declapract-typescript-ehmpathy 0.49.4 → 0.49.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -5,6 +5,7 @@ import {
|
|
|
5
5
|
DeclaredGithubEnvironment,
|
|
6
6
|
DeclaredGithubRepo,
|
|
7
7
|
DeclaredGithubRepoConfig,
|
|
8
|
+
DeclaredGithubRepoRuleset,
|
|
8
9
|
DeclaredGithubTeamRepoAccess,
|
|
9
10
|
getDeclastructGithubProvider,
|
|
10
11
|
} from 'declastruct-github';
|
|
@@ -154,6 +155,37 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
|
|
|
154
155
|
preventSelfReview: false, // self-approval allowed if in reviewers list
|
|
155
156
|
});
|
|
156
157
|
|
|
158
|
+
// restrict who may cut `v*` release tags to the rhelease app only
|
|
159
|
+
// .why = prod apply is gated on a version tag cut from main; if anyone could push a
|
|
160
|
+
// `v*` tag, that gate is bypassable. this ruleset blocks creation, update, and
|
|
161
|
+
// deletion of `v*` tags for everyone except the rhelease app — the github half
|
|
162
|
+
// of the prod-apply oidc guarantee, and the immutability of released tags
|
|
163
|
+
const rulesetReleaseTags = DeclaredGithubRepoRuleset.as({
|
|
164
|
+
repo,
|
|
165
|
+
name: 'protect-release-tags',
|
|
166
|
+
target: 'tag',
|
|
167
|
+
enforcement: 'active',
|
|
168
|
+
|
|
169
|
+
// only the rhelease github app may write `v*` tags
|
|
170
|
+
bypassActors: [
|
|
171
|
+
{
|
|
172
|
+
actorId: 2472031, // rhelease github app id (gh api /apps/rhelease)
|
|
173
|
+
actorType: 'Integration',
|
|
174
|
+
bypassMode: 'always',
|
|
175
|
+
},
|
|
176
|
+
],
|
|
177
|
+
|
|
178
|
+
// applies to release tags only
|
|
179
|
+
conditions: {
|
|
180
|
+
refNameInclude: ['refs/tags/v*'],
|
|
181
|
+
refNameExclude: [],
|
|
182
|
+
},
|
|
183
|
+
|
|
184
|
+
// enforce release-tag immutability: only the bypass actor may create, move, or delete
|
|
185
|
+
// matched tags. a released `v1.2.3` must never be re-pointed or removed once cut
|
|
186
|
+
rules: [{ type: 'creation' }, { type: 'update' }, { type: 'deletion' }],
|
|
187
|
+
});
|
|
188
|
+
|
|
157
189
|
// and return the full set
|
|
158
190
|
return [
|
|
159
191
|
repo,
|
|
@@ -162,5 +194,6 @@ export const getResources = async (): Promise<DomainEntity<any>[]> => {
|
|
|
162
194
|
teamReleasersAccess, // must come before environments that reference this team
|
|
163
195
|
envProductionOnMain,
|
|
164
196
|
envProductionOnElse,
|
|
197
|
+
rulesetReleaseTags,
|
|
165
198
|
];
|
|
166
199
|
};
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "declapract-typescript-ehmpathy",
|
|
3
3
|
"author": "ehmpathy",
|
|
4
4
|
"description": "declapract best practices declarations for typescript",
|
|
5
|
-
"version": "0.49.
|
|
5
|
+
"version": "0.49.5",
|
|
6
6
|
"license": "MIT",
|
|
7
7
|
"main": "src/index.js",
|
|
8
8
|
"repository": "ehmpathy/declapract-typescript-ehmpathy",
|
|
@@ -76,13 +76,13 @@
|
|
|
76
76
|
"esbuild-register": "3.6.0",
|
|
77
77
|
"husky": "8.0.3",
|
|
78
78
|
"jest": "30.2.0",
|
|
79
|
-
"rhachet": "1.42.
|
|
79
|
+
"rhachet": "1.42.5",
|
|
80
80
|
"rhachet-brains-anthropic": "0.4.1",
|
|
81
81
|
"rhachet-brains-fireworksai": "0.1.3",
|
|
82
82
|
"rhachet-brains-xai": "0.3.3",
|
|
83
|
-
"rhachet-roles-bhrain": "0.29.
|
|
84
|
-
"rhachet-roles-bhuild": "0.21.
|
|
85
|
-
"rhachet-roles-ehmpathy": "1.37.
|
|
83
|
+
"rhachet-roles-bhrain": "0.29.15",
|
|
84
|
+
"rhachet-roles-bhuild": "0.21.19",
|
|
85
|
+
"rhachet-roles-ehmpathy": "1.37.6",
|
|
86
86
|
"tsc-alias": "1.8.10",
|
|
87
87
|
"tsx": "4.20.6",
|
|
88
88
|
"type-fns": "1.21.2",
|