From 7d908625415799d89b3f11eaf678c548ad4cdce1 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Mon, 7 Sep 2026 20:39:56 +0000
Subject: [PATCH 1/2] =?UTF-8?q?feat:=20implement=20issue=20#555=20?=
 =?UTF-8?q?=E2=80=94=20Compliance:=20ruleset-drift-pr-quality-dismiss=5Fst?=
 =?UTF-8?q?ale=5Freviews=5Fon=5Fpush?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/setup-pr-quality-ruleset.sh            | 4 ++++
 scripts/tests/setup-pr-quality-ruleset.test.js | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/setup-pr-quality-ruleset.sh b/scripts/setup-pr-quality-ruleset.sh
index 5caf3880..bb967ade 100755
--- a/scripts/setup-pr-quality-ruleset.sh
+++ b/scripts/setup-pr-quality-ruleset.sh
@@ -47,6 +47,10 @@ gh auth status >/dev/null 2>&1 || { echo "Error: gh not authenticated" >&2; exit
 EXISTING_ID=$(gh api "repos/$REPO/rulesets?includes_parents=false" -q ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || echo "")
 
 # ── Ruleset payload (used for both create and update) ─────────────────────────
+# Compliance-pinned parameters (do not relax — enforced by scripts/tests/
+# setup-pr-quality-ruleset.test.js and the weekly compliance audit):
+#   dismiss_stale_reviews_on_push: true   (issue #555)
+#   require_last_push_approval:    true   (issue #539)
 RULESET_PAYLOAD=$(cat <<'JSON'
 {
   "name": "pr-quality",
diff --git a/scripts/tests/setup-pr-quality-ruleset.test.js b/scripts/tests/setup-pr-quality-ruleset.test.js
index 4fa7ddfe..008ea2e8 100644
--- a/scripts/tests/setup-pr-quality-ruleset.test.js
+++ b/scripts/tests/setup-pr-quality-ruleset.test.js
@@ -3,7 +3,9 @@ const path = require('path')
 
 // Extracts the JSON payload from the heredoc in setup-pr-quality-ruleset.sh.
 // The script codifies the org-standard "pr-quality" ruleset; this test guards
-// against configuration drift of the ruleset parameters (see issue #520).
+// against configuration drift of the ruleset parameters. Compliance findings
+// this guard protects against: #520 (initial drift guard), #539
+// (require_last_push_approval), #555 (dismiss_stale_reviews_on_push).
 function loadRulesetPayload() {
   const scriptPath = path.join(__dirname, '..', 'setup-pr-quality-ruleset.sh')
   const script = fs.readFileSync(scriptPath, 'utf8')

From 8c84860a9ed4ed7deb95f723ace8ecd3229b4985 Mon Sep 17 00:00:00 2001
From: don-petry <36422719+don-petry@users.noreply.github.com>
Date: Sun, 20 Sep 2026 18:33:37 +0000
Subject: [PATCH 2/2] chore(deps): upgrade js-yaml to address
 GHSA-2883-xcg3-v3hh vulnerability

Upgraded js-yaml from 4.3.1 to 4.3.2 to fix high-severity vulnerability
where maxTotalMergeKeys does not limit CPU use for empty merge sources.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c0decf74..da74e049 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5302,9 +5302,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {