jschoubben
d2036f2a63
The forge's required status was a second copy of the gate mesh-delivery and the merge tool already keep; a stuck status writer held it too (issues 1886, 1891) and only a hand change at the forge let a fix merge. Main keeps no push, the tools' merge whitelist and no administrator override. The merge tool judges mesh/check whether or not the branch requires it, and on a branch that requires none merges only a head the operator's Approve names. The protection tool loses its status argument.
58 lines
2.8 KiB
TypeScript
58 lines
2.8 KiB
TypeScript
// A branch's protection (novox/hq ADR 0237): no direct push, and on main only the tools' account merges (ADR 0398 §2).
|
|
// The forge requires no status to merge (ADR 0534 §1): the checks still run and report, and mesh-delivery and the
|
|
// merge tool judge them (ADR 0534 §3, §4), never the forge. Pure, so it is tested without a forge; the client does the
|
|
// asking (client.ts).
|
|
|
|
import { TOOLS_ACCOUNT } from "./tools-account.js";
|
|
|
|
/** The branch whose rule takes no push and lets only the tools' account merge (novox/hq ADR 0398 §2, issue 948). */
|
|
export const MAIN_BRANCH = "main";
|
|
|
|
/** A branch protection rule, as the forge keeps it — the fields the mesh reads; the forge sends more. */
|
|
export interface BranchProtection {
|
|
rule_name?: string;
|
|
branch_name?: string;
|
|
enable_push?: boolean;
|
|
enable_status_check?: boolean;
|
|
status_check_contexts?: string[] | null;
|
|
required_approvals?: number;
|
|
block_admin_merge_override?: boolean;
|
|
enable_merge_whitelist?: boolean;
|
|
merge_whitelist_usernames?: string[] | null;
|
|
[field: string]: unknown;
|
|
}
|
|
|
|
/** What a branch's protection is set to. A field not given is left as the rule has it (or the forge's
|
|
* default on a new rule), except pushes, which a new rule refuses unless `push` says otherwise. */
|
|
export interface ProtectionWanted {
|
|
/** Whether a person may push to the branch directly. */
|
|
push?: boolean;
|
|
/** Whether an administrator is stopped from merging past what the rule asks. */
|
|
blockAdminOverride?: boolean;
|
|
/** Who may merge into the branch; for main only ever the tools' account (ADR 0398 §2). Not given: left as it is.
|
|
* Empty or null asks for no whitelist, which the guard refuses for main; the body for main ignores it. */
|
|
mergeWhitelist?: string[] | null;
|
|
}
|
|
|
|
/** What every rule the mesh writes says of statuses: none is required to merge (novox/hq ADR 0534 §1). */
|
|
export function noStatusBody(): Record<string, unknown> {
|
|
return { enable_status_check: false, status_check_contexts: [] };
|
|
}
|
|
|
|
/** What main's rule always says: no push, only the tools' account merges (novox/hq ADR 0398 §2, issue 948), and no
|
|
* status required (ADR 0534 §1). */
|
|
export function mainRuleBody(): Record<string, unknown> {
|
|
return { enable_push: false, enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT], ...noStatusBody() };
|
|
}
|
|
|
|
/** The forge's body for a wanted protection. */
|
|
export function protectionBody(want: ProtectionWanted, creating: boolean, branch = ""): Record<string, unknown> {
|
|
const body: Record<string, unknown> = noStatusBody();
|
|
if (want.push !== undefined) body.enable_push = want.push;
|
|
else if (creating) body.enable_push = false;
|
|
if (want.blockAdminOverride !== undefined) body.block_admin_merge_override = want.blockAdminOverride;
|
|
if (branch === MAIN_BRANCH) Object.assign(body, mainRuleBody()); // whatever was asked: main takes no push (ADR 0398 §2)
|
|
return body;
|
|
}
|
|
|