@jakobm/peacekeeper 0.13.0 → 0.14.0

package/README.md

@@ -277,7 +277,8 @@ with **Require branches to be up to date before merging** enabled. Classic branc
 protection must enforce checks for administrators too. Alternatively, active
 rulesets must require strict checks and have no bypass actors. Rules inherited
 from the organization are included. Merge queues are not currently an alternative
-to this strict policy.
+to this strict policy. Repositories must also enable **Automatically delete head
+branches** (`delete_branch_on_merge=true`).
 
 The PR test job runs `peacekeeper verify-release-protection` before its tests.
 The command checks `GITHUB_BASE_REF`, or `git.defaultBranch` outside PR CI.
@@ -291,8 +292,9 @@ jobs in its latest PR workflow run. Manual tags without that PR are rejected.
 API failures, missing permissions, and unverifiable rules stop the commands.
 The workflow expects a `RELEASE_POLICY_TOKEN` Actions secret, exposed to the
 commands as `GH_TOKEN`. Use a fine-grained PAT or GitHub App token with access to
-this repository and Administration read, Contents read, Pull requests read and
-Actions read permissions. GitHub only exposes ruleset bypass actors to callers
+this repository and Administration read, Contents read/write, Pull requests read and
+Actions read permissions. Contents write is required even to read merge-related
+settings such as `delete_branch_on_merge`. GitHub only exposes ruleset bypass actors to callers
 with write access to the ruleset; ruleset users must additionally grant that
 access (Administration write for repository rulesets, or the appropriate access
 for inherited organization rulesets). Missing bypass information also fails.
@@ -303,8 +305,8 @@ by executing fork code with `pull_request_target`.
 
 To set this up for this repository:
 
-1. Open the [token creation form with the required read permissions prefilled](https://github.com/settings/personal-access-tokens/new?name=peacekeeper-release-policy&target_name=jakobmattsson&expires_in=90&administration=read&contents=read&pull_requests=read&actions=read).
-   For repository rulesets, use the [form with Administration write instead](https://github.com/settings/personal-access-tokens/new?name=peacekeeper-release-policy&target_name=jakobmattsson&expires_in=90&administration=write&contents=read&pull_requests=read&actions=read)
+1. Open the [token creation form with the required permissions prefilled](https://github.com/settings/personal-access-tokens/new?name=peacekeeper-release-policy&target_name=jakobmattsson&expires_in=90&administration=read&contents=write&pull_requests=read&actions=read).
+   For repository rulesets, use the [form with Administration write instead](https://github.com/settings/personal-access-tokens/new?name=peacekeeper-release-policy&target_name=jakobmattsson&expires_in=90&administration=write&contents=write&pull_requests=read&actions=read)
    so GitHub exposes bypass actors. For another repository, change the resource
    owner. Select **Only select repositories**, choose `peacekeeper`, review
    the permissions and expiration, and generate the token. If the owner requires

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jakobm/peacekeeper",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Shared repository test, Git worktree, and Codex hook commands",
   "license": "MIT",
   "repository": {

package/scripts/check-project-requirements.txt

@@ -184,6 +184,9 @@ Online release policy and GitHub token setup
   local declarations above. Use verify-release-protection to check the branch
   policy and verify-release before publishing to check the release itself.
 
+  Enable "Automatically delete head branches" (delete_branch_on_merge=true) in
+  the repository settings. The online release policy commands require it.
+
   Configure the default branch from git.defaultBranch with every exact job name
   in git.releaseRequiredChecks mandatory and "Require branches to be up to date
   before merging" enabled. Choose either:
@@ -197,7 +200,7 @@ Online release policy and GitHub token setup
   Create a fine-grained GitHub PAT or GitHub App installation token with access
   to this repository and these repository permissions:
     Administration: read
-    Contents: read
+    Contents: read/write
     Pull requests: read
     Actions: read
   For repository rulesets, Administration: write is additionally needed because

package/scripts/release-protection.js

@@ -11,6 +11,9 @@ function requiredChecks(cwd) {
 // other API failures, including permission failures, must propagate.
 function verifyProtection({ api, slug, branch, checks }) {
   const base = `repos/${slug}`;
+  if (api(base)?.delete_branch_on_merge !== true) {
+    throw new Error(`Repository ${slug} must enable delete_branch_on_merge. Run gh api --method PATCH ${base} -F delete_branch_on_merge=true, then rerun.`);
+  }
   let protection;
   try {
     protection = api(`${base}/branches/${encodeURIComponent(branch)}/protection`);
@@ -56,7 +59,7 @@ function githubApi(exec, cwd, host) {
   return endpoint => {
     const response = exec('gh', ['api', '--hostname', host, '--method', 'GET', endpoint], { cwd });
     if (response.status !== 0) {
-      const error = new Error(`Cannot verify GitHub release policy (${endpoint}): ${response.stderr?.trim() || 'API request failed'}. Grant the token Administration read, Contents read, Pull requests read and Actions read permissions, then rerun.`);
+      const error = new Error(`Cannot verify GitHub release policy (${endpoint}): ${response.stderr?.trim() || 'API request failed'}. Grant the token Administration read, Contents read/write, Pull requests read and Actions read permissions, then rerun.`);
       error.status = Number(/HTTP (\d{3})/u.exec(response.stderr || '')?.[1]);
       throw error;
     }