Platform/org-policy
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Org-wide repo policy enforcement: branch protection, merge style, protected workflow paths (task 04)
1 commit 1 branch 0 tags 26 KiB
  • JavaScript 100%
Find a file
Exact
forge-admin c27c0791fd
All checks were successful
org-policy / enforce (push) Successful in 11s
Details
Task 04: org policy enforcement - branch protection, merge style, protected workflow paths
2026-08-18 12:45:33 +02:00
.forgejo/workflows Task 04: org policy enforcement - branch protection, merge style, protected workflow paths 2026-08-18 12:45:33 +02:00
scripts Task 04: org policy enforcement - branch protection, merge style, protected workflow paths 2026-08-18 12:45:33 +02:00
README.md Task 04: org policy enforcement - branch protection, merge style, protected workflow paths 2026-08-18 12:45:33 +02:00

README.md

Platform/org-policy (task 04)

Scheduled enforcement (every 6h, plus on push / manual dispatch) of repo policy across the work orgs Packages / Products / Services — see scripts/enforce.mjs:

  • merge style: merge-commit + squash only, default squash. Fast-forward-only is DISABLED everywhere (known bug: ff-only merges can land before required checks pass).
  • branch protection on main:
    • no direct pushes -> PRs required (admins exempt: platform tooling pushes with admin PATs)
    • required status checks: contexts matching build*
    • protected file patterns: .forgejo/workflows/**;.gitea/workflows/**;.github/workflows/** -> non-admins cannot change CI callers even via PR (the pipeline security boundary)

Auth: repo Actions secret ORG_POLICY_TOKEN (admin PAT: write:repository, read:organization, read:user — see /root/assembly-credentials.txt on the VM, key org-policy-pat).

New repos are covered at the next scheduled run (<=6h gap); unit-new (task 06) should trigger workflow_dispatch on this repo after creating a repo to close the gap.