ci: make the template the source of the org standard - #3
Merged
Conversation
setup_repo.py now configures a new repository to the full standard, not just branch protection: environments and Pages where the workflows use them, read-only workflow tokens, squash/merge-commit only with branches deleted on merge, secret scanning + push protection + Dependabot security updates + private vulnerability reporting, topics from pyproject keywords, and a `master` ruleset (pull requests only, no force-push or deletion, "All checks passed" required) in place of classic protection. It is idempotent and is what the existing repositories were aligned with. The template gets a CI of its own: render with copier and run the generated project's gate, aggregated into "All checks passed" so the same ruleset can apply here. Its own CONTRIBUTING, CODE_OF_CONDUCT and SECURITY are added, and the generated SECURITY.md becomes the org-wide one (draft advisory link, no version table that goes stale).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
setup_repo.py now configures a new repository to the full standard, not just
branch protection: environments and Pages where the workflows use them,
read-only workflow tokens, squash/merge-commit only with branches deleted on
merge, secret scanning + push protection + Dependabot security updates +
private vulnerability reporting, topics from pyproject keywords, and a
masterruleset (pull requests only, no force-push or deletion, "All checkspassed" required) in place of classic protection. It is idempotent and is
what the existing repositories were aligned with.
The template gets a CI of its own: render with copier and run the generated
project's gate, aggregated into "All checks passed" so the same ruleset can
apply here. Its own CONTRIBUTING, CODE_OF_CONDUCT and SECURITY are added, and
the generated SECURITY.md becomes the org-wide one (draft advisory link, no
version table that goes stale).
Checked locally: rendered with the defaults, the generated project passes
make check,make test-unitanduv build;setup_repo.pywas run against all 15 other repositories of the org today.