Compliance: ruleset-drift-pr-quality-require_last_push_approval #520

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Aug 7, 2026
2. don-petry commented on Aug 7, 2026

   

   don-petry

   on Aug 7, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #520 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

   Scope

   Bring the codified pr-quality ruleset into compliance by setting require_last_push_approval to true in scripts/setup-pr-quality-ruleset.sh, and add a regression test that guards against future drift of this parameter.

   Root Cause

   scripts/setup-pr-quality-ruleset.sh codifies the ruleset JSON payload with "require_last_push_approval": false. The org standard requires true. This is the in-repo source of truth that the compliance audit compares against.

   Implementation Checklist

   • scripts/setup-pr-quality-ruleset.sh — change "require_last_push_approval": false to true

   Tests to Write

   • scripts/tests/setup-pr-quality-ruleset.test.js — parse the ruleset JSON payload from the script and assert the pull_request rule sets require_last_push_approval: true (fails before the fix, passes after)

   Test Command

   npm test
3. don-petry commented on Aug 7, 2026

   

   don-petry

   on Aug 7, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Plan Execution

   • Identified the in-repo source of truth: scripts/setup-pr-quality-ruleset.sh codifies the pr-quality ruleset payload
   • Wrote a failing regression test asserting require_last_push_approval: true (red)
   • Changed "require_last_push_approval": false → true in the codified payload (green)
   • Ran full test suite, coverage, dev-lead lint, and npm run check

   Test Results

   Test Suites: 15 passed, 15 total
   Tests:       394 passed, 394 total
   
   dev-lead lint: all checks passed (shellcheck 4 files, CODEOWNERS OK)
   npm run check: 0 errors (22 pre-existing warnings in src/, unrelated)
   coverage: thresholds met (lines 99 / stmts 95 / funcs 95 / branches 85)
   

   Files Changed

   • scripts/setup-pr-quality-ruleset.sh: set require_last_push_approval to true in the codified pr-quality ruleset JSON payload, converging with the org standard
   • scripts/tests/setup-pr-quality-ruleset.test.js (new): parses the ruleset JSON from the script and asserts require_last_push_approval: true, guarding against future drift of this parameter

   Notes

   • The live GitHub ruleset itself is reconciled by running scripts/setup-pr-quality-ruleset.sh (or the org-level apply-rulesets.sh) — that is a runtime/API operation handled outside this repo's code. This change corrects the codified source of truth that the compliance audit compares against.
   • No behavioral code changed; the added test is a config-drift guard directly relevant to this compliance finding.
4. don-petry

   added a commit that references this issue on Aug 7, 2026

   feat: implement issue #520 — Compliance: ruleset-drift-pr-quality-req…

   ...

   fa282f6
5. don-petry

   closed this as completedin #522on Aug 7, 2026