From 7018c33e88dc530fd737ee91c4fdecf28644f769 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:28:48 +0000 Subject: [PATCH 1/3] =?UTF-8?q?feat:=20implement=20issue=20#399=20?= =?UTF-8?q?=E2=80=94=20Compliance:=20ruleset-bypass-orgadmin-code-quality?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/scripts/apply-code-quality-ruleset.sh | 11 ++++++- .../tests/apply-code-quality-ruleset.bats | 32 +++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh index 1e1dd419..5e642bf7 100755 --- a/.github/scripts/apply-code-quality-ruleset.sh +++ b/.github/scripts/apply-code-quality-ruleset.sh @@ -11,8 +11,12 @@ # - agent-shield / AgentShield agent-shield.yml, caller job: agent-shield, reusable job: AgentShield # - dependency-audit / Detect ecosystems dependency-audit.yml, caller job: dependency-audit, reusable job: Detect ecosystems # +# Bypass actors configured (required on every ruleset targeting main — see #399): +# - OrganizationAdmin (bypass_mode: always) emergency admin override +# # Standard reference: # https://github.com/petry-projects/.github/blob/main/standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories +# https://github.com/petry-projects/.github/blob/main/standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main # # Usage: # GH_TOKEN= bash .github/scripts/apply-code-quality-ruleset.sh @@ -61,7 +65,12 @@ PAYLOAD=$(jq -n '{ } } ], - bypass_actors: [] + bypass_actors: [ + { + actor_type: "OrganizationAdmin", + bypass_mode: "always" + } + ] }') if [ -n "$EXISTING_ID" ]; then diff --git a/.github/scripts/tests/apply-code-quality-ruleset.bats b/.github/scripts/tests/apply-code-quality-ruleset.bats index b6836b93..a2909c10 100644 --- a/.github/scripts/tests/apply-code-quality-ruleset.bats +++ b/.github/scripts/tests/apply-code-quality-ruleset.bats @@ -7,6 +7,15 @@ SCRIPT="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)/apply-code-quality-ruleset.sh" +setup() { + export BATS_TMPDIR="$(mktemp -d)" + export GH_TOKEN="mock-token" +} + +teardown() { + rm -rf "$BATS_TMPDIR" +} + assert_required_check() { local context="$1" grep -qE "context:\s*\"$context\"" "$SCRIPT" @@ -44,3 +53,26 @@ assert_required_check() { @test "script requires the dependency-audit / Detect ecosystems status check" { assert_required_check "dependency-audit / Detect ecosystems" } + +@test "payload includes the OrganizationAdmin bypass actor with bypass_mode always" { + gh() { + if [ "$1" = "api" ]; then + if [ "$2" = "repos/petry-projects/markets/rulesets" ]; then + echo "" + return 0 + elif [ "$2" = "-X" ] && [ "$3" = "POST" ]; then + cat > "$BATS_TMPDIR/payload.json" + echo '{"id": 12345}' + return 0 + fi + fi + command gh "$@" + } + export -f gh + + run bash "$SCRIPT" + [ "$status" -eq 0 ] + + [ "$(jq -r '.bypass_actors[0].actor_type' "$BATS_TMPDIR/payload.json")" = "OrganizationAdmin" ] + [ "$(jq -r '.bypass_actors[0].bypass_mode' "$BATS_TMPDIR/payload.json")" = "always" ] +} From 4772fff0a88a968c37d5e75c1e2f5ab078f8c219 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:37:51 +0000 Subject: [PATCH 2/3] chore: dev-lead update (review-changes) [skip ci-relay] --- .github/scripts/apply-code-quality-ruleset.sh | 23 +++++++---- .../tests/apply-code-quality-ruleset.bats | 41 +++++++++++++------ 2 files changed, 45 insertions(+), 19 deletions(-) diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh index 5e642bf7..df6b7504 100755 --- a/.github/scripts/apply-code-quality-ruleset.sh +++ b/.github/scripts/apply-code-quality-ruleset.sh @@ -41,7 +41,21 @@ export GH_TOKEN EXISTING_ID=$(gh api "repos/$REPO/rulesets" \ --jq ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || true) -PAYLOAD=$(jq -n '{ +# Required bypass actor per org standard (see #399) +REQUIRED_BYPASS='{"actor_type":"OrganizationAdmin","bypass_mode":"always"}' + +# When updating an existing ruleset, fetch its current bypass actors and merge them +# with the required actor so that other legitimate bypass actors are not silently removed. +if [ -n "$EXISTING_ID" ]; then + EXISTING_BYPASS=$(gh api "repos/$REPO/rulesets/$EXISTING_ID" \ + --jq '.bypass_actors // []' 2>/dev/null || echo "[]") + BYPASS_ACTORS=$(echo "$EXISTING_BYPASS" | \ + jq --argjson req "$REQUIRED_BYPASS" 'map(select(.actor_type != $req.actor_type)) + [$req]') +else + BYPASS_ACTORS=$(jq -n --argjson req "$REQUIRED_BYPASS" '[$req]') +fi + +PAYLOAD=$(jq -n --argjson bypass_actors "$BYPASS_ACTORS" '{ name: "code-quality", target: "branch", enforcement: "active", @@ -65,12 +79,7 @@ PAYLOAD=$(jq -n '{ } } ], - bypass_actors: [ - { - actor_type: "OrganizationAdmin", - bypass_mode: "always" - } - ] + bypass_actors: $bypass_actors }') if [ -n "$EXISTING_ID" ]; then diff --git a/.github/scripts/tests/apply-code-quality-ruleset.bats b/.github/scripts/tests/apply-code-quality-ruleset.bats index a2909c10..febe813a 100644 --- a/.github/scripts/tests/apply-code-quality-ruleset.bats +++ b/.github/scripts/tests/apply-code-quality-ruleset.bats @@ -7,15 +7,6 @@ SCRIPT="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)/apply-code-quality-ruleset.sh" -setup() { - export BATS_TMPDIR="$(mktemp -d)" - export GH_TOKEN="mock-token" -} - -teardown() { - rm -rf "$BATS_TMPDIR" -} - assert_required_check() { local context="$1" grep -qE "context:\s*\"$context\"" "$SCRIPT" @@ -55,13 +46,14 @@ assert_required_check() { } @test "payload includes the OrganizationAdmin bypass actor with bypass_mode always" { + export GH_TOKEN="mock-token" gh() { if [ "$1" = "api" ]; then if [ "$2" = "repos/petry-projects/markets/rulesets" ]; then echo "" return 0 elif [ "$2" = "-X" ] && [ "$3" = "POST" ]; then - cat > "$BATS_TMPDIR/payload.json" + cat > "$BATS_TEST_TMPDIR/payload.json" echo '{"id": 12345}' return 0 fi @@ -73,6 +65,31 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - [ "$(jq -r '.bypass_actors[0].actor_type' "$BATS_TMPDIR/payload.json")" = "OrganizationAdmin" ] - [ "$(jq -r '.bypass_actors[0].bypass_mode' "$BATS_TMPDIR/payload.json")" = "always" ] + jq -e '.bypass_actors == [{"actor_type": "OrganizationAdmin", "bypass_mode": "always"}]' "$BATS_TEST_TMPDIR/payload.json" +} + +@test "update preserves existing bypass actors while ensuring OrganizationAdmin is present" { + export GH_TOKEN="mock-token" + gh() { + if [ "$1" = "api" ]; then + if [ "$2" = "repos/petry-projects/markets/rulesets" ]; then + echo "999" + return 0 + elif [ "$2" = "repos/petry-projects/markets/rulesets/999" ] && [ "$3" = "--jq" ]; then + echo '[{"actor_type":"RepositoryRole","bypass_mode":"pull_request"}]' + return 0 + elif [ "$2" = "-X" ] && [ "$3" = "PUT" ]; then + cat > "$BATS_TEST_TMPDIR/payload.json" + echo '{}' + return 0 + fi + fi + command gh "$@" + } + export -f gh + + run bash "$SCRIPT" + [ "$status" -eq 0 ] + + jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_type":"OrganizationAdmin","bypass_mode":"always"}]' "$BATS_TEST_TMPDIR/payload.json" } From e3e884d538af101c73871f0c58065d2765b288c1 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Fri, 7 Aug 2026 13:49:21 +0000 Subject: [PATCH 3/3] chore: dev-lead update (review-changes) [skip ci-relay] --- .github/scripts/apply-code-quality-ruleset.sh | 22 ++++++++++++++----- .../tests/apply-code-quality-ruleset.bats | 4 ++-- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh index df6b7504..932f64e6 100755 --- a/.github/scripts/apply-code-quality-ruleset.sh +++ b/.github/scripts/apply-code-quality-ruleset.sh @@ -12,7 +12,8 @@ # - dependency-audit / Detect ecosystems dependency-audit.yml, caller job: dependency-audit, reusable job: Detect ecosystems # # Bypass actors configured (required on every ruleset targeting main — see #399): -# - OrganizationAdmin (bypass_mode: always) emergency admin override +# - OrganizationAdmin (bypass_mode: always) emergency admin override +# - dependabot-automerge-petry (actor_id: 3167543, bypass_mode: always) enables Dependabot auto-merge # # Standard reference: # https://github.com/petry-projects/.github/blob/main/standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories @@ -41,18 +42,27 @@ export GH_TOKEN EXISTING_ID=$(gh api "repos/$REPO/rulesets" \ --jq ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || true) -# Required bypass actor per org standard (see #399) -REQUIRED_BYPASS='{"actor_type":"OrganizationAdmin","bypass_mode":"always"}' +# Required bypass actors per org standard (see #399) +REQUIRED_BYPASS_ORG_ADMIN='{"actor_type":"OrganizationAdmin","bypass_mode":"always"}' +REQUIRED_BYPASS_DEPENDABOT='{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}' +REQUIRED_BYPASS_ACTORS=$(jq -n \ + --argjson org_admin "$REQUIRED_BYPASS_ORG_ADMIN" \ + --argjson dependabot "$REQUIRED_BYPASS_DEPENDABOT" \ + '[$org_admin, $dependabot]') # When updating an existing ruleset, fetch its current bypass actors and merge them -# with the required actor so that other legitimate bypass actors are not silently removed. +# with the required actors so that other legitimate bypass actors are not silently removed. if [ -n "$EXISTING_ID" ]; then EXISTING_BYPASS=$(gh api "repos/$REPO/rulesets/$EXISTING_ID" \ --jq '.bypass_actors // []' 2>/dev/null || echo "[]") BYPASS_ACTORS=$(echo "$EXISTING_BYPASS" | \ - jq --argjson req "$REQUIRED_BYPASS" 'map(select(.actor_type != $req.actor_type)) + [$req]') + jq --argjson req "$REQUIRED_BYPASS_ACTORS" \ + 'map(select( + .actor_type != "OrganizationAdmin" and + (.actor_type != "Integration" or .actor_id != 3167543) + )) + $req') else - BYPASS_ACTORS=$(jq -n --argjson req "$REQUIRED_BYPASS" '[$req]') + BYPASS_ACTORS=$REQUIRED_BYPASS_ACTORS fi PAYLOAD=$(jq -n --argjson bypass_actors "$BYPASS_ACTORS" '{ diff --git a/.github/scripts/tests/apply-code-quality-ruleset.bats b/.github/scripts/tests/apply-code-quality-ruleset.bats index febe813a..1a2b9ff8 100644 --- a/.github/scripts/tests/apply-code-quality-ruleset.bats +++ b/.github/scripts/tests/apply-code-quality-ruleset.bats @@ -65,7 +65,7 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - jq -e '.bypass_actors == [{"actor_type": "OrganizationAdmin", "bypass_mode": "always"}]' "$BATS_TEST_TMPDIR/payload.json" + jq -e '.bypass_actors == [{"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$BATS_TEST_TMPDIR/payload.json" } @test "update preserves existing bypass actors while ensuring OrganizationAdmin is present" { @@ -91,5 +91,5 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_type":"OrganizationAdmin","bypass_mode":"always"}]' "$BATS_TEST_TMPDIR/payload.json" + jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$BATS_TEST_TMPDIR/payload.json" }