jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 12:40:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(mobile): relax release check (#2636)

Browse Source 
Signed-off-by: npub1re830n24qhgstulznk5dxdluccspxkxxdq643lm4q3zwwwjgsuqqmcmdrm <1e4f17cd5505d105f3e29da8d337fcc6201358c6683558ff750444e73a488700@buzz.block.builderlab.xyz>
Co-authored-by: npub1re830n24qhgstulznk5dxdluccspxkxxdq643lm4q3zwwwjgsuqqmcmdrm <1e4f17cd5505d105f3e29da8d337fcc6201358c6683558ff750444e73a488700@buzz.block.builderlab.xyz>
This commit is contained in:
Tom Brow
2026-07-23 17:00:35 -07:00
committed by GitHub
parent e341b09cb9
commit 3d17195ac8
3 changed files with 4 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
RELEASING.md
View File

@@ -221,8 +221,9 @@ release App because strict tag protection denies direct human creation. The App
must be installed on `block/buzz`, have Contents write and Metadata read, and
retain an `always` bypass on the immutable `mobile-v*` tag rules. It does not
require GitHub Releases permissions, repository Administration permission, or a
mobile release-branch ruleset. The publisher validates both the App token's
effective `current_user_can_bypass` value and the exact ruleset bypass actor set.
mobile release-branch ruleset. The publisher validates the App token's effective
`current_user_can_bypass` value rather than reading the ruleset's hidden bypass
actor list.
---

7
scripts/release-rulesets.sh
View File

@@ -22,7 +22,7 @@ require_canonical_repository() {
}
require_release_tag_ruleset() {
local ruleset_endpoint state can_bypass bypass_actors rule_types includes excludes
local ruleset_endpoint state can_bypass rule_types includes excludes
command -v gh >/dev/null 2>&1 || fail_release_ruleset "gh is required" || return 1
ruleset_endpoint="repos/block/buzz/rulesets/$RELEASE_TAG_RULESET_ID"
@@ -37,11 +37,6 @@ require_release_tag_ruleset() {
[[ "$can_bypass" == "always" ]] || \
fail_release_ruleset "release App cannot always bypass Release tag ruleset $RELEASE_TAG_RULESET_ID (reported '$can_bypass')" || return 1
bypass_actors="$(gh api "$ruleset_endpoint" --jq '[.bypass_actors[] | [.actor_type, (.actor_id | tostring), .bypass_mode] | join(":")] | sort | join(",")')" || \
fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID bypass actors" || return 1
[[ "$bypass_actors" == "Integration:4349119:always" ]] || \
fail_release_ruleset "Release tag ruleset $RELEASE_TAG_RULESET_ID has unexpected bypass actors: '$bypass_actors'" || return 1
rule_types="$(gh api "$ruleset_endpoint" --jq '[.rules[].type] | sort | join(",")')" || \
fail_release_ruleset "could not verify Release tag ruleset $RELEASE_TAG_RULESET_ID rules" || return 1
[[ "$rule_types" == "creation,deletion,non_fast_forward,update" ]] || \

16
scripts/test-mobile-release-candidate-publisher.sh
View File

@@ -21,7 +21,6 @@ case "${1:-}:${2:-}" in
case "$*" in
*'.enforcement'*) printf '%s\n' "${GH_TAG_RULESET_STATE:-active}" ;;
*'.current_user_can_bypass'*) printf '%s\n' "${GH_CURRENT_USER_CAN_BYPASS-always}" ;;
*'.bypass_actors[]'*) printf '%s\n' "${GH_BYPASS_ACTORS:-Integration:4349119:always}" ;;
*'[.rules[].type]'*) printf '%s\n' "${GH_TAG_RULE_TYPES:-creation,deletion,non_fast_forward,update}" ;;
*'.conditions.ref_name.include[]'*) printf '%s\n' "${GH_TAG_INCLUDES:-refs/tags/mobile-v*}" ;;
*'.conditions.ref_name.exclude[]'*) printf '%s\n' "${GH_TAG_EXCLUDES:-}" ;;
@@ -91,21 +90,6 @@ if GH_CURRENT_USER_CAN_BYPASS='' "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/nul
echo "publisher accepted a ruleset response without an effective bypass" >&2
exit 1
fi
if GH_BYPASS_ACTORS='Integration:4349119:always,Integration:9876543:always' \
"$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
echo "publisher accepted an extra ruleset bypass actor" >&2
exit 1
fi
if GH_BYPASS_ACTORS='Integration:9876543:always' \
"$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
echo "publisher accepted a substituted ruleset bypass actor" >&2
exit 1
fi
if GH_BYPASS_ACTORS='Integration:4349119:pull_request' \
"$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
echo "publisher accepted a ruleset bypass actor with the wrong mode" >&2
exit 1
fi
if GH_TAG_RULESET_STATE=disabled "$publisher" 1.2.3 1 "$GH_TARGET_SHA" >/dev/null 2>&1; then
echo "publisher accepted disabled tag protection" >&2
exit 1