Swatantra-66 opened a new pull request, #195: URL: https://github.com/apache/nuttx-website/pull/195
Resolves #130 ### Summary & Context In #130, @raiden00pl noted that direct `git push` to `master` succeeded without requiring a Pull Request or code review. @hartmannathan confirmed with Apache Infra that branch protection rules can be configured directly by the project via `.asf.yaml` ([ASF Infra documentation](https://github.com/apache/infrastructure-asfyaml)). ### Root Cause In `nuttx-website/.asf.yaml`, the `Default Branch Protection` ruleset previously only enforced: ```yaml restrict_deletion: true restrict_force_push: true ``` Because no pull request rule was declared, GitHub treated direct pushes to `master` as permissible for committers with write access. ### Solution This PR updates the `Default Branch Protection` ruleset in `.asf.yaml` using [ASF Infra's convenience syntax](https://github.com/apache/infrastructure-asfyaml) to add pull request review and conversation resolution enforcement: ```yaml required_conversation_resolution: true required_pull_request_reviews: dismiss_stale_reviews: true require_last_push_approval: true required_approving_review_count: 1 ``` ### Key Behaviors & Guarantees 1. **Blocks Accidental Direct Pushes**: GitHub will immediately reject any direct `git push` to `master` or `release/*` branches with `GH013: Repository rule violations found`. All changes must be submitted via a Pull Request. 2. **Review Requirement**: Enforces at least 1 approving review from maintainers before merging (can easily be adjusted to `2` if the PMC prefers matching the core RTOS policy). 3. **Conversation Resolution**: Requires all review comment threads to be marked resolved before a PR can be merged. 4. **Stale Review Dismissal**: Automatically resets approvals when new commits are pushed, ensuring the final code state is reviewed. 5. **No Disruption to Publishing**: `publish.sh` deploys to the `asf-site` branch, which is untouched by this ruleset. 6. **ASF Infra Compatibility**: Preserves `bypass_teams: [root]`, ensuring ASF Infrastructure administrative bots retain their required bypass access. ### Verification - Validated YAML schema syntax against `apache/infrastructure-asfyaml` parser specifications (`valid_rulesets_convenience` test matrix). - Verified ruleset target applies strictly to `~DEFAULT_BRANCH` (`master`) and release branches. Signed-off-by: Swatantra Yadav <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
