@devdogsuga/backstage 0.1.1 → 0.1.3

package/dist/{cli-YLCe3Zrx.js → cli-ZF4QgJro.js}

@@ -4462,107 +4462,107 @@ async function resolveAppId(org, appSlug) {
 }
 //#endregion
 //#region src/github/rulesets/desired.ts
-/**
-* Canonical fixed-ruleset name -> earlier name(s) this reconciler recognizes
-* as the SAME slot, so the first run renames rather than creating a
-* duplicate that leaves the old one live and unmanaged.
-*
-* Only `main` has a legacy alias today (`main-protection`, live on GitHub as
-* of 2026-09-24). `production`, `~ALL` and `team/**` have no live ruleset to
-* rename — they are created fresh. The tag ruleset keeps its live name,
-* `tag-protection`, unchanged; nothing about its shape is wrong today, so
-* there is no rename to make.
-*/
-const LEGACY_NAME_ALIASES = { main: ["main-protection"] };
-/** Ruleset names this reconciler deletes outright — nothing in the desired set replaces them. */
-const DELETE_RULESET_NAMES = ["comp-branches"];
-/**
-* A live ruleset name this reconciler must NEVER touch: one `teamSync.ts`
-* created and owns (`team/<slug>`, an exact-ref ruleset), as opposed to the
-* `team/**` wildcard-creation ruleset this module itself manages.
-*
-* `teamRulesetName()` in DevDogsUGA's `rulesets.ts` builds these as
-* `team/${slug}`, and slugs never contain `/`, so a live name is a per-team
-* ruleset iff it starts with `team/` and is not the literal `team/**` this
-* reconciler owns.
-*/
+/** Earlier live names which occupy the same managed slot. */
+const LEGACY_NAME_ALIASES = { "main-reviews": ["main", "main-protection"] };
+/** Obsolete fixed rulesets removed after the production-branch cutover. */
+const DELETE_RULESET_NAMES = ["comp-branches", "production"];
 function isPerTeamRulesetName(name) {
 	return name.startsWith("team/") && name !== "team/**";
 }
+const main$1 = { ref_name: {
+	include: ["refs/heads/main"],
+	exclude: []
+} };
+const always = (actor_id) => ({
+	actor_id,
+	actor_type: "Team",
+	bypass_mode: "always"
+});
 /**
-* The five fixed rulesets, built from resolved actor ids.
+* Fixed DevDogsUGA rulesets.
 *
-* Pure — no network, no `gh` — so `desired.test.ts` can assert the shape
-* without mocking anything, and `commands.ts` calls this only after
-* resolving `RulesetActors` from the live org.
+* The main policy is deliberately split. A bypass actor bypasses every rule
+* in one ruleset, so combining immutable history, PR reviews, updates and CI
+* would make a direct-push exception an accidental force-push exception too.
 */
 function buildDesiredRulesets(actors) {
 	return [
 		{
-			name: "main",
+			name: "main-integrity",
 			target: "branch",
 			enforcement: "active",
-			conditions: { ref_name: {
-				include: ["refs/heads/main"],
-				exclude: []
-			} },
-			bypass_actors: [{
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}],
-			rules: [
-				{ type: "deletion" },
-				{ type: "non_fast_forward" },
+			conditions: main$1,
+			bypass_actors: [],
+			rules: [{ type: "deletion" }, { type: "non_fast_forward" }]
+		},
+		{
+			name: "main-updates",
+			target: "branch",
+			enforcement: "active",
+			conditions: main$1,
+			bypass_actors: [
 				{
-					type: "update",
-					parameters: { update_allows_fetch_and_merge: false }
+					actor_id: actors.reviewersTeamId,
+					actor_type: "Team",
+					bypass_mode: "pull_request"
 				},
-				{
-					type: "pull_request",
-					parameters: {
-						allowed_merge_methods: ["squash"],
-						dismiss_stale_reviews_on_push: false,
-						require_code_owner_review: false,
-						require_last_push_approval: false,
-						required_approving_review_count: 0,
-						required_review_thread_resolution: false
-					}
+				always(actors.devopsTeamId),
+				always(actors.adminsTeamId)
+			],
+			rules: [{
+				type: "update",
+				parameters: { update_allows_fetch_and_merge: false }
+			}]
+		},
+		{
+			name: "main-reviews",
+			target: "branch",
+			enforcement: "active",
+			conditions: main$1,
+			bypass_actors: [always(actors.devopsTeamId), always(actors.adminsTeamId)],
+			rules: [{
+				type: "pull_request",
+				parameters: {
+					allowed_merge_methods: ["squash"],
+					dismiss_stale_reviews_on_push: false,
+					require_code_owner_review: true,
+					require_last_push_approval: true,
+					required_approving_review_count: 1,
+					required_review_thread_resolution: true
 				}
-			]
+			}]
 		},
 		{
-			name: "production",
+			name: "main-ci",
 			target: "branch",
 			enforcement: "active",
-			conditions: { ref_name: {
-				include: ["refs/heads/production"],
-				exclude: []
-			} },
-			bypass_actors: [{
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "pull_request"
-			}],
-			rules: [
-				{ type: "deletion" },
-				{ type: "non_fast_forward" },
-				{
-					type: "update",
-					parameters: { update_allows_fetch_and_merge: false }
-				},
-				{
-					type: "pull_request",
-					parameters: {
-						allowed_merge_methods: ["merge"],
-						dismiss_stale_reviews_on_push: false,
-						require_code_owner_review: true,
-						require_last_push_approval: false,
-						required_approving_review_count: 1,
-						required_review_thread_resolution: false
-					}
+			conditions: main$1,
+			bypass_actors: [always(actors.devopsTeamId), always(actors.adminsTeamId)],
+			rules: [{
+				type: "required_status_checks",
+				parameters: {
+					do_not_enforce_on_create: false,
+					strict_required_status_checks_policy: false,
+					required_status_checks: [
+						{
+							context: "validate",
+							integration_id: 15368
+						},
+						{
+							context: "database",
+							integration_id: 15368
+						},
+						{
+							context: "format",
+							integration_id: 15368
+						},
+						{
+							context: "flutter",
+							integration_id: 15368
+						}
+					]
 				}
-			]
+			}]
 		},
 		{
 			name: "~ALL",
@@ -4570,17 +4570,17 @@ function buildDesiredRulesets(actors) {
 			enforcement: "active",
 			conditions: { ref_name: {
 				include: ["~ALL"],
-				exclude: ["refs/heads/team/**"]
+				exclude: ["refs/heads/main", "refs/heads/team/**"]
 			} },
-			bypass_actors: [{
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}, ...actors.renovateAppId !== void 0 ? [{
-				actor_id: actors.renovateAppId,
-				actor_type: "Integration",
-				bypass_mode: "always"
-			}] : []],
+			bypass_actors: [
+				always(actors.devopsTeamId),
+				always(actors.adminsTeamId),
+				...actors.renovateAppId === void 0 ? [] : [{
+					actor_id: actors.renovateAppId,
+					actor_type: "Integration",
+					bypass_mode: "always"
+				}]
+			],
 			rules: [
 				{
 					type: "update",
@@ -4599,15 +4599,15 @@ function buildDesiredRulesets(actors) {
 				include: ["refs/heads/team/**"],
 				exclude: []
 			} },
-			bypass_actors: [{
-				actor_id: actors.appId,
-				actor_type: "Integration",
-				bypass_mode: "always"
-			}, {
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}],
+			bypass_actors: [
+				{
+					actor_id: actors.appId,
+					actor_type: "Integration",
+					bypass_mode: "always"
+				},
+				always(actors.devopsTeamId),
+				always(actors.adminsTeamId)
+			],
 			rules: [
 				{ type: "creation" },
 				{ type: "deletion" },
@@ -4622,15 +4622,7 @@ function buildDesiredRulesets(actors) {
 				include: ["refs/tags/**"],
 				exclude: []
 			} },
-			bypass_actors: [{
-				actor_id: actors.adminsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}, {
-				actor_id: actors.devopsTeamId,
-				actor_type: "Team",
-				bypass_mode: "always"
-			}],
+			bypass_actors: [always(actors.adminsTeamId), always(actors.devopsTeamId)],
 			rules: [
 				{ type: "creation" },
 				{ type: "update" },
@@ -4702,6 +4694,17 @@ function canonicalizeRule(rule) {
 			}
 		};
 	}
+	if (rule.type === "required_status_checks") return {
+		type: "required_status_checks",
+		parameters: {
+			do_not_enforce_on_create: rule.parameters.do_not_enforce_on_create,
+			strict_required_status_checks_policy: rule.parameters.strict_required_status_checks_policy,
+			required_status_checks: [...rule.parameters.required_status_checks].sort((a, b) => a.context.localeCompare(b.context)).map((check) => ({
+				context: check.context,
+				integration_id: check.integration_id
+			}))
+		}
+	};
 	return { type: rule.type };
 }
 function sortRules(rules) {
@@ -4824,6 +4827,7 @@ const DEFAULT_REPO$1 = "DevDogsUGA";
 const DEFAULT_APP_SLUG = "devdogs-platform";
 const DEFAULT_DEVOPS_SLUG = "devops";
 const DEFAULT_ADMINS_SLUG = "admins";
+const DEFAULT_REVIEWERS_SLUG = "reviewers";
 /** TASK-299 — installed separately from the platform App; may not exist yet. */
 const DEFAULT_RENOVATE_SLUG = "renovate";
 function parseOptions$1(argv) {
@@ -4903,11 +4907,13 @@ async function runGithubRulesets(argv) {
 	};
 	let devopsTeamId;
 	let adminsTeamId;
+	let reviewersTeamId;
 	let appId;
 	try {
-		[devopsTeamId, adminsTeamId, appId] = await Promise.all([
+		[devopsTeamId, adminsTeamId, reviewersTeamId, appId] = await Promise.all([
 			resolveTeamId(opts.org, DEFAULT_DEVOPS_SLUG),
 			resolveTeamId(opts.org, DEFAULT_ADMINS_SLUG),
+			resolveTeamId(opts.org, DEFAULT_REVIEWERS_SLUG),
 			resolveAppId(opts.org, opts.appSlug)
 		]);
 	} catch (err) {
@@ -4923,6 +4929,7 @@ async function runGithubRulesets(argv) {
 	const actors = {
 		devopsTeamId,
 		adminsTeamId,
+		reviewersTeamId,
 		appId,
 		renovateAppId
 	};

package/dist/launch.js

@@ -320,7 +320,7 @@ async function launchWith(argv, options) {
 */
 async function launch(argv) {
 	await launchWith(argv, { dispatch: async (args) => {
-		const { main } = await import("./cli-YLCe3Zrx.js");
+		const { main } = await import("./cli-ZF4QgJro.js");
 		await main(args);
 	} });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/backstage",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "private": false,
   "type": "module",
   "description": "Officer and production CLI for DevDogsUGA: deploys, env sync with Bitwarden and GitHub, the migration planner role, club graphics and QR codes, GitHub rulesets and settings, and the newsletter. Ships built JS; run it anywhere with `pnpm dlx @devdogsuga/backstage` (no checkout needed to start; commands that read a checkout say so).",
@@ -41,9 +41,9 @@
     "typescript": "^6.0.3",
     "zod": "4.4.3",
     "@devdogsuga/brand": "0.1.5",
-    "@devdogsuga/newsletter": "0.1.8",
+    "@devdogsuga/events": "0.1.5",
     "@devdogsuga/telemetry": "0.1.3",
-    "@devdogsuga/events": "0.1.5"
+    "@devdogsuga/newsletter": "0.1.9"
   },
   "peerDependencies": {
     "@devdogsuga/db": "*",
@@ -66,8 +66,8 @@
     "vitest": "^4.1.11",
     "@devdogsuga/cli-core": "0.0.0",
     "@devdogsuga/config": "0.1.2",
-    "@devdogsuga/db": "0.1.2",
-    "@devdogsuga/env": "0.1.4"
+    "@devdogsuga/db": "0.1.3",
+    "@devdogsuga/env": "0.1.5"
   },
   "scripts": {
     "build": "tsdown && node scripts/write-build-info.mjs && node ../../scripts/check-bundle-imports.mjs",