Skip to content

📝 docs: document protect-main solo Branch-Protection #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
konih merged 2 commits into from
Jul 17, 2026
Merged

📝 docs: document protect-main solo Branch-Protection #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
843ea82
:memo: docs: document protect-main solo Branch-Protection
konih Jul 17, 2026
c0a8999
:memo: docs: sync CHANGELOG for protect-main docs PR
konih Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
name: Scorecard

# Results feed the OpenSSF Scorecard badge; protect-main requires Analyze (go)
# and CI gates separately (see AGENTS.md branch policy).

on:
push:
branches:
Expand Down
6 changes: 6 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,12 @@ tree as read-only build output:
- **Commits:** `:gitmoji: type(scope): summary` — ASCII shortcode only; no Unicode emoji; no AI
co-author trailers; never modify git config. One logical change per commit.
- **Merge:** rebase-and-merge only — linear history, no squash, no merge commits.
- **Branch policy (`protect-main` ruleset on `main`):** PRs required; **1 approving
review** + last-push approval + dismiss-stale for non-bypass actors; no force-push /
no branch deletion; required checks `lint`, `check-diff`, `unit-tests`, `gitleaks`,
`govulncheck`, `coverage`, `Analyze (go)` (up-to-date). **Admin** bypass is
`pull_request` mode only — solo merges via `gh pr merge --rebase --admin`. Markdown-only
PRs may skip CI jobs via `detect-noop`; those still need admin/bypass to land.
- **Spec-driven:** every implementation lane references an OpenSpec change under `openspec/changes/`.
A change is `proposal.md` + `design.md` + `tasks.md` + `specs/<capability>/spec.md`.
- **TDD:** mandatory for hand-authored Go and `hack/` scripts — failing test first. Generated code
Expand Down
15 changes: 15 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,19 @@ Release notes are generated from [Conventional Commits](https://www.conventional
(with a leading gitmoji token) on the default branch using
[git-cliff](https://git-cliff.org/).

## [Unreleased]

### Bug Fixes

- **ci:** Accept up v0.51 per-extension annotations in D-020-FU verify [43294ed](https://github.com/platformrelay/provider-gridscale/commit/43294edb7cb5e32de9e309e17e6d07d3fbc0cee4)


### Documentation

- Document protect-main solo Branch-Protection [843ea82](https://github.com/platformrelay/provider-gridscale/commit/843ea823ef54d8643337315b9f1a5c887b10108a)

- **coordination:** Close v0.2.0 release — signed publish green [77be16d](https://github.com/platformrelay/provider-gridscale/commit/77be16dbd60906933c1bdcf715d8de1611e6c9ae)

## [0.2.0](https://github.com/platformrelay/provider-gridscale/compare/v0.1.1..v0.2.0) - 2026-07-17

### Bug Fixes
Expand All @@ -34,6 +47,8 @@ Release notes are generated from [Conventional Commits](https://www.conventional

### Documentation

- **readme:** OpenSSF Scorecard badge, drop Go Report, prep v0.2.0 [1799637](https://github.com/platformrelay/provider-gridscale/commit/1799637fcc822baeb5bb5e78322a8531d152ef2b)

- **coordination:** D-020-FU fixed (2e15c3e) — ready for signed v0.2.0 dispatch [acbfb48](https://github.com/platformrelay/provider-gridscale/commit/acbfb4878517b6928770eb314b483345527b8b93)

- **coordination:** 2026-07-17 handover — U-1/LB-1 landed, upstream PRs, D-020-FU [b4782dd](https://github.com/platformrelay/provider-gridscale/commit/b4782dd306f7fe0822c39da6ba11f3461e35fa7c)
Expand Down
10 changes: 6 additions & 4 deletions GOVERNANCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,9 @@ contribute, how to report a vulnerability, and who owns the repository.
This `GOVERNANCE.md`, alongside [`CONTRIBUTING.md`](CONTRIBUTING.md),
[`SECURITY.md`](SECURITY.md), and the [Code of Conduct](CODE_OF_CONDUCT.md), exists to make the
project's governance **transparent and discoverable** — publishing the model *is* the maturity
signal. In keeping with the honesty of [`SECURITY.md`](SECURITY.md), note that the automated
supply-chain and governance checks (OpenSSF Scorecard, CodeQL, and friends) are **planned** under
[Epic E5](docs/ROADMAP.md#e5--cicd-hardening--supply-chain), not yet running; this document advances
the governance dimension of that baseline rather than asserting the scans already pass.
signal. Supply-chain automation from [Epic E5](docs/ROADMAP.md#e5--cicd-hardening--supply-chain) is
**running** (CodeQL, OpenSSF Scorecard, govulncheck, gitleaks, coverage). Branch protection on
`main` is enforced by ruleset **`protect-main`**: one approval for external contributors, required
CI/SAST checks, and an Admin **pull-request-only** bypass so the solo maintainer can merge without
a second human (`gh pr merge --rebase --admin`). Scorecard **Code-Review** (second-person approvals)
remains a multi-maintainer goal.
2 changes: 1 addition & 1 deletion docs/assurance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ what remains operator-gated.

| Claim | Evidence in this repo |
| --- | --- |
| Changes land through reviewed, linear history | [`CONTRIBUTING.md`](../CONTRIBUTING.md) merge policy (rebase-and-merge); [`GOVERNANCE.md`](../GOVERNANCE.md) |
| Changes land through reviewed, linear history | Ruleset **`protect-main`** (1 approval + required checks + Admin PR-only bypass for solo); [`CONTRIBUTING.md`](../CONTRIBUTING.md) rebase-and-merge; [`GOVERNANCE.md`](../GOVERNANCE.md); [`AGENTS.md`](../AGENTS.md) |
| Maintainers are identifiable | [`OWNERS.md`](../OWNERS.md), [`CODEOWNERS`](../CODEOWNERS) |
| Vulnerability reporting path exists | [`SECURITY.md`](../SECURITY.md) |
| Code of Conduct is a recognised standard | [`CODE_OF_CONDUCT.md`](../CODE_OF_CONDUCT.md) (Contributor Covenant 2.1) |
Expand Down
Loading