|
| 1 | +--- |
| 2 | +# This repository's OWN settings. The fleet's central settings-repos heal |
| 3 | +# applies the six-layer merge of this file with the fleet layers; the sync |
| 4 | +# renders the same merge into .github/settings.yml. |
| 5 | +# Rendered once, repo-owned: template sync never rewrites it. Fleet defaults |
| 6 | +# merge UNDER this file - keys here win, null opts out, labels replace by |
| 7 | +# name, rulesets MERGE by name (rules append by type, nested objects merge |
| 8 | +# key by key, other arrays replace wholesale). The fleet invariants (squash-only merging, the main |
| 9 | +# and non-bypassable rulesets) sit ABOVE and cannot be overridden. |
| 10 | +# Undeclared labels are deleted against the MERGED roster; undeclared |
| 11 | +# rulesets are left alone. |
| 12 | +# |
| 13 | +# The fleet layers already carry everything this repository used to declare |
| 14 | +# by hand: the repository policy block, the dependabot labels (dependencies, |
| 15 | +# github_actions, javascript), the triage trio, the release-please labels, |
| 16 | +# the nightly and fuzzer tracking labels (nightly-failure, fuzz-nightly), |
| 17 | +# and the main ruleset with its code_scanning, code_quality, and |
| 18 | +# copilot_code_review rules. |
| 19 | + |
| 20 | +repository: |
| 21 | + description: "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more. A loud, stateless Probot Settings replacement." |
| 22 | + # Declared even when empty: the apply manages only declared keys, so |
| 23 | + # this keeps it healing out-of-band edits. |
| 24 | + homepage: "" |
| 25 | + topics: github-action, repository-settings, settings-as-code, configuration-as-code, probot-settings, rulesets, branch-protection, labels |
| 26 | + private: false |
| 27 | + |
| 28 | +labels: |
| 29 | + # e2e-nightly.yml's file-fuzz-issue.ts files under this label, so it must |
| 30 | + # survive the label sync. |
| 31 | + - name: e2e-fuzz |
| 32 | + color: "B60205" |
| 33 | + description: Automated e2e nightly failure |
| 34 | + |
| 35 | +rulesets: |
| 36 | + # NARROWS the release-please module's release-tags ruleset: the fleet |
| 37 | + # declares it over `v*`, which would also freeze the moving major tag |
| 38 | + # (v2) that update-release.yml force-moves with the Actions token on |
| 39 | + # every release. A same-name ruleset merges key by key and an array |
| 40 | + # replaces wholesale, so this entry swaps only the include list and |
| 41 | + # inherits everything else (rules, enforcement, bypass) from the fleet. |
| 42 | + # The vX.Y.Z tags stay immutable: each points at a commit carrying the |
| 43 | + # built bundle that template-sync workflow pins and release artifacts |
| 44 | + # reference - on the `build` branch (the release commit's tree without its |
| 45 | + # workflows, plus the bundle) from now on; the tags cut before that branch |
| 46 | + # existed point at main commits from when main still committed the bundle. |
| 47 | + # The `latest` tag matches neither pattern; its own ruleset is below. |
| 48 | + - name: release-tags |
| 49 | + conditions: |
| 50 | + ref_name: |
| 51 | + include: |
| 52 | + - v*.*.* |
| 53 | + |
| 54 | + # The moving major tags (v1, v2) move on purpose - every release in the |
| 55 | + # line force-pushes them to its packaged commit - so no update rule, but |
| 56 | + # they must never vanish: a deleted major bricks every @v2 consumer at |
| 57 | + # once. fnmatch's * crosses dots, so v* also covers the vX.Y.Z tags; |
| 58 | + # that overlap is a harmless union with release-tags above. |
| 59 | + - name: major-release-tags |
| 60 | + target: tag |
| 61 | + enforcement: active |
| 62 | + conditions: |
| 63 | + ref_name: |
| 64 | + include: |
| 65 | + - v* |
| 66 | + exclude: [] |
| 67 | + rules: |
| 68 | + - type: deletion |
| 69 | + bypass_actors: |
| 70 | + - actor_id: 5 |
| 71 | + actor_type: RepositoryRole |
| 72 | + bypass_mode: always |
| 73 | + |
| 74 | + # The moving `latest` tag: post-green.yml and the release hook point it at |
| 75 | + # the `build` commit of the newest main source with a lease, so no update |
| 76 | + # or non_fast_forward rule (either would refuse that move; the lease and |
| 77 | + # the script's own checks keep it from going backward). Deletion is the one |
| 78 | + # thing it must never suffer: a deleted latest bricks every @latest |
| 79 | + # consumer at once. No bypass, like the build ruleset, so the apply heals |
| 80 | + # an out-of-band bypass actor. |
| 81 | + - name: latest-tag |
| 82 | + target: tag |
| 83 | + enforcement: active |
| 84 | + conditions: |
| 85 | + ref_name: |
| 86 | + include: |
| 87 | + - latest |
| 88 | + exclude: [] |
| 89 | + rules: |
| 90 | + - type: deletion |
| 91 | + bypass_actors: [] |
| 92 | + |
| 93 | + # The `build` branch of packaged commits: post-green.yml appends a green |
| 94 | + # main commit's packaged commit with a plain push when its token can (the |
| 95 | + # release hook appends the release's when post-green did not), so build may |
| 96 | + # only ever move forward - no force-push can rewrite the chain that |
| 97 | + # `@build` consumers pin by sha and that the release hook walks to find |
| 98 | + # a release's commit, and no deletion can remove it from under them. |
| 99 | + # Declared with NO bypass, like the fleet's non-bypassable ruleset: an |
| 100 | + # omitted key is invisible to drift detection, so the empty list is what |
| 101 | + # lets the apply heal an out-of-band bypass actor. |
| 102 | + - name: build |
| 103 | + target: branch |
| 104 | + enforcement: active |
| 105 | + conditions: |
| 106 | + ref_name: |
| 107 | + include: |
| 108 | + - build |
| 109 | + exclude: [] |
| 110 | + rules: |
| 111 | + - type: deletion |
| 112 | + - type: non_fast_forward |
| 113 | + bypass_actors: [] |
0 commit comments