From 843ea823ef54d8643337315b9f1a5c887b10108a Mon Sep 17 00:00:00 2001 From: Konrad Ferdinand Heimel Date: Fri, 17 Jul 2026 15:39:10 +0200 Subject: [PATCH 1/2] :memo: docs: document protect-main solo Branch-Protection Create/document protect-main (1 approval, required CI/SAST checks, Admin PR-only bypass). Update governance/assurance claims that E5 scans now run. --- .github/workflows/scorecard.yml | 3 +++ AGENTS.md | 6 ++++++ GOVERNANCE.md | 10 ++++++---- docs/assurance.md | 2 +- 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f7f6ccf..3fe32f3 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,5 +1,8 @@ name: Scorecard +# Results feed the OpenSSF Scorecard badge; protect-main requires Analyze (go) +# and CI gates separately (see AGENTS.md branch policy). + on: push: branches: diff --git a/AGENTS.md b/AGENTS.md index bb0cdd8..69298dc 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -41,6 +41,12 @@ tree as read-only build output: - **Commits:** `:gitmoji: type(scope): summary` — ASCII shortcode only; no Unicode emoji; no AI co-author trailers; never modify git config. One logical change per commit. - **Merge:** rebase-and-merge only — linear history, no squash, no merge commits. +- **Branch policy (`protect-main` ruleset on `main`):** PRs required; **1 approving + review** + last-push approval + dismiss-stale for non-bypass actors; no force-push / + no branch deletion; required checks `lint`, `check-diff`, `unit-tests`, `gitleaks`, + `govulncheck`, `coverage`, `Analyze (go)` (up-to-date). **Admin** bypass is + `pull_request` mode only — solo merges via `gh pr merge --rebase --admin`. Markdown-only + PRs may skip CI jobs via `detect-noop`; those still need admin/bypass to land. - **Spec-driven:** every implementation lane references an OpenSpec change under `openspec/changes/`. A change is `proposal.md` + `design.md` + `tasks.md` + `specs//spec.md`. - **TDD:** mandatory for hand-authored Go and `hack/` scripts — failing test first. Generated code diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 4316cbe..3215299 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -130,7 +130,9 @@ contribute, how to report a vulnerability, and who owns the repository. This `GOVERNANCE.md`, alongside [`CONTRIBUTING.md`](CONTRIBUTING.md), [`SECURITY.md`](SECURITY.md), and the [Code of Conduct](CODE_OF_CONDUCT.md), exists to make the project's governance **transparent and discoverable** — publishing the model *is* the maturity -signal. In keeping with the honesty of [`SECURITY.md`](SECURITY.md), note that the automated -supply-chain and governance checks (OpenSSF Scorecard, CodeQL, and friends) are **planned** under -[Epic E5](docs/ROADMAP.md#e5--cicd-hardening--supply-chain), not yet running; this document advances -the governance dimension of that baseline rather than asserting the scans already pass. +signal. Supply-chain automation from [Epic E5](docs/ROADMAP.md#e5--cicd-hardening--supply-chain) is +**running** (CodeQL, OpenSSF Scorecard, govulncheck, gitleaks, coverage). Branch protection on +`main` is enforced by ruleset **`protect-main`**: one approval for external contributors, required +CI/SAST checks, and an Admin **pull-request-only** bypass so the solo maintainer can merge without +a second human (`gh pr merge --rebase --admin`). Scorecard **Code-Review** (second-person approvals) +remains a multi-maintainer goal. diff --git a/docs/assurance.md b/docs/assurance.md index fe7b8a4..e78b0ac 100644 --- a/docs/assurance.md +++ b/docs/assurance.md @@ -9,7 +9,7 @@ what remains operator-gated. | Claim | Evidence in this repo | | --- | --- | -| Changes land through reviewed, linear history | [`CONTRIBUTING.md`](../CONTRIBUTING.md) merge policy (rebase-and-merge); [`GOVERNANCE.md`](../GOVERNANCE.md) | +| Changes land through reviewed, linear history | Ruleset **`protect-main`** (1 approval + required checks + Admin PR-only bypass for solo); [`CONTRIBUTING.md`](../CONTRIBUTING.md) rebase-and-merge; [`GOVERNANCE.md`](../GOVERNANCE.md); [`AGENTS.md`](../AGENTS.md) | | Maintainers are identifiable | [`OWNERS.md`](../OWNERS.md), [`CODEOWNERS`](../CODEOWNERS) | | Vulnerability reporting path exists | [`SECURITY.md`](../SECURITY.md) | | Code of Conduct is a recognised standard | [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md) (Contributor Covenant 2.1) | From c0a8999127d44044066fff2cfd4c3c56bba2cb04 Mon Sep 17 00:00:00 2001 From: Konrad Ferdinand Heimel Date: Fri, 17 Jul 2026 17:08:35 +0200 Subject: [PATCH 2/2] :memo: docs: sync CHANGELOG for protect-main docs PR --- CHANGELOG.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 035682a..3baa44a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,19 @@ Release notes are generated from [Conventional Commits](https://www.conventional (with a leading gitmoji token) on the default branch using [git-cliff](https://git-cliff.org/). +## [Unreleased] + +### Bug Fixes + +- **ci:** Accept up v0.51 per-extension annotations in D-020-FU verify [43294ed](https://github.com/platformrelay/provider-gridscale/commit/43294edb7cb5e32de9e309e17e6d07d3fbc0cee4) + + +### Documentation + +- Document protect-main solo Branch-Protection [843ea82](https://github.com/platformrelay/provider-gridscale/commit/843ea823ef54d8643337315b9f1a5c887b10108a) + +- **coordination:** Close v0.2.0 release — signed publish green [77be16d](https://github.com/platformrelay/provider-gridscale/commit/77be16dbd60906933c1bdcf715d8de1611e6c9ae) + ## [0.2.0](https://github.com/platformrelay/provider-gridscale/compare/v0.1.1..v0.2.0) - 2026-07-17 ### Bug Fixes @@ -34,6 +47,8 @@ Release notes are generated from [Conventional Commits](https://www.conventional ### Documentation +- **readme:** OpenSSF Scorecard badge, drop Go Report, prep v0.2.0 [1799637](https://github.com/platformrelay/provider-gridscale/commit/1799637fcc822baeb5bb5e78322a8531d152ef2b) + - **coordination:** D-020-FU fixed (2e15c3e) — ready for signed v0.2.0 dispatch [acbfb48](https://github.com/platformrelay/provider-gridscale/commit/acbfb4878517b6928770eb314b483345527b8b93) - **coordination:** 2026-07-17 handover — U-1/LB-1 landed, upstream PRs, D-020-FU [b4782dd](https://github.com/platformrelay/provider-gridscale/commit/b4782dd306f7fe0822c39da6ba11f3461e35fa7c)