Re-vendor the ruleset payloads and configure.sh after the promotion - #13
Merged
Conversation
The hub promoted `develop` to `main` as `7194f91` while the previous two convergence pull requests were open, so the ground truth this repo is measured against moved under them. ProjectTemplate#545 takes `bypass_actors` out of all three payloads, and rewrites `configure.sh` around that decision. The rewrite is the substantive half. Apply now reads the live bypass list and writes it back unchanged, because a PUT replaces the whole document and omitting the field would delete the list rather than leave it alone, and it aborts rather than proceeding if that read fails. Check reports the live list and asserts nothing about it. Who may bypass a ruleset decides who the rules do not apply to, which is a decision for the maintainer rather than a value the fleet config hands out. ## What this deliberately does not do Remove the live bypass. Both rulesets here carry the `RepositoryRole` admin entry the old payload granted every repo, and nothing in this change touches it. Removing it is a protected-branch settings write and a decision the hub just declared human, so it is the maintainer's. Worth knowing that the two tools now disagree about that state. `configure.sh check ptr727/Blog release` exits 0 and reports the bypass as unmanaged, while `spec/audit.py` still compares `bypass_actors` and calls the same state a DEFECT on both branches. Raised as ProjectTemplate#554, since it makes every fleet repo carrying a bypass permanently not operational on a field the fleet decided not to manage. ## Verification - All four verbatim units byte-match hub `main` `7194f91` after LF normalization: the three re-vendored here plus `.markdownlint-cli2.jsonc`. - `repo-config/configure.sh check ptr727/Blog release` exits 0 under the rewritten check mode, and reports "bypass list: RepositoryRole 5 always (not managed by this script)" on both rulesets rather than asserting it. - The JSON and editorconfig gates are clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s carried GitHub ruleset payloads and the repo-config/configure.sh apply/check logic to align with the hub’s post-promotion canonical state, specifically removing bypass_actors from the vendored payloads and ensuring configure.sh apply preserves any existing live bypass list rather than managing it.
Changes:
- Remove
bypass_actorsfrom themainanddevelopruleset payload JSON. - Rewrite
configure.sh applyto read and re-write the livebypass_actorslist on ruleset updates (avoiding accidental deletion via PUT replacement semantics). - Update
configure.sh checkto report (but not assert) the live bypass list.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| repo-config/main.json | Removes bypass_actors from the vendored main-branch ruleset payload. |
| repo-config/develop.json | Removes bypass_actors from the vendored develop-branch ruleset payload. |
| repo-config/configure.sh | Preserves live bypass list during ruleset updates; reports bypass list during checks without asserting it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hub promoted
developtomainas7194f91while #11 and #12 were open, so the ground truth this repo is measured against moved under them. ProjectTemplate#545 takesbypass_actorsout of the hub's ruleset payloads and rewritesconfigure.sharound that decision.The diff is exactly three files:
repo-config/develop.json,repo-config/main.json, andrepo-config/configure.sh. The hub carries a third payload,repo-config/operational/develop.json, which this repo does not carry and is not owed, because it is areleaserepo rather than anoperationalone.The rewrite is the substantive half
Who may bypass a ruleset decides who the rules do not apply to, which the hub has now declared a maintainer's decision rather than a value the fleet config hands out.
configure.shwas rewritten to hold that line against a replacing API:PUTreplaces the whole document, so omitting the field would delete the list rather than leave it alone. A failed read aborts rather than proceeding, since applying without it would silently clear the list.What this deliberately does not do
Remove the live bypass. Both rulesets here carry the
RepositoryRoleadmin entry the old payload granted every repo, and nothing in this change touches it. Removing it is a protected-branch settings write and a decision the hub just declared human, so it is yours.The two tools now disagree about that exact state, which is worth knowing before you read a fleet audit:
configure.sh checkspec/audit.pyDEFECT ruleset: develop divergesand the same formainaudit.pystill carriesbypass_actorsinRULESET_SUBSET, so it diffs an absent payload field against the live list and can never agree. Raised as ProjectTemplate#554, because it makes every fleet repo carrying a bypass permanently not operational on a field the fleet just decided not to manage.Also raised, not fixed here
ProjectTemplate#552: the promotion added an audit check flagging any carried
AGENTS.mdthat names the template repo, and the byte-lockedFleet Bootstrapsection this repo carried in #11 names it. A repo carrying the canonical correctly cannot pass, and the only way to pass is to break the byte-lock. Blog is the first repo to carry that section, which is why it surfaced here.Verification
main7194f91after LF normalization..markdownlint-cli2.jsoncwas checked and needed no change, so it is not in the diff. It is this repo's fourth verbatim unit and the promotion did not move it, which is worth stating so a reader can tell it was verified rather than overlooked.repo-config/configure.sh check ptr727/Blog releaseexits 0 under the rewritten check mode, against the live rulesets and settings.🤖 Generated with Claude Code