Repository navigation
chore(github/branch): require the checks of the shared workflows under their new names - #1121
Merged
Merged
Conversation
…r their new names Claude-Session: https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7 Signed-off-by: panicboat <panicboat@gmail.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
panicboat-github-workflow-bot
Bot
added
the
deploy:branch
Contributor
Plan Result (branch/master)
Change Result (Click me) # github_repository_ruleset.branches["deploy-actions-main"] will be updated in-place
~ resource "github_repository_ruleset" "branches" {
id = "15519988"
name = "deploy-actions-main"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
+ required_status_checks {
+ do_not_enforce_on_create = false
+ strict_required_status_checks_policy = false
+ required_check {
+ context = "ensure-sha-pinned / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "validate / Validate PR title"
+ integration_id = 0
}
}
# (1 unchanged block hidden)
}
# (1 unchanged block hidden)
}
# github_repository_ruleset.branches["dot-github-main"] will be created
+ resource "github_repository_ruleset" "branches" {
+ enforcement = "active"
+ etag = (known after apply)
+ id = (known after apply)
+ name = "dot-github-main"
+ node_id = (known after apply)
+ repository = ".github"
+ ruleset_id = (known after apply)
+ target = "branch"
+ conditions {
+ ref_name {
+ exclude = []
+ include = [
+ "~DEFAULT_BRANCH",
]
}
}
+ rules {
+ deletion = true
+ non_fast_forward = true
+ required_linear_history = true
+ required_signatures = false
+ update_allows_fetch_and_merge = false
+ pull_request {
+ allowed_merge_methods = (known after apply)
+ dismiss_stale_reviews_on_push = false
+ require_code_owner_review = false
+ require_last_push_approval = false
+ required_approving_review_count = 0
+ required_review_thread_resolution = false
}
+ required_status_checks {
+ do_not_enforce_on_create = false
+ strict_required_status_checks_policy = false
+ required_check {
+ context = "Test scripts"
+ integration_id = 0
}
+ required_check {
+ context = "gatekeeper / CI Gatekeeper"
+ integration_id = 0
}
+ required_check {
+ context = "lint / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "semantic / Validate PR title"
+ integration_id = 0
}
}
}
}
# github_repository_ruleset.branches["monorepo-main"] will be updated in-place
~ resource "github_repository_ruleset" "branches" {
id = "15519991"
name = "monorepo-main"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
~ required_status_checks {
# (2 unchanged attributes hidden)
+ required_check {
+ context = "ci-gatekeeper / CI Gatekeeper"
+ integration_id = 0
}
+ required_check {
+ context = "ensure-sha-pinned / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "validate / Validate PR title"
+ integration_id = 0
}
# (1 unchanged block hidden)
}
# (1 unchanged block hidden)
}
# (3 unchanged blocks hidden)
}
# github_repository_ruleset.branches["platform-main"] will be updated in-place
~ resource "github_repository_ruleset" "branches" {
id = "15519990"
name = "platform-main"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
+ required_status_checks {
+ do_not_enforce_on_create = false
+ strict_required_status_checks_policy = false
+ required_check {
+ context = "ci-gatekeeper / CI Gatekeeper"
+ integration_id = 0
}
+ required_check {
+ context = "ensure-sha-pinned / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "validate / Validate PR title"
+ integration_id = 0
}
}
# (1 unchanged block hidden)
}
# (1 unchanged block hidden)
}
Plan: 1 to add, 3 to change, 0 to destroy.
Changes to Outputs:
~ branch_protection_rulesets = {
+ dot-github-main = {
+ id = (known after apply)
+ name = "dot-github-main"
+ repository = ".github"
}
# (3 unchanged attributes hidden)
} |
Contributor
✅ Apply Succeeded (branch/master)Details (Click me)Oct 25 02:09:49.491 INF download and unarchive the package program=aqua version=2.64.0 env=linux/amd64 exe_name=terragrunt package_name=gruntwork-io/terragrunt package_version=v1.0.2 registry=standard
Initializing the backend...
Successfully configured the backend "s3"! OpenTofu will automatically
use this backend unless the backend configuration changes.
Initializing provider plugins...
- Finding integrations/github versions matching "~> 6.13"...
- Installing integrations/github v6.13.0 to the shared cache directory...
- Installed integrations/github v6.13.0 (signed, key ID 38027F80D7FD5FB2)
- Using integrations/github v6.13.0 from the shared cache directory
Providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://opentofu.org/docs/cli/plugins/signing/
OpenTofu has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that OpenTofu can guarantee to make the same selections by default when
you run "tofu init" in the future.
OpenTofu has been successfully initialized!
You may now begin working with OpenTofu. Try running "tofu plan" to see
any changes that are required for your infrastructure. All OpenTofu commands
should now work.
If you ever set or change modules or backend configuration for OpenTofu,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
data.github_repository.repo["deploy-actions"]: Reading...
data.github_repository.repo["platform"]: Reading...
data.github_repository.repo["monorepo"]: Reading...
data.github_repository.repo["dot-github"]: Reading...
data.github_repository.repo["platform"]: Read complete after 1s [id=platform]
data.github_repository.repo["monorepo"]: Read complete after 1s [id=monorepo]
data.github_repository.repo["dot-github"]: Read complete after 1s [id=.github]
data.github_repository.repo["deploy-actions"]: Read complete after 2s [id=deploy-actions]
github_repository_ruleset.branches["monorepo-main"]: Refreshing state... [id=15519991]
github_repository_ruleset.branches["platform-main"]: Refreshing state... [id=15519990]
github_repository_ruleset.branches["deploy-actions-main"]: Refreshing state... [id=15519988]
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
~ update in-place (current -> planned)
OpenTofu will perform the following actions:
# github_repository_ruleset.branches["deploy-actions-main"] will be updated in-place
~ resource "github_repository_ruleset" "branches" {
id = "15519988"
name = "deploy-actions-main"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
+ required_status_checks {
+ do_not_enforce_on_create = false
+ strict_required_status_checks_policy = false
+ required_check {
+ context = "ensure-sha-pinned / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "validate / Validate PR title"
+ integration_id = 0
}
}
# (1 unchanged block hidden)
}
# (1 unchanged block hidden)
}
# github_repository_ruleset.branches["dot-github-main"] will be created
+ resource "github_repository_ruleset" "branches" {
+ enforcement = "active"
+ etag = (known after apply)
+ id = (known after apply)
+ name = "dot-github-main"
+ node_id = (known after apply)
+ repository = ".github"
+ ruleset_id = (known after apply)
+ target = "branch"
+ conditions {
+ ref_name {
+ exclude = []
+ include = [
+ "~DEFAULT_BRANCH",
]
}
}
+ rules {
+ deletion = true
+ non_fast_forward = true
+ required_linear_history = true
+ required_signatures = false
+ update_allows_fetch_and_merge = false
+ pull_request {
+ allowed_merge_methods = (known after apply)
+ dismiss_stale_reviews_on_push = false
+ require_code_owner_review = false
+ require_last_push_approval = false
+ required_approving_review_count = 0
+ required_review_thread_resolution = false
}
+ required_status_checks {
+ do_not_enforce_on_create = false
+ strict_required_status_checks_policy = false
+ required_check {
+ context = "Test scripts"
+ integration_id = 0
}
+ required_check {
+ context = "gatekeeper / CI Gatekeeper"
+ integration_id = 0
}
+ required_check {
+ context = "lint / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "semantic / Validate PR title"
+ integration_id = 0
}
}
}
}
# github_repository_ruleset.branches["monorepo-main"] will be updated in-place
~ resource "github_repository_ruleset" "branches" {
id = "15519991"
name = "monorepo-main"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
~ required_status_checks {
# (2 unchanged attributes hidden)
+ required_check {
+ context = "ci-gatekeeper / CI Gatekeeper"
+ integration_id = 0
}
+ required_check {
+ context = "ensure-sha-pinned / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "validate / Validate PR title"
+ integration_id = 0
}
# (1 unchanged block hidden)
}
# (1 unchanged block hidden)
}
# (3 unchanged blocks hidden)
}
# github_repository_ruleset.branches["platform-main"] will be updated in-place
~ resource "github_repository_ruleset" "branches" {
id = "15519990"
name = "platform-main"
# (6 unchanged attributes hidden)
~ rules {
# (7 unchanged attributes hidden)
+ required_status_checks {
+ do_not_enforce_on_create = false
+ strict_required_status_checks_policy = false
+ required_check {
+ context = "ci-gatekeeper / CI Gatekeeper"
+ integration_id = 0
}
+ required_check {
+ context = "ensure-sha-pinned / Ensure actions are pinned to SHAs"
+ integration_id = 0
}
+ required_check {
+ context = "validate / Validate PR title"
+ integration_id = 0
}
}
# (1 unchanged block hidden)
}
# (1 unchanged block hidden)
}
Plan: 1 to add, 3 to change, 0 to destroy.
Changes to Outputs:
~ branch_protection_rulesets = {
+ dot-github-main = {
+ id = (known after apply)
+ name = "dot-github-main"
+ repository = ".github"
}
# (3 unchanged attributes hidden)
}
github_repository_ruleset.branches["dot-github-main"]: Creating...
github_repository_ruleset.branches["platform-main"]: Modifying... [id=15519990]
github_repository_ruleset.branches["deploy-actions-main"]: Modifying... [id=15519988]
github_repository_ruleset.branches["monorepo-main"]: Modifying... [id=15519991]
github_repository_ruleset.branches["dot-github-main"]: Creation complete after 1s [id=25804793]
github_repository_ruleset.branches["platform-main"]: Modifications complete after 3s [id=15519990]
github_repository_ruleset.branches["deploy-actions-main"]: Modifications complete after 4s [id=15519988]
github_repository_ruleset.branches["monorepo-main"]: Modifications complete after 6s [id=15519991]
Apply complete! Resources: 1 added, 3 changed, 0 destroyed.
Outputs:
branch_protection_rulesets = {
"deploy-actions-main" = {
"id" = "15519988"
"name" = "deploy-actions-main"
"repository" = "deploy-actions"
}
"dot-github-main" = {
"id" = "25804793"
"name" = "dot-github-main"
"repository" = ".github"
}
"monorepo-main" = {
"id" = "15519991"
"name" = "monorepo-main"
"repository" = "monorepo"
}
"platform-main" = {
"id" = "15519990"
"name" = "platform-main"
"repository" = "platform"
}
}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
monorepo・platform・deploy-actions の ruleset に、共通の workflow で変わった新しい名前で必須チェックを戻します。
あわせて
panicboat/.githubに ruleset を作ります。Why
#1119 で、切り替えの間だけ名前が変わる必須チェックを外しました。
切り替えの PR（#1120・panicboat/monorepo#1750・panicboat/deploy-actions#357）はすべて merge されたので、新しい名前で戻します。
panicboat/.githubは 3 つのリポジトリが参照する workflow の正本なので、ほかのリポジトリと同じく main を ruleset で守ります。Before / After
Docs Sync Checkのみci-gatekeeper / CI Gatekeeper・validate / Validate PR title・ensure-sha-pinned / Ensure actions are pinned to SHAs・Docs Sync Checkci-gatekeeper / CI Gatekeeper・validate / Validate PR title・ensure-sha-pinned / Ensure actions are pinned to SHAsvalidate / Validate PR title・ensure-sha-pinned / Ensure actions are pinned to SHAspanicboat/.githubの rulesetdefaults.hclの既定に、必須チェックgatekeeper / CI Gatekeeper・semantic / Validate PR title・lint / Ensure actions are pinned to SHAs・Test scripts.githubは自分の workflow を呼ぶので、呼び出し側の job 名がほかのリポジトリと違います。Decisions
test / checkout / Self checkoutは必須にしません。Impact
Verification
terragrunt render --format jsonで、4 つのリポジトリのrequired_status_checksが After のとおりになることを確認しました。ci-gatekeeper / CI Gatekeeper・validate / Validate PR title・ensure-sha-pinned / Ensure actions are pinned to SHAsが出ています（ci: call the shared workflows from panicboat/.github #1120 の merge 後）。semantic-pull-request.ymlは platform と同じ内容です（shasum 一致）。ensure-sha-pinned / Ensure actions are pinned to SHAsが出ています。.githubの 4 つの名前が出ています。ci-gatekeeper / CI Gatekeeperは、caller の job id が platform と同じなので同じ名前になります。.githubの ruleset の作成です。Relations
🤖 Generated with Claude Code
https://claude.ai/code/session_01R7jQZQj1VyeBbYR7P1ssV7