|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Bootstrap a repo with fleet-standard governance: |
| 3 | +# 1. Enable allow_auto_merge (required for --auto merge workflow) |
| 4 | +# 2. Create the 'PR quality gates' branch ruleset from the canonical |
| 5 | +# template at config/rulesets/pr-quality-gates.json |
| 6 | +# 3. Inject required_status_checks based on a preset |
| 7 | +# |
| 8 | +# Presets are status-check-list choices. Every preset uses the same |
| 9 | +# pull_request / deletion / non_fast_forward / copilot_code_review / |
| 10 | +# code_quality rules from the template — only the required-checks list |
| 11 | +# differs per repo. |
| 12 | +# |
| 13 | +# IMPORTANT: required_status_checks context strings MUST match the |
| 14 | +# check-run "name:" field GitHub emits (display name), NOT the workflow |
| 15 | +# job ID. A job with `all-checks-pass:` / `name: All Checks Pass` emits |
| 16 | +# a check named "All Checks Pass" — the ruleset context must say |
| 17 | +# "All Checks Pass" or merges silently stay BLOCKED. |
| 18 | +# |
| 19 | +# Lesson source: mojwang/ihw#34 and mojwang/mojwang.tech#85 (Apr 2026) |
| 20 | +# both BLOCKED until the four PATCHed rulesets converged to this shape. |
| 21 | +# |
| 22 | +# Usage: |
| 23 | +# ./scripts/bootstrap-repo-ruleset.sh <owner/repo> --preset <name> |
| 24 | +# |
| 25 | +# Presets: |
| 26 | +# repo-generic No required status checks (vault / docs repos). |
| 27 | +# full-next Standard Next.js CI: lint, typecheck, test, build, |
| 28 | +# review, All Checks Pass, Lighthouse CI. |
| 29 | +# static-next Static Next.js (output: export): lint, typecheck, |
| 30 | +# test, review, All Checks Pass. |
| 31 | +# macbook-setup macbook-dev-setup convention: test, |
| 32 | +# validate-documentation, security-scan, |
| 33 | +# All Checks Pass. |
| 34 | +# |
| 35 | +# Requires: gh (authenticated), jq. |
| 36 | + |
| 37 | +set -euo pipefail |
| 38 | + |
| 39 | +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" |
| 40 | +REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" |
| 41 | +TEMPLATE="$REPO_ROOT/config/rulesets/pr-quality-gates.json" |
| 42 | + |
| 43 | +usage() { |
| 44 | + cat <<EOF |
| 45 | +Usage: $(basename "$0") <owner/repo> --preset <repo-generic|full-next|static-next|macbook-setup> |
| 46 | +
|
| 47 | +Enables allow_auto_merge on the repo and creates a 'PR quality gates' |
| 48 | +ruleset from $TEMPLATE, injecting required_status_checks based on the |
| 49 | +preset. |
| 50 | +
|
| 51 | +Flags: |
| 52 | + --preset <name> Required. One of: repo-generic, full-next, |
| 53 | + static-next, macbook-setup. |
| 54 | + --dry-run Print the ruleset payload that would be POSTed; |
| 55 | + skip the API calls. |
| 56 | +EOF |
| 57 | +} |
| 58 | + |
| 59 | +repo="" |
| 60 | +preset="" |
| 61 | +dry_run=0 |
| 62 | + |
| 63 | +while [[ $# -gt 0 ]]; do |
| 64 | + case "$1" in |
| 65 | + --preset) |
| 66 | + shift |
| 67 | + if [[ $# -lt 1 || "$1" == -* ]]; then |
| 68 | + echo "Error: --preset requires a value" >&2 |
| 69 | + usage >&2 |
| 70 | + exit 2 |
| 71 | + fi |
| 72 | + preset="$1"; shift ;; |
| 73 | + --dry-run) dry_run=1; shift ;; |
| 74 | + -h|--help) usage; exit 0 ;; |
| 75 | + -*) echo "Unknown flag: $1" >&2; usage >&2; exit 2 ;; |
| 76 | + *) |
| 77 | + if [[ -z "$repo" ]]; then |
| 78 | + repo="$1" |
| 79 | + else |
| 80 | + echo "Unexpected extra argument: $1" >&2 |
| 81 | + usage >&2 |
| 82 | + exit 2 |
| 83 | + fi |
| 84 | + shift ;; |
| 85 | + esac |
| 86 | +done |
| 87 | + |
| 88 | +if [[ -z "$repo" || -z "$preset" ]]; then |
| 89 | + echo "Error: both <owner/repo> and --preset are required" >&2 |
| 90 | + usage >&2 |
| 91 | + exit 2 |
| 92 | +fi |
| 93 | + |
| 94 | +if [[ ! -f "$TEMPLATE" ]]; then |
| 95 | + echo "Error: template not found at $TEMPLATE" >&2 |
| 96 | + exit 1 |
| 97 | +fi |
| 98 | + |
| 99 | +if ! command -v gh >/dev/null 2>&1; then |
| 100 | + echo "Error: gh CLI is required" >&2 |
| 101 | + exit 1 |
| 102 | +fi |
| 103 | +if ! command -v jq >/dev/null 2>&1; then |
| 104 | + echo "Error: jq is required" >&2 |
| 105 | + exit 1 |
| 106 | +fi |
| 107 | + |
| 108 | +# Preset → required_status_checks list. Display names only (see header). |
| 109 | +case "$preset" in |
| 110 | + repo-generic) |
| 111 | + checks_json='[]' ;; |
| 112 | + full-next) |
| 113 | + checks_json='[{"context":"lint"},{"context":"typecheck"},{"context":"test"},{"context":"build"},{"context":"review"},{"context":"All Checks Pass"},{"context":"Lighthouse CI"}]' ;; |
| 114 | + static-next) |
| 115 | + checks_json='[{"context":"lint"},{"context":"typecheck"},{"context":"test"},{"context":"review"},{"context":"All Checks Pass"}]' ;; |
| 116 | + macbook-setup) |
| 117 | + checks_json='[{"context":"test"},{"context":"validate-documentation"},{"context":"security-scan"},{"context":"All Checks Pass"}]' ;; |
| 118 | + *) |
| 119 | + echo "Error: unknown preset '$preset'" >&2 |
| 120 | + usage >&2 |
| 121 | + exit 2 ;; |
| 122 | +esac |
| 123 | + |
| 124 | +# Build the payload: load the template, then either insert or merge the |
| 125 | +# required_status_checks rule. For repo-generic (empty list) we omit the |
| 126 | +# rule entirely — a rule with zero checks still requires branches to be |
| 127 | +# up-to-date with main, which is stricter than "no check gate at all." |
| 128 | +# |
| 129 | +# jq expressions: |
| 130 | +# - del(._comment) strips the top-level comment field (GitHub rejects it). |
| 131 | +# - The rules-array walk adds required_status_checks only when the preset |
| 132 | +# ships one, and does so idempotently (no duplicates on re-run). |
| 133 | +if [[ "$checks_json" == "[]" ]]; then |
| 134 | + payload=$(jq 'del(._comment)' "$TEMPLATE") |
| 135 | +else |
| 136 | + payload=$(jq --argjson checks "$checks_json" ' |
| 137 | + del(._comment) | |
| 138 | + .rules += [{ |
| 139 | + "type": "required_status_checks", |
| 140 | + "parameters": { |
| 141 | + "strict_required_status_checks_policy": true, |
| 142 | + "do_not_enforce_on_create": false, |
| 143 | + "required_status_checks": $checks |
| 144 | + } |
| 145 | + }] |
| 146 | + ' "$TEMPLATE") |
| 147 | +fi |
| 148 | + |
| 149 | +echo "Repo: $repo" |
| 150 | +echo "Preset: $preset" |
| 151 | +echo "Required checks: $(echo "$checks_json" | jq -c '.')" |
| 152 | + |
| 153 | +if [[ "$dry_run" -eq 1 ]]; then |
| 154 | + echo "" |
| 155 | + echo "--- Dry-run payload ---" |
| 156 | + echo "$payload" | jq . |
| 157 | + exit 0 |
| 158 | +fi |
| 159 | + |
| 160 | +echo "" |
| 161 | +echo "Step 1/2: enabling allow_auto_merge on $repo…" |
| 162 | +GH_FORCE_TTY=0 NO_COLOR=1 gh api --method PATCH "repos/$repo" \ |
| 163 | + -F allow_auto_merge=true \ |
| 164 | + --jq '{repo: "'"$repo"'", allow_auto_merge}' |
| 165 | + |
| 166 | +echo "" |
| 167 | +echo "Step 2/2: creating 'PR quality gates' ruleset on $repo…" |
| 168 | +tmp=$(mktemp) |
| 169 | +printf '%s' "$payload" > "$tmp" |
| 170 | +response=$(GH_FORCE_TTY=0 NO_COLOR=1 gh api --method POST "repos/$repo/rulesets" --input "$tmp") |
| 171 | +rm -f "$tmp" |
| 172 | + |
| 173 | +echo "$response" | jq '{id, name, enforcement, updated_at, rules_count: (.rules | length)}' |
| 174 | + |
| 175 | +echo "" |
| 176 | +echo "Done. Open a PR against the default branch to verify:" |
| 177 | +echo " - Copilot auto-request fires on push" |
| 178 | +echo " - All required status checks gate the merge" |
| 179 | +echo " - Conversation resolution gates the merge" |
0 commit comments