From 888246dc08ec9ed0f0b621727f8f3b250f7faf39 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 18 Aug 2026 20:20:17 +0000 Subject: [PATCH 1/2] =?UTF-8?q?feat:=20implement=20issue=20#418=20?= =?UTF-8?q?=E2=80=94=20Compliance:=20ruleset-bypass-orgadmin-code-quality?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/scripts/apply-code-quality-ruleset.sh | 4 ++-- .github/scripts/tests/apply-code-quality-ruleset.bats | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh index 932f64e6..ff2d69d8 100755 --- a/.github/scripts/apply-code-quality-ruleset.sh +++ b/.github/scripts/apply-code-quality-ruleset.sh @@ -12,7 +12,7 @@ # - dependency-audit / Detect ecosystems dependency-audit.yml, caller job: dependency-audit, reusable job: Detect ecosystems # # Bypass actors configured (required on every ruleset targeting main — see #399): -# - OrganizationAdmin (bypass_mode: always) emergency admin override +# - OrganizationAdmin (actor_id: 0, bypass_mode: always) emergency admin override # - dependabot-automerge-petry (actor_id: 3167543, bypass_mode: always) enables Dependabot auto-merge # # Standard reference: @@ -43,7 +43,7 @@ EXISTING_ID=$(gh api "repos/$REPO/rulesets" \ --jq ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || true) # Required bypass actors per org standard (see #399) -REQUIRED_BYPASS_ORG_ADMIN='{"actor_type":"OrganizationAdmin","bypass_mode":"always"}' +REQUIRED_BYPASS_ORG_ADMIN='{"actor_id":0,"actor_type":"OrganizationAdmin","bypass_mode":"always"}' REQUIRED_BYPASS_DEPENDABOT='{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}' REQUIRED_BYPASS_ACTORS=$(jq -n \ --argjson org_admin "$REQUIRED_BYPASS_ORG_ADMIN" \ diff --git a/.github/scripts/tests/apply-code-quality-ruleset.bats b/.github/scripts/tests/apply-code-quality-ruleset.bats index ef774682..6e92d0e7 100644 --- a/.github/scripts/tests/apply-code-quality-ruleset.bats +++ b/.github/scripts/tests/apply-code-quality-ruleset.bats @@ -74,7 +74,7 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - jq -e '.bypass_actors == [{"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$TEST_TMPDIR/payload.json" + jq -e '.bypass_actors == [{"actor_id":0,"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$TEST_TMPDIR/payload.json" } @test "update preserves existing bypass actors while ensuring OrganizationAdmin is present" { @@ -100,5 +100,5 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$TEST_TMPDIR/payload.json" + jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_id":0,"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$TEST_TMPDIR/payload.json" } From d6dd9971eb75f6b039b4dd5c992246abcee361a3 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 18 Aug 2026 20:44:46 +0000 Subject: [PATCH 2/2] chore: dev-lead update (review-changes) [skip ci-relay] --- .github/scripts/apply-code-quality-ruleset.sh | 4 ++-- .../tests/apply-code-quality-ruleset.bats | 16 ++++------------ 2 files changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/scripts/apply-code-quality-ruleset.sh b/.github/scripts/apply-code-quality-ruleset.sh index ff2d69d8..932f64e6 100755 --- a/.github/scripts/apply-code-quality-ruleset.sh +++ b/.github/scripts/apply-code-quality-ruleset.sh @@ -12,7 +12,7 @@ # - dependency-audit / Detect ecosystems dependency-audit.yml, caller job: dependency-audit, reusable job: Detect ecosystems # # Bypass actors configured (required on every ruleset targeting main — see #399): -# - OrganizationAdmin (actor_id: 0, bypass_mode: always) emergency admin override +# - OrganizationAdmin (bypass_mode: always) emergency admin override # - dependabot-automerge-petry (actor_id: 3167543, bypass_mode: always) enables Dependabot auto-merge # # Standard reference: @@ -43,7 +43,7 @@ EXISTING_ID=$(gh api "repos/$REPO/rulesets" \ --jq ".[] | select(.name == \"$RULESET_NAME\") | .id" 2>/dev/null || true) # Required bypass actors per org standard (see #399) -REQUIRED_BYPASS_ORG_ADMIN='{"actor_id":0,"actor_type":"OrganizationAdmin","bypass_mode":"always"}' +REQUIRED_BYPASS_ORG_ADMIN='{"actor_type":"OrganizationAdmin","bypass_mode":"always"}' REQUIRED_BYPASS_DEPENDABOT='{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}' REQUIRED_BYPASS_ACTORS=$(jq -n \ --argjson org_admin "$REQUIRED_BYPASS_ORG_ADMIN" \ diff --git a/.github/scripts/tests/apply-code-quality-ruleset.bats b/.github/scripts/tests/apply-code-quality-ruleset.bats index 6e92d0e7..069bac28 100644 --- a/.github/scripts/tests/apply-code-quality-ruleset.bats +++ b/.github/scripts/tests/apply-code-quality-ruleset.bats @@ -7,14 +7,6 @@ SCRIPT="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)/apply-code-quality-ruleset.sh" -setup() { - export TEST_TMPDIR="$(mktemp -d)" - export GH_TOKEN="mock-token" -} - -teardown() { - rm -rf "$TEST_TMPDIR" -} assert_required_check() { local context="$1" @@ -62,7 +54,7 @@ assert_required_check() { echo "" return 0 elif [ "$2" = "-X" ] && [ "$3" = "POST" ]; then - cat > "$TEST_TMPDIR/payload.json" + cat > "$BATS_TEST_TMPDIR/payload.json" echo '{"id": 12345}' return 0 fi @@ -74,7 +66,7 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - jq -e '.bypass_actors == [{"actor_id":0,"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$TEST_TMPDIR/payload.json" + jq -e '.bypass_actors == [{"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$BATS_TEST_TMPDIR/payload.json" } @test "update preserves existing bypass actors while ensuring OrganizationAdmin is present" { @@ -88,7 +80,7 @@ assert_required_check() { echo '[{"actor_type":"RepositoryRole","bypass_mode":"pull_request"}]' return 0 elif [ "$2" = "-X" ] && [ "$3" = "PUT" ]; then - cat > "$TEST_TMPDIR/payload.json" + cat > "$BATS_TEST_TMPDIR/payload.json" echo '{}' return 0 fi @@ -100,5 +92,5 @@ assert_required_check() { run bash "$SCRIPT" [ "$status" -eq 0 ] - jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_id":0,"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$TEST_TMPDIR/payload.json" + jq -e '.bypass_actors == [{"actor_type":"RepositoryRole","bypass_mode":"pull_request"},{"actor_type":"OrganizationAdmin","bypass_mode":"always"},{"actor_id":3167543,"actor_type":"Integration","bypass_mode":"always"}]' "$BATS_TEST_TMPDIR/payload.json" }