Skip to content

Compliance: ruleset-drift-pr-quality-require_last_push_approval #325

Closed
#355
Closed
Compliance: ruleset-drift-pr-quality-require_last_push_approval#325
#355
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on Jul 17, 2026

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-require_last_push_approval

Detail

Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    dev-leadFor dev-lead agent pickup
    on Jul 17, 2026

  2. don-petry commented on Jul 17, 2026

    @don-petry
    don-petry
    on Jul 17, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

    Scope

    Codify the pr-quality repository ruleset (including require_last_push_approval: true) as a repo-local, idempotent fallback script — mirroring the existing apply-code-quality-ruleset.sh pattern — so the drifted parameter can be re-converged from within this repo.

    Root Cause

    This repo maintains repo-local fallback scripts for applying GitHub rulesets (apply-code-quality-ruleset.sh, apply-repo-settings.sh). There is no equivalent for the pr-quality ruleset, so nothing in-repo re-applies require_last_push_approval: true, allowing it to drift to false. The canonical source of truth remains the org standards/rulesets/pr-quality.json; this script is a repo-local reference/fallback matching that JSON exactly.

    Implementation Checklist

    • Create .github/scripts/apply-pr-quality-ruleset.sh — idempotent create/update of the pr-quality ruleset with parameters matching the canonical org JSON: required_approving_review_count: 1, require_code_owner_review: true, required_review_thread_resolution: true, dismiss_stale_reviews_on_push: true, require_last_push_approval: true, allowed_merge_methods: ["squash"], plus bypass actors (OrganizationAdmin + dependabot-automerge Integration id 3167543)
    • Ensure script is executable and passes shellcheck (set -euo pipefail, targets petry-projects/markets)

    Tests to Write

    • .github/scripts/tests/apply-pr-quality-ruleset.bats — static-content assertions: script exists & executable, ruleset name is pr-quality, require_last_push_approval is true, other pr-quality params present, set -euo pipefail, targets petry-projects/markets

    Test Command

    bats .github/scripts/tests/apply-pr-quality-ruleset.bats (plus bash .dev-lead/scripts/dev-lead-lint.sh and shellcheck)

  3. don-petry commented on Jul 17, 2026

    @don-petry
    don-petry
    on Jul 17, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Diagnosed root cause: repo keeps repo-local fallback ruleset scripts (apply-code-quality-ruleset.sh, apply-repo-settings.sh) but had no pr-quality equivalent, so nothing in-repo re-applied require_last_push_approval: true, allowing drift to false.
    • Added .github/scripts/apply-pr-quality-ruleset.sh — idempotent create/update of the pr-quality ruleset, payload matching the canonical org standards/rulesets/pr-quality.json verbatim (incl. require_last_push_approval: true).
    • Added .github/scripts/tests/apply-pr-quality-ruleset.bats (TDD: written first, confirmed red, then green).
    • Verified: shellcheck clean, bash syntax OK, jq payload validates, dev-lead-lint passes.

    Test Results

    $ bats .github/scripts/tests/apply-pr-quality-ruleset.bats
1..10
ok 1 script exists and is executable
ok 2 script uses set -euo pipefail
ok 3 script targets petry-projects/markets repo
ok 4 script manages the pr-quality ruleset
ok 5 script codifies require_last_push_approval as true (issue #325)
ok 6 script sets the full pr-quality pull_request parameters
ok 7 script uses the pull_request rule type
ok 8 script requires GH_TOKEN
ok 9 script is idempotent (checks for existing ruleset id)
ok 10 script generates valid JSON payload that matches the canonical pr-quality ruleset

$ shellcheck --severity=warning -x .github/scripts/apply-pr-quality-ruleset.sh   # PASS
$ bash .dev-lead/scripts/dev-lead-lint.sh                                        # all checks passed

    Files Changed

    • .github/scripts/apply-pr-quality-ruleset.sh (new): idempotent script that creates/updates the pr-quality ruleset with the compliant require_last_push_approval: true and the full canonical parameter set (required_approving_review_count: 1, require_code_owner_review: true, required_review_thread_resolution: true, dismiss_stale_reviews_on_push: true, allowed_merge_methods: ["squash"]) plus bypass actors (OrganizationAdmin + dependabot-automerge Integration id 3167543). Run with GH_TOKEN=<admin-token> bash .github/scripts/apply-pr-quality-ruleset.sh to converge.
    • .github/scripts/tests/apply-pr-quality-ruleset.bats (new): static-content + payload assertions guarding the compliance parameter.

    Notes

    • The canonical source of truth remains the org standards/rulesets/pr-quality.json; this repo-local script is a reference/fallback mirroring the existing apply-code-quality-ruleset.sh pattern. Applying the ruleset to the live GitHub repo requires an admin token and is out of scope for this file-only change.
    • Two failures in the unrelated pr-review-mention-workflow.bats (tests for pr-review-mention.yml, not touched here) are pre-existing yq-flavor/environment mismatches, independent of this change (only two new files were added).
  4. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jul 21, 2026

  5. don-petry commented on Jul 21, 2026

    @don-petry
    don-petry
    on Jul 21, 2026
    ContributorAuthor

    Dev-Lead Implementation Plan

    Issue: #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

    Scope

    Codify the pr-quality repository ruleset as a repo-local, idempotent reference/fallback script (mirroring the existing apply-code-quality-ruleset.sh pattern) so require_last_push_approval is set to true per the codified standard (petry-projects/.github/standards/rulesets/pr-quality.json, source of truth #575/#580).

    Root Cause

    The pr-quality ruleset is managed by the org-level canonical tool; this repo has no repo-local reference script for it. The drift finding (require_last_push_approval expected true, actual false) is remediated by codifying the full ruleset locally with the correct parameter, matching the established code-quality pattern.

    Implementation Checklist

    • .github/scripts/apply-pr-quality-ruleset.sh — new idempotent create/update script for the pr-quality ruleset (pull_request rule) with require_last_push_approval: true and all other codified parameters/bypass actors from the canonical JSON
    • .github/scripts/tests/apply-pr-quality-ruleset.bats — static content assertions (no live API calls)

    Tests to Write

    • script exists and is executable
    • uses set -euo pipefail
    • targets petry-projects/markets
    • declares the pr-quality ruleset
    • sets require_last_push_approval: true (the drifted parameter)
    • codifies required_approving_review_count: 1, require_code_owner_review, required_review_thread_resolution, dismiss_stale_reviews_on_push, allowed_merge_methods: ["squash"]

    Test Command

    bats .github/scripts/tests/ (plus shellcheck and .dev-lead/scripts/dev-lead-lint.sh)

  6. don-petry commented on Jul 21, 2026

    @don-petry
    don-petry
    on Jul 21, 2026
    ContributorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Added .github/scripts/apply-pr-quality-ruleset.sh — idempotent create/update of the pr-quality ruleset with require_last_push_approval: true
    • Added .github/scripts/tests/apply-pr-quality-ruleset.bats — static content assertions (no live API calls)
    • Verified full bats suite, shellcheck, and dev-lead-lint all pass

    Root Cause & Fix

    The pr-quality ruleset is managed by the org-level canonical tool (petry-projects/.github/scripts/apply-rulesets.sh); this repo previously had no repo-local reference script for it (unlike code-quality). The drift (require_last_push_approval expected true, actual false) is remediated by codifying the full pr-quality ruleset locally — mirroring the existing apply-code-quality-ruleset.sh pattern (#326) — with all parameters from the source-of-truth JSON (standards/rulesets/pr-quality.json, #575/#580), including require_last_push_approval: true. Running the script with an admin GH_TOKEN converges the live ruleset.

    Test Results

    1..11
ok 1 script exists and is executable
ok 2 script uses set -euo pipefail
ok 3 script targets petry-projects/markets repo
ok 4 script declares the pr-quality ruleset
ok 5 script declares a pull_request rule
ok 6 script sets require_last_push_approval to true (issue #325)
ok 7 script requires 1 approving review
ok 8 script requires code owner review
ok 9 script requires review thread resolution
ok 10 script dismisses stale reviews on push
ok 11 script restricts allowed merge methods to squash

    ShellCheck (--severity=warning -x): clean (0 warnings)

    Files Changed

    • .github/scripts/apply-pr-quality-ruleset.sh: new idempotent reference/fallback script codifying the pr-quality ruleset (pull_request rule) with require_last_push_approval: true, required_approving_review_count: 1, require_code_owner_review, required_review_thread_resolution, dismiss_stale_reviews_on_push, allowed_merge_methods: ["squash"], and the canonical bypass actors (OrganizationAdmin + Integration 3167543)
    • .github/scripts/tests/apply-pr-quality-ruleset.bats: 11 static assertions covering the drifted parameter and all other codified params

    Notes

    • Followed the established repo-local pattern (apply-code-quality-ruleset.sh): no workflow wiring added, as the sibling ruleset script is likewise a standalone reference/fallback and the org-level tool remains canonical.
    • Tests are static-content assertions (no live GitHub API calls), consistent with the existing ruleset test convention.
    • Applying to the live repo requires an admin GH_TOKEN (administration:write) and is out of scope for this code change.

  7. don-petry commented on Jul 24, 2026

    @don-petry
    don-petry
    on Jul 24, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-07-24)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  8. don-petry commented on Jul 31, 2026

    @don-petry
    don-petry
    on Jul 31, 2026
    ContributorAuthor

    Weekly Compliance Audit (2026-07-31)

    This finding is still open.

    Detail: Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

    Standard: standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

  9. don-petry
    added a commit that references this issue on Aug 7, 2026

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    a48a934
  10. don-petry
    closed this as completedin #355on Aug 7, 2026
  11. don-petry
    added a commit that references this issue on Aug 7, 2026

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    93726a6
  12. don-petry
    added 2 commits that reference this issue on Aug 14, 2026

    feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-req…

    25b4835

    feat: implement issue #400 — Compliance: ruleset-bypass-dependabot-co…

    af4d65d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions