[panicboat]

Summary

monorepo の main の ruleset で、commit status Docs Sync Check を必須チェックにします。

Why

panicboat/monorepo#1714 で、dystopia の変更が仕様書・規約・ポリシーに追いついているかを判定する workflow を足しました。
必須にしないと、判定が落ちても merge できてしまいます。
CI Gatekeeper はこの workflow を待たないので、CI Gatekeeper 経由では止まりません。

Before / After

• monorepo の main への merge
  • Before: Docs Sync Check が落ちていても merge できる。
  • After: Docs Sync Check が success になるまで merge できない。
    • dystopia を変えない PR と bot の PR は、Claude を呼ばずにすぐ success になります。
    • 判定が誤っているときは、人間が確かめて docs-check-approved ラベルを付けると通ります。

Decisions

• 必須チェックに送り手（integration）を指定しません。
  • status は workflow が GitHub Actions の token で書きます。今の必須チェックも送り手を指定していないので、それに合わせます。
• merge 時点で開いている monorepo の PR のうち、head にこの workflow がないものは、main を取り込むまで merge できなくなります。
  • 今あてはまるのは、release-please の PR 3 件（monorepo#1303・#1304・#1397）だけです。
  • release-please は main が進むたびに PR を作り直すので、次の更新で workflow が入り、bot の PR として success になります。
• fork からの PR には status が付かないので、merge できません。
  • 通すときは、人間が内容を確かめて gh api で status を success にします（monorepo の設計書どおり）。

Verification

• tofu fmt -check -recursive github/branch は出力なしで通りました。
• monorepo#1714 とその再生用の PR で、status Docs Sync Check が PR ごとに書かれることを確かめました。
• deploy:branch の terragrunt plan は 0 to add, 1 to change, 0 to destroy でした。
  • 変わるのは github_repository_ruleset.branches["monorepo-main"] に required_check { context = "Docs Sync Check" } が 1 件増えることだけです。

Relations

• feat(dystopia): check that pull requests keep the docs in sync monorepo#1714: status を書く workflow です（merge 済み）。
• feat(aws): let the monorepo docs sync check assume the bedrock role #1103: その workflow が使う Bedrock のロールです（merge 済み）。

🤖 Generated with Claude Code

https://claude.ai/code/session_01G93vHYG85bcS1N49AfuvrM

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6bff57a6-e91e-474c-98d8-5ae49882660b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[panicboat-github-workflow-bot]

Plan Result (branch/master)

CI link

Plan: 0 to add, 1 to change, 0 to destroy.

• Update
  • github_repository_ruleset.branches["monorepo-main"]

Change Result (Click me)

  # github_repository_ruleset.branches["monorepo-main"] will be updated in-place
  ~ resource "github_repository_ruleset" "branches" {
        id          = "15519991"
        name        = "monorepo-main"
        # (6 unchanged attributes hidden)

      ~ rules {
            # (7 unchanged attributes hidden)

          ~ required_status_checks {
                # (2 unchanged attributes hidden)

              + required_check {
                  + context        = "Docs Sync Check"
                  + integration_id = 0
                }

                # (3 unchanged blocks hidden)
            }

            # (1 unchanged block hidden)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[panicboat-github-workflow-bot]

✅ Apply Succeeded (branch/master)

CI link

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Details (Click me)

Oct 24 15:18:26.372 INF download and unarchive the package program=aqua version=2.64.0 env=linux/amd64 exe_name=terragrunt package_name=gruntwork-io/terragrunt package_version=v1.0.2 registry=standard

Initializing the backend...

Successfully configured the backend "s3"! OpenTofu will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding integrations/github versions matching "~> 6.13"...
- Installing integrations/github v6.13.0 to the shared cache directory...
- Installed integrations/github v6.13.0 (signed, key ID 38027F80D7FD5FB2)
- Using integrations/github v6.13.0 from the shared cache directory

Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/

OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.

OpenTofu has been successfully initialized!

You may now begin working with OpenTofu. Try running "tofu plan" to see
any changes that are required for your infrastructure. All OpenTofu commands
should now work.

If you ever set or change modules or backend configuration for OpenTofu,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
data.github_repository.repo["monorepo"]: Reading...
data.github_repository.repo["deploy-actions"]: Reading...
data.github_repository.repo["platform"]: Reading...
data.github_repository.repo["monorepo"]: Read complete after 0s [id=monorepo]
data.github_repository.repo["platform"]: Read complete after 1s [id=platform]
data.github_repository.repo["deploy-actions"]: Read complete after 1s [id=deploy-actions]
github_repository_ruleset.branches["platform-main"]: Refreshing state... [id=15519990]
github_repository_ruleset.branches["monorepo-main"]: Refreshing state... [id=15519991]
github_repository_ruleset.branches["deploy-actions-main"]: Refreshing state... [id=15519988]

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)

OpenTofu will perform the following actions:

  # github_repository_ruleset.branches["monorepo-main"] will be updated in-place
  ~ resource "github_repository_ruleset" "branches" {
        id          = "15519991"
        name        = "monorepo-main"
        # (6 unchanged attributes hidden)

      ~ rules {
            # (7 unchanged attributes hidden)

          ~ required_status_checks {
                # (2 unchanged attributes hidden)

              + required_check {
                  + context        = "Docs Sync Check"
                  + integration_id = 0
                }

                # (3 unchanged blocks hidden)
            }

            # (1 unchanged block hidden)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
github_repository_ruleset.branches["monorepo-main"]: Modifying... [id=15519991]
github_repository_ruleset.branches["monorepo-main"]: Modifications complete after 1s [id=15519991]

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

Outputs:

branch_protection_rulesets = {
  "deploy-actions-main" = {
    "id" = "15519988"
    "name" = "deploy-actions-main"
    "repository" = "deploy-actions"
  }
  "monorepo-main" = {
    "id" = "15519991"
    "name" = "monorepo-main"
    "repository" = "monorepo"
  }
  "platform-main" = {
    "id" = "15519990"
    "name" = "platform-main"
    "repository" = "platform"
  }
}