From 204106195c4624760a617dc9b1be69e94fddc903 Mon Sep 17 00:00:00 2001 From: Bryan Fawcett Date: Sat, 12 Sep 2026 04:03:41 +0800 Subject: [PATCH] docs: correct the merge-method section against the live ruleset The Merge method section was wrong in both directions, and this is the document other repos in the org are meant to copy their settings from. It said "the org ruleset allows squash merges only". GET /orgs/mukoko-dev/rulesets/22932468 returns `allowed_merge_methods: ["rebase"]` on the pull_request rule. Rebase, not squash. It said "the repository-level settings in this org still leave merge-commit and rebase switched on". Every repository checked - mukoko, mukoko-auth, kweli, kweli-mcp, mukoko-lingo, mukoko-home, packages-ui - reports allow_squash_merge: false, allow_merge_commit: false, allow_rebase_merge: true, allow_auto_merge: true. The settings and the ruleset agree; the README was the only thing disagreeing with either. It listed `required_signatures` as part of the ruleset. The ruleset's rules are deletion, non_fast_forward, required_linear_history, pull_request and required_status_checks. There is no signature requirement, and the README now says so explicitly so the claim does not come back. Added, all verified against the API: - The rest of what the pull_request rule actually does - stale reviews dismissed on push, review threads must resolve, unattributed changes need an extra approval, and required_approving_review_count is 0. - That required_status_checks is strict, so branches must be up to date. - That the ruleset skips sandbox-* and archive-* repositories. - The second ruleset, enterprise-main-protection, inherited from the bundu-labs enterprise and currently in evaluate mode, blocking nothing. Also: - Documented the three workflows this repository actually ships - lint.yml, pr-title-lint.yml and stale.yml - with their triggers. The README described only lint.yml. - Extended the reusable-workflow table. nyuchi/.github publishes 21 reusable workflows; the table listed five of them and read as exhaustive. It now covers Python, Rust, MDX docs, Docker, Terraform/OpenTofu and Solidity, and says plainly that the directory is the authority. - Added the Lint badge (curls 200) and an at-a-glance line, and a licence section recording that no LICENSE file is committed here. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 72 ++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 63 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index abb5d3d..fdb9a8a 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,13 @@ # mukoko-dev/.github -Org-wide defaults for `mukoko-dev`: the shared CI wiring, the lint -configuration every repository inherits, and the notes explaining why both -are shaped the way they are. +> Org-wide defaults for `mukoko-dev`: the shared CI wiring, the lint +> configuration every repository inherits, and the notes explaining why both +> are shaped the way they are. + +[![Lint](https://github.com/mukoko-dev/.github/actions/workflows/lint.yml/badge.svg)](https://github.com/mukoko-dev/.github/actions/workflows/lint.yml) + +**Workflow library:** [`nyuchi/.github`](https://github.com/nyuchi/.github/tree/main/.github/workflows) +| **Active ruleset:** `org-wide-main-protection` | **Merge method:** rebase only ## CI is not written here @@ -21,6 +26,15 @@ Only add a workflow file here when the behaviour genuinely differs from the shared one. If you ever do copy a reusable workflow into this org, say so in the PR and record why, so the divergence is deliberate and visible. +What this repository does hold, in `.github/workflows/`, are three thin +callers that also apply to this repository itself: + +| File | Name | Trigger | +| ------------------- | ---------- | ------------------------------------------------------------- | +| `lint.yml` | `Lint` | Pull requests, and pushes to `main`/`master`/`scaffold` | +| `pr-title-lint.yml` | `PR title` | `pull_request_target` — opened, edited, reopened, synchronize | +| `stale.yml` | `Stale` | Daily at 01:23 UTC, and `workflow_dispatch` | + [hub]: https://github.com/nyuchi/.github/tree/main/.github/workflows ## Every repository needs `lint.yml` @@ -58,8 +72,20 @@ from a workflow in that repository: | Next.js app or pnpm/Turborepo monorepo | `reusable-ci-nextjs-monorepo.yml` | | TypeScript application | `reusable-ci-typescript.yml` | | Published TypeScript package | `reusable-ci-typescript-lib.yml` | +| Python monorepo | `reusable-ci-python-monorepo.yml` | +| Rust monorepo | `reusable-ci-rust-monorepo.yml` | +| Docs site with `.mdx` | `reusable-ci-docs-mdx.yml` | +| Docker image or container | `reusable-ci-docker.yml`, `reusable-ci-container.yml` | +| Terraform or OpenTofu | `reusable-ci-terraform.yml`, `reusable-ci-opentofu.yml` | +| Solidity | `reusable-ci-solidity.yml` | | any repository | `reusable-codeql.yml`, `reusable-dependency-review.yml` | +Also in the library, for repositories that want them: `reusable-release.yml`, +`reusable-sbom.yml`, `reusable-slsa-provenance.yml`, +`reusable-openssf-scorecard.yml`, `reusable-pr-title-lint.yml` and +`reusable-stale.yml`. The list above is not exhaustive — read +[the directory][hub] rather than trusting this table to stay complete. + ## Lint configuration `.prettierrc`, `.prettierignore`, `.markdownlint.jsonc`, `.yamllint.yaml` and @@ -77,10 +103,38 @@ Two adjustments come up often: becomes `{/_ … _/}` — corrupting the file. If a repository has `.mdx` content, pass a `prettier-glob` that excludes it. -## Merge method +## Merge method and branch protection + +**Rebase only.** `org-wide-main-protection` sets +`allowed_merge_methods: ["rebase"]`, and the repository settings agree with it: +every repository in this org has `allow_squash_merge: false`, +`allow_merge_commit: false`, `allow_rebase_merge: true` and +`allow_auto_merge: true`. Squash and merge-commit are off in both places. + +Alongside the five required checks, the ruleset applies: + +| Rule | Effect | +| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `deletion` | The default branch cannot be deleted | +| `non_fast_forward` | No force pushes | +| `required_linear_history` | No merge commits reach the default branch | +| `pull_request` | Changes land by PR. Stale reviews are dismissed on push, review threads must be resolved, and unattributed changes need an extra approval. `required_approving_review_count` is **0** | +| `required_status_checks` | Strict — the branch must be up to date with the base | + +It applies to the default branch of every repository except `sandbox-*` and +`archive-*`. + +There is **no `required_signatures` rule.** An earlier version of this +document said there was; there is not, and commits do not need to be signed +to merge. + +A second ruleset, `enterprise-main-protection`, arrives from the `bundu-labs` +enterprise. It is in **evaluate** mode — it reports what it would have done +and blocks nothing. + +## Licence + +No `LICENSE` file is committed to this repository. Until one is added the +contents are under exclusive copyright. -The org ruleset allows **squash merges only**, alongside -`required_linear_history` and `required_signatures`. Note that the -repository-level settings in this org still leave merge-commit and rebase -switched on; the ruleset is what actually decides, and it permits squash -alone. +© Nyuchi Africa (Pvt) Ltd.