleans so a string "true" cannot pass. # # Runs the script in --dry-run --force mode so no real GitHub API calls are # made and the repo-identity safety check is skipped. Asserts the dry-run @@ -84,6 +86,23 @@ else fail=1 fi +# The compliance-critical parameter for #480: a code owner review must be +# required. Asserted as a strict boolean within the pr-quality ruleset so a +# string "true" or the setting appearing in another ruleset cannot pass. +_code_owner=$(printf '%s\n' "$_pr_q_json" | jq -r ' + .rules[] + | select(.type == "pull_request") + | (.parameters.require_code_owner_review // false) + | (type == "boolean" and . == true) +') +if [[ "$_code_owner" = "true" ]]; then + echo "ok - pr-quality pull_request rule sets require_code_owner_review = true" + pass_count=$((pass_count + 1)) +else + echo "not ok - pr-quality pull_request rule: require_code_owner_review not true (got: ${_code_owner:-missing})" + fail=1 +fi + # Remaining standard pr-quality pull_request parameters — checked within the # pr-quality ruleset object so a matching field in any other ruleset cannot # produce a false pass. @@ -104,7 +123,6 @@ _jq_check() { } _jq_check '.required_approving_review_count' '1' 'pr-quality requires 1 approving review' -_jq_check '.require_code_owner_review' 'true' 'pr-quality requires code owner review' _jq_check '.require_last_push_approval' 'true' 'pr-quality requires last push approval' _jq_check '.required_review_thread_resolution' 'true' 'pr-quality requires review thread resolution' From bbab7ff1f58997bcc9744993ca848a3492d23b33 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:43:11 +0000 Subject: [PATCH 2/3] chore: dev-lead update (review-changes) [skip ci-relay] --- tests/scripts/apply-rulesets.test.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/scripts/apply-rulesets.test.sh b/tests/scripts/apply-rulesets.test.sh index ae0e38d1..477a1413 100755 --- a/tests/scripts/apply-rulesets.test.sh +++ b/tests/scripts/apply-rulesets.test.sh @@ -89,12 +89,12 @@ fi # The compliance-critical parameter for #480: a code owner review must be # required. Asserted as a strict boolean within the pr-quality ruleset so a # string "true" or the setting appearing in another ruleset cannot pass. -_code_owner=$(printf '%s\n' "$_pr_q_json" | jq -r ' +_code_owner=$(jq -r ' .rules[] | select(.type == "pull_request") | (.parameters.require_code_owner_review // false) | (type == "boolean" and . == true) -') +' <<< "$_pr_q_json") if [[ "$_code_owner" = "true" ]]; then echo "ok - pr-quality pull_request rule sets require_code_owner_review = true" pass_count=$((pass_count + 1)) From c46fd0e9886e6f9a187208d69f7f3fe0dcc7bac7 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 7 Aug 2026 17:16:09 +0000 Subject: [PATCH 3/3] chore: dev-lead update (review-changes) [skip ci-relay] --- pnpm-lock.yaml | 12 ++++++------ pnpm-workspace.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index be71ac90..edeacc67 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -10,7 +10,7 @@ overrides: brace-expansion: '>=5.0.8' ws: '>=8.21.0' form-data: '>=4.0.6' - js-yaml: '>=4.3.0 <5.0.0' + js-yaml: '>=4.3.1' '@babel/core': ^7.29.6 lodash@>=4.0.0 <=4.17.23: '>=4.18.0' tmp: '>=0.2.6' @@ -3309,8 +3309,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.3.0: - resolution: {integrity: sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==} + js-yaml@4.3.1: + resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true jsc-safe-url@0.2.4: @@ -5952,7 +5952,7 @@ snapshots: dependencies: '@babel/code-frame': 7.29.0 chalk: 4.1.2 - js-yaml: 4.3.0 + js-yaml: 4.3.1 '@formatjs/ecma402-abstract@2.3.6': dependencies: @@ -6047,7 +6047,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 4.3.0 + js-yaml: 4.3.1 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.3': {} @@ -9323,7 +9323,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.3.0: + js-yaml@4.3.1: dependencies: argparse: 2.0.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 43be5c0d..63fd4a95 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -8,7 +8,7 @@ overrides: brace-expansion: '>=5.0.8' ws: '>=8.21.0' form-data: '>=4.0.6' - js-yaml: '>=4.3.0 <5.0.0' + js-yaml: '>=4.3.1' '@babel/core': ^7.29.6 'lodash@>=4.0.0 <=4.17.23': '>=4.18.0' tmp: '>=0.2.6'