Skip to content

Compliance: ruleset-drift-pr-quality-require_code_owner_review #323

Closed
#352
Closed
Compliance: ruleset-drift-pr-quality-require_code_owner_review#323
#352
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Jul 17, 2026

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-require_code_owner_review

Detail

Ruleset pr-quality parameter require_code_owner_review has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    dev-leadFor dev-lead agent pickup
    on Jul 17, 2026

  2. don-petry commented on Jul 17, 2026

    @don-petry
    don-petry
    on Jul 17, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review

    Scope

    Add a repo-local, idempotent applier script (and static bats test) that converges the pr-quality repository ruleset to the codified standard — restoring require_code_owner_review: true — mirroring the existing apply-code-quality-ruleset.sh reference/fallback pattern.

    Context

    • The codified source of truth is standards/rulesets/pr-quality.json in petry-projects/.github; the org-level scripts/apply-rulesets.sh is canonical.
    • This repo already keeps repo-local reference/fallback appliers (e.g. .github/scripts/apply-code-quality-ruleset.sh) but had none for pr-quality. This change adds the missing pr-quality applier so the repo carries an accurate, runnable representation of the standard.
    • CODEOWNERS already has a catch-all owner, so require_code_owner_review is enforceable once the ruleset parameter is restored.

    Implementation Checklist

    • .github/scripts/apply-pr-quality-ruleset.sh — new idempotent create/update of the pr-quality ruleset using the exact codified payload (require_code_owner_review: true, required_approving_review_count: 1, required_review_thread_resolution: true, dismiss_stale_reviews_on_push: true, require_last_push_approval: true, allowed_merge_methods: ["squash"], bypass actors, ~DEFAULT_BRANCH). Executable, set -euo pipefail, requires GH_TOKEN.

    Tests to Write

    • .github/scripts/tests/apply-pr-quality-ruleset.bats — static content assertions (no live API): script exists + executable, set -euo pipefail, targets petry-projects/markets, ruleset name pr-quality, type: pull_request, and require_code_owner_review set to true.

    Test Command

    bats .github/scripts/tests/ (plus bash .dev-lead/scripts/dev-lead-lint.sh for shellcheck)

  3. don-petry commented on Jul 17, 2026

    @don-petry
    don-petry
    on Jul 17, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Added repo-local idempotent applier .github/scripts/apply-pr-quality-ruleset.sh that converges the pr-quality ruleset, restoring require_code_owner_review: true
    • Added static bats test .github/scripts/tests/apply-pr-quality-ruleset.bats (TDD: written first, confirmed red, then green)
    • Verified the script's payload is byte-for-byte equivalent (order-insensitive) to the codified source of truth standards/rulesets/pr-quality.json in petry-projects/.github

    Approach

    The codified JSON in petry-projects/.github is the source of truth and the org-level scripts/apply-rulesets.sh is canonical. This repo already keeps repo-local reference/fallback appliers (e.g. apply-code-quality-ruleset.sh) but had none for pr-quality. This change adds the missing pr-quality applier, mirroring that established pattern, so the repository carries an accurate, runnable representation of the standard. CODEOWNERS already has a catch-all owner, so require_code_owner_review is enforceable once the parameter is restored.

    Test Results

    $ bats .github/scripts/tests/apply-pr-quality-ruleset.bats
1..9
ok 1 script exists and is executable
ok 2 script uses set -euo pipefail
ok 3 script targets petry-projects/markets repo
ok 4 script requires GH_TOKEN
ok 5 script manages the pr-quality ruleset
ok 6 script configures a pull_request rule
ok 7 script sets require_code_owner_review to true (issue #323)
ok 8 script codifies the remaining pr-quality parameters
ok 9 script is idempotent (creates or updates by existing id)

$ shellcheck --severity=warning -x .github/scripts/apply-pr-quality-ruleset.sh
(clean)

$ bash .dev-lead/scripts/dev-lead-lint.sh
[lint] all checks passed

# Payload equivalence vs standards/rulesets/pr-quality.json:
PAYLOAD MATCHES CODIFIED STANDARD (order-insensitive)

    Note: two pre-existing failures in the unrelated pr-review-mention-workflow.bats are environmental (the runner's yq is the Python variant, which uses different query syntax than the mikefarah yq those tests expect). They are untouched by this change.

    Files Changed

    • .github/scripts/apply-pr-quality-ruleset.sh (new): idempotent create/update of the pr-quality ruleset with the full codified parameter set — required_approving_review_count: 1, require_code_owner_review: true, required_review_thread_resolution: true, dismiss_stale_reviews_on_push: true, require_last_push_approval: true, allowed_merge_methods: ["squash"], standard bypass actors, ~DEFAULT_BRANCH.
    • .github/scripts/tests/apply-pr-quality-ruleset.bats (new): static content assertions, no live API calls.

    Notes

    • A ruleset update is a whole-object PUT/POST (not a per-parameter PATCH), so the script necessarily codifies the complete pr-quality payload; it is verified identical to the org standard rather than adding anything beyond it.
    • Actual server-side convergence still requires running the canonical org apply-rulesets.sh (or this repo-local fallback with an administration:write token); this change ensures the repo's codified representation is correct and runnable.
  4. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jul 21, 2026

  5. don-petry commented on Jul 21, 2026

    @don-petry
    don-petry
    on Jul 21, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review

    Scope

    Codify the pr-quality repository ruleset (with require_code_owner_review: true) as a repo-local, idempotent apply script plus a bats test suite, mirroring the existing apply-code-quality-ruleset.sh pattern, so the standard is version-controlled and can be applied to converge the repo.

    Background

    The compliance finding reports the pr-quality ruleset parameter require_code_owner_review drifted from true (expected) to false (actual). The codified source of truth is petry-projects/.github/standards/rulesets/pr-quality.json. This repo already codifies its code-quality ruleset in a repo-local fallback script (.github/scripts/apply-code-quality-ruleset.sh); there is no equivalent for pr-quality yet. The org's apply-rulesets.sh (canonical) plus this repo-local script converge the live setting; applying the live GitHub setting itself requires an admin token and is out of scope for this code change.

    Implementation Checklist

    • .github/scripts/apply-pr-quality-ruleset.sh — new idempotent create/update script for the pr-quality ruleset matching the codified standard (require_code_owner_review: true, required_approving_review_count: 1, required_review_thread_resolution: true, dismiss_stale_reviews_on_push: true, require_last_push_approval: true, allowed_merge_methods: ["squash"], bypass actors, ~DEFAULT_BRANCH condition)

    Tests to Write

    • .github/scripts/tests/apply-pr-quality-ruleset.bats — static-content assertions: script exists/executable, set -euo pipefail, targets petry-projects/markets, declares pr-quality ruleset, requires GH_TOKEN, and asserts require_code_owner_review is set to true (the drifted parameter) plus the other codified pull_request parameters

    Test Command

    bats .github/scripts/tests/*.bats (plus shellcheck --severity=warning -x .github/scripts/apply-pr-quality-ruleset.sh and bash .dev-lead/scripts/dev-lead-lint.sh)

  6. don-petry commented on Jul 21, 2026

    @don-petry
    don-petry
    on Jul 21, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Created .github/scripts/apply-pr-quality-ruleset.sh — idempotent create/update script for the pr-quality ruleset, codifying require_code_owner_review: true (the drifted parameter) plus the full pull_request rule from the org standard
    • Created .github/scripts/tests/apply-pr-quality-ruleset.bats — 12 static-content assertions (TDD: written first, confirmed red, then green)

    Approach

    The pr-quality parameter require_code_owner_review drifted to false; expected true. This repo already codifies its code-quality ruleset as a repo-local, idempotent fallback script (apply-code-quality-ruleset.sh) but had no pr-quality equivalent. I mirrored that established pattern, sourcing the exact ruleset shape from the codified standard petry-projects/.github/standards/rulesets/pr-quality.json (fetched directly to verify every value). The org's canonical apply-rulesets.sh plus this repo-local script converge the live GitHub setting.

    Codified pull_request parameters: required_approving_review_count: 1, require_code_owner_review: true, required_review_thread_resolution: true, dismiss_stale_reviews_on_push: true, require_last_push_approval: true, allowed_merge_methods: ["squash"], with the standard's bypass_actors and ~DEFAULT_BRANCH condition.

    Test Results

    ok 23 script disables Claude (1236702) auto-trigger
ok 24 script uses set -euo pipefail
ok 25 script targets petry-projects/markets repo
ok 26 script wires in secret_scanning_non_provider_patterns enablement (issue #227)
ok 27 script exists and is executable
ok 28 script uses set -euo pipefail
ok 29 script targets petry-projects/markets repo
ok 30 script PATCHes secret_scanning_non_provider_patterns to enabled
ok 31 script requires GH_TOKEN
ok 32 workflow file exists
ok 33 workflow is valid YAML
ok 34 pr-review-mention job skips Bot-typed senders (issue #307 fix)
ok 35 uses: ref stays pinned to the pr-review-mention/v2-stable channel
ok 36 trigger events are unchanged
ok 37 job-level pull-requests: write permission is preserved

    Also verified: shellcheck --severity=warning -x clean on the new script; jq payload validates and emits require_code_owner_review = true; bash .dev-lead/scripts/dev-lead-lint.sh passes.

    Files Changed

    • .github/scripts/apply-pr-quality-ruleset.sh (new): idempotent script that creates/updates the pr-quality ruleset per the codified standard
    • .github/scripts/tests/apply-pr-quality-ruleset.bats (new): static-assertion test suite for the script

    Notes

    • Applying the live GitHub ruleset setting requires an administration:write admin token and is out of scope for this code change; the CI workflow / apply-repo-settings mechanism with GH_TOKEN_ADMIN handles live application. This change codifies and tests the standard so it is version-controlled and reproducible.
    • The repo's bats tests are static-content assertions (no live API calls), consistent with all existing apply-*-ruleset tests.
    • Follow-up (optional): wire apply-pr-quality-ruleset.sh into a workflow if the org wants automated live application, matching whatever mechanism drives apply-code-quality-ruleset.sh.

  7. don-petry commented on Jul 24, 2026

    @don-petry
    don-petry
    on Jul 24, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-07-24)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_code_owner_review has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  8. don-petry commented on Jul 31, 2026

    @don-petry
    don-petry
    on Jul 31, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-07-31)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_code_owner_review has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  9. don-petry
    added 2 commits that reference this issue on Aug 4, 2026

    feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-req…

    9f2f315

    feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-req…

    f186806
  10. don-petry
    closed this as completedin #352on Aug 4, 2026
  11. don-petry
    added 2 commits that reference this issue on Aug 14, 2026

    feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-req…

    d12178f

    feat: implement issue #400 — Compliance: ruleset-bypass-dependabot-co…

    af4d65d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions