Skip to content

Compliance: ruleset-drift-pr-quality-require_last_push_approval #539

Closed
#547
Closed
Compliance: ruleset-drift-pr-quality-require_last_push_approval#539
#547
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Aug 14, 2026

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-require_last_push_approval

Detail

Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/google-app-scripts to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    dev-leadFor dev-lead agent pickup
    on Aug 14, 2026

  2. don-petry commented on Aug 14, 2026

    @don-petry
    don-petry
    on Aug 14, 2026
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #539 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

    Scope

    Verify that this repository's codified pr-quality ruleset enforces require_last_push_approval: true and is guarded against drift by a CI test; determine whether any source change is required to bring the codebase into compliance.

    Investigation findings (pre-implementation)

    • The only in-repo codification of this ruleset is scripts/setup-pr-quality-ruleset.sh. Its pull_request rule already sets require_last_push_approval: true (line 68), matching the codified standard.
    • scripts/tests/setup-pr-quality-ruleset.test.js already asserts this value (both individually and via an exact toEqual on all pull_request parameters) and passes.
    • The guard test is wired into npm test via the jest testMatch (**/tests/**/*.test.[jt]s?(x)).
    • The sibling code-quality ruleset uses required_status_checks (no pull_request rule), so it is out of scope.

    Implementation Checklist

    • Locate every in-repo codification of the pr-quality ruleset / require_last_push_approval
    • Confirm the codified value already equals the expected standard (true)
    • Confirm a drift-guard test exists, is CI-wired, and passes
    • Run full verification (test suite, npm run check, dev-lead lint)

    Tests to Write

    • No new tests required: the existing exact-match guard in setup-pr-quality-ruleset.test.js already fails if require_last_push_approval is ever removed or set to false.

    Note on residual drift

    The codebase source of truth is already compliant. The audit finding reflects live GitHub ruleset settings drift (actual false), which converges by running the existing scripts/setup-pr-quality-ruleset.sh (admin/ops action, PUT of the full payload) — not a code change. This may be a re-flag of the codification already added under the guard referenced in the test (#520).

    Test Command

    npm test

  3. don-petry commented on Aug 14, 2026

    @don-petry
    don-petry
    on Aug 14, 2026
    CollaboratorAuthor

    Dev-Lead: Investigation Complete — Codebase Already Compliant

    Summary

    The repository's codified source of truth for the pr-quality ruleset already enforces require_last_push_approval: true. No source change is required to bring the codebase into compliance; the reported drift exists only in the live GitHub ruleset settings and converges by running the existing setup script (admin/ops action).

    Plan Execution

    • Located every in-repo codification of require_last_push_approval / pr-quality
    • Confirmed scripts/setup-pr-quality-ruleset.sh (line 68) codifies require_last_push_approval: true — matches the expected standard
    • Confirmed scripts/tests/setup-pr-quality-ruleset.test.js guards the value (individual assertion + exact toEqual on all pull_request params) and passes
    • Confirmed the guard test runs in CI (jest testMatch covers scripts/tests/)
    • Confirmed sibling code-quality ruleset is out of scope (uses required_status_checks, no pull_request rule)
    • Ran full verification (test suite, npm run check, dev-lead lint) — all green

    Why no code change (TDD exception)

    Per the Phase 2 exception for behavior-preserving cases: the codified value and its drift-guard test are already present and passing. Adding a change would be fabricated work and would violate "do not implement more than the issue requests." The existing exact-match test already fails if require_last_push_approval is ever set to false or removed, so drift of the codified value is protected.

    Test Results

    > google-app-scripts@0.0.0 test
> jest --runInBand

Test Suites: 15 passed, 15 total
Tests:       403 passed, 403 total
Snapshots:   0 total
Time:        5.52 s
Ran all test suites.
    • npm run check: 0 errors (22 pre-existing unused-var warnings in unrelated gmail-to-drive-by-labels tests)
    • bash .dev-lead/scripts/dev-lead-lint.sh: all checks passed

    Files Changed

    • None (codebase already compliant).

    Recommended remediation (live settings — outside a code PR)

    Run the existing codified script against the live repo to converge the drifted GitHub ruleset (requires repo admin):

    bash scripts/setup-pr-quality-ruleset.sh petry-projects/google-app-scripts

    This PUTs the full payload (with require_last_push_approval: true) to the existing pr-quality ruleset. I did not run it here because it mutates live shared repository settings, which is outside the code-change scope of this task and warrants explicit maintainer authorization.

    Notes

    This finding is a re-flag of live-settings drift for a parameter whose codification is already correct (guard added under the referenced #520). Suggest closing #539 once the ops convergence script is run, or converting it to an ops/apply task since there is no code fix to make.

  4. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Aug 18, 2026

  5. don-petry commented on Aug 18, 2026

    @don-petry
    don-petry
    on Aug 18, 2026
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #539 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

    Scope

    Bring the repo's codified pr-quality ruleset into full parity with the standard for require_last_push_approval: true and confirm the setup script reconverges live drift.

    Findings from investigation

    • scripts/setup-pr-quality-ruleset.sh already codifies require_last_push_approval: true in its ruleset payload, and its update path PUTs the payload to reconverge any drifted parameters (idempotent).
    • scripts/tests/setup-pr-quality-ruleset.test.js already asserts require_last_push_approval === true (dedicated + exhaustive parameter tests). All 6 tests pass.
    • The reported drift (actual: false) is in the live GitHub ruleset, not the codified source of truth; it converges when the setup script runs.
    • Remaining gap vs. the codified standard: the script header's reconvergence note names only dismiss_stale_reviews_on_push and omits require_last_push_approval.

    Implementation Checklist

    Tests to Write

    • None required — behavior is already guarded by existing dedicated and exhaustive parameter assertions (documentation-only change, no observable behavior change)

    Test Command

    npx jest scripts/tests/setup-pr-quality-ruleset.test.js and full npm test

  6. don-petry commented on Aug 18, 2026

    @don-petry
    don-petry
    on Aug 18, 2026
    CollaboratorAuthor

    Dev-Lead: Implementation Complete

    Summary

    The repository's codified source of truth was already compliant: scripts/setup-pr-quality-ruleset.sh sets require_last_push_approval: true in its ruleset payload, and its update path PUTs that payload to reconverge any drifted parameters (idempotent). Existing tests already assert the value. The reported actual: false is live GitHub ruleset drift, which converges the next time the setup script runs against the repo — it was not a gap in the codebase.

    To bring the codebase to full parity with the standard (matching the pattern used for #538), I documented require_last_push_approval in the script header's reconvergence note, which previously named only dismiss_stale_reviews_on_push.

    Plan Execution

    • Investigated codification: payload + tests already enforce require_last_push_approval: true
    • Documented require_last_push_approval in the setup script header reconvergence note
    • Verified full test suite, dev-lead lint, and npm run check

    Test Results

    > jest --runInBand

Test Suites: 15 passed, 15 total
Tests:       404 passed, 404 total
Snapshots:   0 total
Time:        5.248 s

dev-lead-lint.sh: all checks passed (shellcheck 4 files, CODEOWNERS OK)
npm run check: exit 0 (prettier --check + eslint; 0 errors, pre-existing warnings only)

    Targeted guard tests (scripts/tests/setup-pr-quality-ruleset.test.js) — 6/6 passing, including:

    • requires last-push approval on the pull_request rule → require_last_push_approval === true
    • has exactly one pull_request rule with all required parameters → exhaustive param match
    • script updates existing rulesets via PUT to enforce compliance

    Files Changed

    • scripts/setup-pr-quality-ruleset.sh: header comment now lists require_last_push_approval (alongside dismiss_stale_reviews_on_push) among the drifted parameters the update path reconverges. No functional change — the payload already codified require_last_push_approval: true.

    Notes

    • No test changes required: the codified value is already guarded by a dedicated assertion and an exhaustive toEqual on the full parameter set. Per the TDD documentation-only exception, no new failing test was written.
    • Live convergence (flipping the actual GitHub ruleset from false → true) requires running scripts/setup-pr-quality-ruleset.sh against the repo with an admin-authenticated gh; that is an infrastructure operation outside this code change.

  7. don-petry commented on Aug 21, 2026

    @don-petry
    don-petry
    on Aug 21, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-08-21)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/google-app-scripts to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  8. don-petry commented on Aug 28, 2026

    @don-petry
    don-petry
    on Aug 28, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-08-28)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/google-app-scripts to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  9. don-petry commented on Aug 31, 2026

    @don-petry
    don-petry
    on Aug 31, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-08-31)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/google-app-scripts to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  10. don-petry commented on Sep 4, 2026

    @don-petry
    don-petry
    on Sep 4, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-09-04)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/google-app-scripts to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  11. don-petry
    added 2 commits that reference this issue on Sep 7, 2026

    fix(ruleset): preserve complete ruleset and validate before update

    4c30383

    feat: implement issue #539 — Compliance: ruleset-drift-pr-quality-req…

    3c2edeb
  12. don-petry
    closed this as completedin #547on Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions