fix(audit): merge ruleset required checks when legacy list is empty - #537
Closed
rockygeekz wants to merge 1 commit into
Closed
fix(audit): merge ruleset required checks when legacy list is empty#537rockygeekz wants to merge 1 commit into
rockygeekz wants to merge 1 commit into
Conversation
Repos like ansible/actions keep branch protection for reviews but define required status checks in rulesets only. The legacy protection API returns an empty checks array, which made weekly supply-chain audits false-positive "no required status checks configured". Fall back to rulesets when legacy checks are missing.
Contributor
Author
|
Closing: fork PRs to ansible/team-devtools do not get working CI here (checkout step fails with |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Weekly supply-chain audit flagged
ansible/actionsas having no required status checks even though the repo uses GitHub rulesets (ack / ack,tox / check,check, SonarCloud).Legacy branch protection API still returns a protection object, but
required_status_checks.checksis empty after checks moved to rulesets.collect_branch_protection()returned early without reading rulesets.This merges ruleset required checks when the legacy list is empty.
Test plan
ansible/actionsand confirm required checks are populated