RepoAuditor 0.2.80__tar.gz → 0.2.82__tar.gz

{repoauditor-0.2.80 → repoauditor-0.2.82}/DEVELOPMENT.md

@@ -77,6 +77,7 @@ Please follow the steps below to complete the configuration.
   - Click `Add classic branch protection rule`.
   - Under `Branch name pattern`, type in `main`.
   - Check `Require a pull request before merging`.
+  - Check `Require a pull request before merging -> Require approvals`.
   - Check `Require a pull request before merging -> Dismiss stale pull request approvals when new commits are pushed`.
   - Check `Require a pull request before merging -> Require approval of the most recent reviewable push`.
   - Under `Protect matching branches`
@@ -100,8 +101,13 @@ Please follow the steps below to complete the configuration.
   - Enable `Restrict deletions`
   - Enable `Require signed commits`
   - Enable `Require a pull request before merging` with 1 required approval.
-  - Enable `Require status checks to pass` with the `CI+CD Workflow / Validate (ubuntu-latest, 3.12)` or an equivalent check.
-  - Enable `Block force pushes`.
+    - Enable `Dismiss stale pull request approvals when new commits are pushed`.
+    - Enable `Require approval of the most recent reviewable push`.
+    - Enable `Require conversation resolution before merging`.
+  - Enable `Require status checks to pass`.
+    - Enable `Require branches to be up to date before merging`.
+    - Set the `CI+CD Workflow / Validate (ubuntu-latest, 3.12)` or an equivalent check.
+  - Disable `Block force pushes`.
   - Be sure to hit `Save changes` at the end.
 
 ### Development Activities

{repoauditor-0.2.80 → repoauditor-0.2.82}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: RepoAuditor
-Version: 0.2.80
+Version: 0.2.82
 Summary: Add your description here
 Project-URL: Homepage, https://github.com/gt-sse-center/RepoAuditor
 Project-URL: Documentation, https://github.com/gt-sse-center/RepoAuditor
@@ -142,6 +142,41 @@ uvx RepoAuditor --include GitHub \
 
 `RepoAuditor` will generate a series of messages describing all the issues in the repository, along with the rationale behind them and the steps for resolution.
 
+### Custom Settings
+
+`RepoAuditor` tries to provide default settings and checks which are considered best practices. However, your team or organization may have different ways of doing things.
+You can override the default settings by specifying the appropriate flag.
+
+We have 3 types of flags:
+
+1. Boolean flags for those settings which are checked to be on by default and you wish to check are off, with the form `Module-no-Requirement` (e.g. `--GitHub-no-MergeCommit`).
+2. Conversely, boolean flags for those settings which are checked to be off by default, and you wish to check are on, denoted by the form `Module-Requirement` (e.g. `--GitHub-AllowDeletions`).
+3. Values flags take a string value to determine what value to enforce, and have the form `Module-Requirement-value` (e.g. `--GitHub-License-value "MIT License"`).
+
+Please run `uvx repoauditor --help` to get the list of all flags available.
+
+#### Examples
+
+For example, `RepoAuditor` by default checks that the setting `Allow rebase merging` is off. If you wish to check that this setting is turned on, you can run:
+
+```shell
+uvx repoauditor --GitHub-RebaseMergeCommit
+```
+
+Similarly, `RepoAuditor` checks if `Issues` are enabled. You can set `RepoAuditor` to check if `Issues` is disabled by specifying
+
+```shell
+uvx repoauditor --GitHub-no-SupportIssues
+```
+
+Finally, `RepoAuditor` by default enforces that the `MIT License` exists for the repository. If your organization requires another license (such as `GPL`), you can enforce that by specifying the license keyword such as:
+
+```shell
+uvx repoauditor --GitHub-License-value "GNU General Public License v2.0"
+```
+
+The types of licenses supported by GitHub can be found [here](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository#searching-github-by-license-type). Be sure to specify the full license name, e.g. `GNU General Public License v2.0`.
+
 ### Config File
 
 `RepoAuditor` accepts both a set of flags as well as a configuratin YAML file.
@@ -172,4 +207,4 @@ Additional information can be found at these locations.
 
 ## License
 
-RepoAuditor is licensed under the <a href="https://choosealicense.com/licenses/MIT/" target="_blank">MIT</a> license.
+RepoAuditor is licensed under the <a href="https://choosealicense.com/licenses/MIT/" target="_blank">MIT</a> license.

{repoauditor-0.2.80 → repoauditor-0.2.82}/README.md

@@ -115,6 +115,41 @@ uvx RepoAuditor --include GitHub \
 
 `RepoAuditor` will generate a series of messages describing all the issues in the repository, along with the rationale behind them and the steps for resolution.
 
+### Custom Settings
+
+`RepoAuditor` tries to provide default settings and checks which are considered best practices. However, your team or organization may have different ways of doing things.
+You can override the default settings by specifying the appropriate flag.
+
+We have 3 types of flags:
+
+1. Boolean flags for those settings which are checked to be on by default and you wish to check are off, with the form `Module-no-Requirement` (e.g. `--GitHub-no-MergeCommit`).
+2. Conversely, boolean flags for those settings which are checked to be off by default, and you wish to check are on, denoted by the form `Module-Requirement` (e.g. `--GitHub-AllowDeletions`).
+3. Values flags take a string value to determine what value to enforce, and have the form `Module-Requirement-value` (e.g. `--GitHub-License-value "MIT License"`).
+
+Please run `uvx repoauditor --help` to get the list of all flags available.
+
+#### Examples
+
+For example, `RepoAuditor` by default checks that the setting `Allow rebase merging` is off. If you wish to check that this setting is turned on, you can run:
+
+```shell
+uvx repoauditor --GitHub-RebaseMergeCommit
+```
+
+Similarly, `RepoAuditor` checks if `Issues` are enabled. You can set `RepoAuditor` to check if `Issues` is disabled by specifying
+
+```shell
+uvx repoauditor --GitHub-no-SupportIssues
+```
+
+Finally, `RepoAuditor` by default enforces that the `MIT License` exists for the repository. If your organization requires another license (such as `GPL`), you can enforce that by specifying the license keyword such as:
+
+```shell
+uvx repoauditor --GitHub-License-value "GNU General Public License v2.0"
+```
+
+The types of licenses supported by GitHub can be found [here](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository#searching-github-by-license-type). Be sure to specify the full license name, e.g. `GNU General Public License v2.0`.
+
 ### Config File
 
 `RepoAuditor` accepts both a set of flags as well as a configuratin YAML file.
@@ -145,4 +180,4 @@ Additional information can be found at these locations.
 
 ## License
 
-RepoAuditor is licensed under the <a href="https://choosealicense.com/licenses/MIT/" target="_blank">MIT</a> license.
+RepoAuditor is licensed under the <a href="https://choosealicense.com/licenses/MIT/" target="_blank">MIT</a> license.

{repoauditor-0.2.80 → repoauditor-0.2.82}/src/RepoAuditor/Plugins/GitHub/ClassicBranchProtectionRequirements/DoNotAllowBypassSettings.py

@@ -4,7 +4,7 @@
 # |  Distributed under the MIT License.
 # |
 # -------------------------------------------------------------------------------
-"""Contains the AllowBypassSettings object."""
+"""Contains the DoNotAllowBypassSettings object."""
 
 import textwrap
 

{repoauditor-0.2.80 → repoauditor-0.2.82}/src/RepoAuditor/Plugins/GitHub/Impl/EnableRulesetRequirementImpl.py

@@ -6,6 +6,7 @@
 # -------------------------------------------------------------------------------
 """Contains the EnableRequirementImpl object."""
 
+import textwrap
 from collections.abc import Callable
 from typing import Any, Optional
 
@@ -28,14 +29,24 @@ class EnableRulesetRequirementImpl(EnableRequirementImpl):
         github_ruleset_type: str,
         github_ruleset_value: str,
         get_configuration_value_func: Callable[[dict[str, Any]], Optional[bool]],
-        resolution: str,
         rationale: str,
+        resolution: Optional[str] = None,
         subject: Optional[str] = None,
         *,
         requires_explicit_include: bool = False,
         unset_set_terminology: tuple[str, str] = ("disabled", "enabled"),
         missing_value_is_warning: bool = True,
     ) -> None:
+        if resolution is None:
+            resolution = textwrap.dedent(
+                """\
+                1) Visit '{session.github_url}/settings/rules'.
+                2) Find or create a ruleset on the branch '{branch}'.
+                3) Go to '{__ruleset_value}'.
+                4) {__enabled_str} the rule.
+                """
+            )
+
         super().__init__(
             name=name,
             enabled_by_default=enabled_by_default,
@@ -52,6 +63,17 @@ class EnableRulesetRequirementImpl(EnableRequirementImpl):
 
         self.github_ruleset_type = github_ruleset_type
 
+    # ----------------------------------------------------------------------
+    def _GetValue(
+        self,
+        rule: dict[str, Any],
+    ) -> Optional[bool]:
+        rule_type = rule.get("type")
+        if rule_type is None:
+            return None
+
+        return rule_type == self.github_ruleset_type
+
     # ----------------------------------------------------------------------
     @override
     def _EvaluateImpl(
@@ -70,6 +92,8 @@ class EnableRulesetRequirementImpl(EnableRequirementImpl):
 
         query_data["__expected_value"] = expected_rule_enabled
         query_data["__enabled_str"] = "Enable" if expected_rule_enabled else "Disable"
+        # ruleset_value is stored as settings_value
+        query_data["__ruleset_value"] = self.github_settings_value
 
         # Get the rules for the specified branch
         rules = query_data.get("rules", [])

repoauditor-0.2.82/src/RepoAuditor/Plugins/GitHub/RulesetQuery.py

@@ -0,0 +1,120 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RulesetQuery object."""
+
+from typing import Any, Optional
+
+from dbrownell_Common.Types import override
+
+from RepoAuditor.Impl.ParallelSequentialProcessor import ExecutionStyle
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.AllowMainlineForcePushes import (
+    AllowMainlineForcePushesRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.DismissStalePullRequestApprovals import (
+    DismissStalePullRequestApprovalsRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.EnsureStatusChecks import EnsureStatusChecksRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireApprovalMostRecentPush import (
+    RequireApprovalMostRecentPushRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireApprovals import RequireApprovalsRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireCodeOwnerReview import RequireCodeOwnerReviewRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireCodeScanningResults import (
+    RequireCodeScanningResultsRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireConversationResolution import (
+    RequireConversationResolutionRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireLinearHistory import RequireLinearHistoryRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequirePullRequests import RequirePullRequests
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireSignedCommits import RequireSignedCommits
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireStatusChecksToPass import (
+    RequireStatusChecksToPassRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireSuccessfulDeployments import (
+    RequireSuccessfulDeploymentsRule,
+)
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RequireUpToDateBranches import RequireUpToDateBranchesRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RestrictCreations import RestrictCreationsRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RestrictDeletions import RestrictDeletionsRule
+from RepoAuditor.Plugins.GitHub.RulesetRequirements.RestrictUpdates import RestrictUpdatesRule
+from RepoAuditor.Query import Query
+
+
+class RulesetQuery(Query):
+    """Query to validate GitHub repository rulesets."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            "RulesetQuery",
+            ExecutionStyle.Parallel,
+            [
+                RestrictCreationsRule(),
+                RestrictUpdatesRule(),
+                RestrictDeletionsRule(),
+                RequireLinearHistoryRule(),
+                RequireSuccessfulDeploymentsRule(),
+                RequireSignedCommits(),
+                RequirePullRequests(),
+                RequireApprovalsRule(),
+                DismissStalePullRequestApprovalsRule(),
+                RequireCodeOwnerReviewRule(),
+                RequireApprovalMostRecentPushRule(),
+                RequireConversationResolutionRule(),
+                RequireStatusChecksToPassRule(),
+                RequireUpToDateBranchesRule(),
+                EnsureStatusChecksRule(),
+                AllowMainlineForcePushesRule(),
+                RequireCodeScanningResultsRule(),
+            ],
+        )
+
+    @override
+    def GetData(
+        self,
+        module_data: dict[str, Any],
+    ) -> Optional[dict[str, Any]]:
+        """Retrieve data required for validating GitHub rulesets.
+
+        Args:
+            module_data (dict): Dictionary containing initial data from the module.
+
+        Returns:
+            Optional[dict]: A dictionary containing ruleset-related
+            data, or None if an error occurs.
+
+        """
+        branch = module_data.get("branch")
+        if branch is None:
+            # Get the default branch name
+            response = module_data["session"].get("")
+
+            response.raise_for_status()
+            response = response.json()
+
+            branch = response["default_branch"]
+
+        # Record the branch name
+        module_data["branch"] = branch
+
+        # Fetch ruleset data for a specific branch.
+        # This only returns active rules on the branch
+        rules_response = module_data["session"].get(f"rules/branches/{branch}")
+
+        rules_response.raise_for_status()
+
+        # Add ruleset data to module_data
+        module_data["rules"] = rules_response.json()
+
+        # Also get the associated ruleset for each rule
+        for rule in module_data["rules"]:
+            ruleset_response = module_data["session"].get(f"rulesets/{rule['ruleset_id']}")
+            ruleset_response.raise_for_status()
+            ruleset = ruleset_response.json()
+            rule["ruleset"] = ruleset
+
+        return module_data

repoauditor-0.2.82/src/RepoAuditor/Plugins/GitHub/RulesetRequirements/AllowMainlineForcePushes.py

@@ -0,0 +1,40 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the AllowMainlineForcePushesRule requirement."""
+
+import textwrap
+
+from RepoAuditor.Plugins.GitHub.Impl.EnableRulesetRequirementImpl import EnableRulesetRequirementImpl
+
+
+class AllowMainlineForcePushesRule(EnableRulesetRequirementImpl):
+    """Requirement for rule to allow force pushes to the matching branch."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            name="AllowMainlineForcePushesRule",
+            enabled_by_default=False,
+            dynamic_arg_name="yes",
+            github_ruleset_type="non_fast_forward",
+            github_ruleset_value="Block force pushes",
+            get_configuration_value_func=self._GetValue,
+            rationale=textwrap.dedent(
+                """\
+                The default behavior is to not allow force pushes to the mainline branch.
+
+                Reasons for this Default
+                ------------------------
+                - Force pushes rewrite history, which breaks git lineage for all other clones of the repository.
+                  Merges are possible when this happens, but they are difficult to perform and data loss is
+                  possible.
+
+                Reasons to Override this Default
+                --------------------------------
+                <unknown>
+                """,
+            ),
+        )

repoauditor-0.2.82/src/RepoAuditor/Plugins/GitHub/RulesetRequirements/DismissStalePullRequestApprovals.py

@@ -0,0 +1,59 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the DismissStalePullRequestApprovalsRule object."""
+
+import textwrap
+from typing import Any, Optional
+
+from dbrownell_Common.Types import override  # type: ignore[import-untyped]
+
+from RepoAuditor.Plugins.GitHub.Impl.EnableRulesetRequirementImpl import EnableRulesetRequirementImpl
+
+
+# ----------------------------------------------------------------------
+class DismissStalePullRequestApprovalsRule(EnableRulesetRequirementImpl):
+    """Rule to dismiss stale pull request approvals when new commits are pushed."""
+
+    # ----------------------------------------------------------------------
+    def __init__(self) -> None:
+        super().__init__(
+            name="DismissStalePullRequestApprovalsRule",
+            enabled_by_default=True,
+            dynamic_arg_name="no",
+            github_ruleset_type="dismiss_stale_reviews_on_push",
+            github_ruleset_value="Require a pull request before merging -> Dismiss stale pull request approvals when new commits are pushed",
+            get_configuration_value_func=self._GetValue,
+            rationale=textwrap.dedent(
+                """\
+                The default behavior is to dismiss stale pull request approvals when new commits are pushed.
+
+                Reasons for this Default
+                ------------------------
+                - Approvals apply to the changes as they existed when the approval was granted. The approval
+                  may no longer be valid when new changes are pushed.
+
+                Reasons to Override this Default
+                --------------------------------
+                You trust the contributor to only make minor changes after approval.
+                """
+            ),
+        )
+
+    # ----------------------------------------------------------------------
+    @override
+    def _GetValue(
+        self,
+        rule: dict[str, Any],
+    ) -> Optional[bool]:
+        rule_type = rule.get("type")
+        if rule_type is None:
+            return None
+
+        if rule_type == "pull_request":
+            return rule["parameters"].get(self.github_ruleset_type, False)
+
+        return False

repoauditor-0.2.82/src/RepoAuditor/Plugins/GitHub/RulesetRequirements/EnsureStatusChecks.py

@@ -0,0 +1,69 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the EnsureStatusChecksRule object."""
+
+import textwrap
+from typing import Any, Optional
+
+from dbrownell_Common.Types import override  # type: ignore[import-untyped]
+
+from RepoAuditor.Plugins.GitHub.Impl.EnableRulesetRequirementImpl import EnableRulesetRequirementImpl
+
+
+# ----------------------------------------------------------------------
+class EnsureStatusChecksRule(EnableRulesetRequirementImpl):
+    """Rule to verify status checks have been assigned as a rule for a branch."""
+
+    # ----------------------------------------------------------------------
+    def __init__(self) -> None:
+        super().__init__(
+            name="EnsureStatusChecksRule",
+            enabled_by_default=True,
+            dynamic_arg_name="no",
+            github_ruleset_type="required_status_checks",
+            github_ruleset_value="Require status checks to pass -> Status checks that are required",
+            get_configuration_value_func=self._GetValue,
+            resolution=textwrap.dedent(
+                """\
+                1) Visit '{session.github_url}/settings/rules'.
+                2) Find or create a ruleset on the branch '{branch}'.
+                3) Go to '{__ruleset_value}'.
+                4) Click on '+ Add checks'.
+                5) Type the name of the check to enforce.
+                6) Select status checks that must pass before merging.
+                """,
+            ),
+            rationale=textwrap.dedent(
+                """\
+                The default behavior is to require the specification of at least one status check that must pass before merging.
+
+                Reasons for this Default
+                ------------------------
+                - A Continuous Integration process must be gated by some activity, action, or work flow.
+
+                Reasons to Override this Default
+                --------------------------------
+                - Code reviews are sufficient to ensure the quality of pull requests before they are merged into the branch
+                  (this is not recommended).
+                """
+            ),
+        )
+
+    # ----------------------------------------------------------------------
+    @override
+    def _GetValue(
+        self,
+        rule: dict[str, Any],
+    ) -> Optional[bool]:
+        rule_type = rule.get("type")
+
+        # If rule_type doesn't exist,
+        # it means the rule is not applicable
+        if rule_type and rule_type == self.github_ruleset_type:
+            return len(rule["parameters"][self.github_ruleset_type]) > 0
+
+        return False

repoauditor-0.2.82/src/RepoAuditor/Plugins/GitHub/RulesetRequirements/RequireApprovalMostRecentPush.py

@@ -0,0 +1,58 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RequireApprovalMostRecentPushRule object."""
+
+import textwrap
+from typing import Any, Optional
+
+from dbrownell_Common.Types import override  # type: ignore[import-untyped]
+
+from RepoAuditor.Plugins.GitHub.Impl.EnableRulesetRequirementImpl import EnableRulesetRequirementImpl
+
+
+# ----------------------------------------------------------------------
+class RequireApprovalMostRecentPushRule(EnableRulesetRequirementImpl):
+    """Rule to require approval on the most recent reviewable push in a pull request."""
+
+    # ----------------------------------------------------------------------
+    def __init__(self) -> None:
+        super().__init__(
+            name="RequireApprovalMostRecentPushRule",
+            enabled_by_default=True,
+            dynamic_arg_name="no",
+            github_ruleset_type="require_last_push_approval",
+            github_ruleset_value="Require a pull request before merging -> Require approval of the most recent reviewable push",
+            get_configuration_value_func=self._GetValue,
+            rationale=textwrap.dedent(
+                """\
+                The default behavior is to require approval of the most recent reviewable push by someone other than the author of the pull request.
+
+                Reasons for this Default
+                ------------------------
+                - Self-approval of a pull request eliminates the value provided by a second pair of eyes during a code review.
+
+                Reasons to Override this Default
+                --------------------------------
+                - You are the only person working on the repository.
+                """,
+            ),
+        )
+
+    # ----------------------------------------------------------------------
+    @override
+    def _GetValue(
+        self,
+        rule: dict[str, Any],
+    ) -> Optional[bool]:
+        rule_type = rule.get("type")
+        if rule_type is None:
+            return None
+
+        if rule_type == "pull_request":
+            return rule["parameters"].get(self.github_ruleset_type, False)
+
+        return False

repoauditor-0.2.82/src/RepoAuditor/Plugins/GitHub/RulesetRequirements/RequireApprovals.py

@@ -0,0 +1,68 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RequireApprovalsRule object."""
+
+import textwrap
+from typing import Any, Optional
+
+from dbrownell_Common.Types import override  # type: ignore[import-untyped]
+
+from RepoAuditor.Plugins.GitHub.Impl.EnableRulesetRequirementImpl import EnableRulesetRequirementImpl
+
+
+# ----------------------------------------------------------------------
+class RequireApprovalsRule(EnableRulesetRequirementImpl):
+    """Rule to require at least 1 approval on a pull request."""
+
+    # ----------------------------------------------------------------------
+    def __init__(self) -> None:
+        super().__init__(
+            name="RequireApprovalsRule",
+            enabled_by_default=True,
+            dynamic_arg_name="no",
+            github_ruleset_type="required_approving_review_count",
+            github_ruleset_value="Require a pull request before merging -> Required approvals",
+            get_configuration_value_func=self._GetValue,
+            resolution=textwrap.dedent(
+                """\
+                1) Visit '{session.github_url}/settings/rules'.
+                2) Find or create a ruleset on the branch '{branch}'.
+                3) Go to '{__ruleset_value}'.
+                4) Set the number of required approvals to at least 1.
+                """
+            ),
+            rationale=textwrap.dedent(
+                """\
+                The default behavior is to require at least one approval.
+
+                Reasons for this Default
+                ------------------------
+                - Code Reviews are a generally accepted best practice for software development.
+
+                Reasons to Override this Default
+                --------------------------------
+                - You are the only person working on the repository (set the value to 0).
+                - You want to require more than one approval (set the value to the number of approvals required).
+                - You are not comfortable with the amount of time code reviews introduce in the development process (set the value to 0).
+                """,
+            ),
+        )
+
+    # ----------------------------------------------------------------------
+    @override
+    def _GetValue(
+        self,
+        rule: dict[str, Any],
+    ) -> Optional[bool]:
+        rule_type = rule.get("type")
+        if rule_type is None:
+            return None
+
+        if rule_type == "pull_request":
+            return rule["parameters"].get(self.github_ruleset_type, 0) > 0
+
+        return False