Skip to content

docs: correct the merge-method section against the live ruleset #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Bryan Fawcett (bryanfawcett) merged 1 commit into from
Sep 11, 2026
Merged

docs: correct the merge-method section against the live ruleset #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 63 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,13 @@
# mukoko-dev/.github

Org-wide defaults for `mukoko-dev`: the shared CI wiring, the lint
configuration every repository inherits, and the notes explaining why both
are shaped the way they are.
> Org-wide defaults for `mukoko-dev`: the shared CI wiring, the lint
> configuration every repository inherits, and the notes explaining why both
> are shaped the way they are.

[![Lint](https://github.com/mukoko-dev/.github/actions/workflows/lint.yml/badge.svg)](https://github.com/mukoko-dev/.github/actions/workflows/lint.yml)

**Workflow library:** [`nyuchi/.github`](https://github.com/nyuchi/.github/tree/main/.github/workflows)
| **Active ruleset:** `org-wide-main-protection` | **Merge method:** rebase only

## CI is not written here

Expand All @@ -21,6 +26,15 @@ Only add a workflow file here when the behaviour genuinely differs from the
shared one. If you ever do copy a reusable workflow into this org, say so in
the PR and record why, so the divergence is deliberate and visible.

What this repository does hold, in `.github/workflows/`, are three thin
callers that also apply to this repository itself:

| File | Name | Trigger |
| ------------------- | ---------- | ------------------------------------------------------------- |
| `lint.yml` | `Lint` | Pull requests, and pushes to `main`/`master`/`scaffold` |
| `pr-title-lint.yml` | `PR title` | `pull_request_target` — opened, edited, reopened, synchronize |
| `stale.yml` | `Stale` | Daily at 01:23 UTC, and `workflow_dispatch` |

[hub]: https://github.com/nyuchi/.github/tree/main/.github/workflows

## Every repository needs `lint.yml`
Expand Down Expand Up @@ -58,8 +72,20 @@ from a workflow in that repository:
| Next.js app or pnpm/Turborepo monorepo | `reusable-ci-nextjs-monorepo.yml` |
| TypeScript application | `reusable-ci-typescript.yml` |
| Published TypeScript package | `reusable-ci-typescript-lib.yml` |
| Python monorepo | `reusable-ci-python-monorepo.yml` |
| Rust monorepo | `reusable-ci-rust-monorepo.yml` |
| Docs site with `.mdx` | `reusable-ci-docs-mdx.yml` |
| Docker image or container | `reusable-ci-docker.yml`, `reusable-ci-container.yml` |
| Terraform or OpenTofu | `reusable-ci-terraform.yml`, `reusable-ci-opentofu.yml` |
| Solidity | `reusable-ci-solidity.yml` |
| any repository | `reusable-codeql.yml`, `reusable-dependency-review.yml` |

Also in the library, for repositories that want them: `reusable-release.yml`,
`reusable-sbom.yml`, `reusable-slsa-provenance.yml`,
`reusable-openssf-scorecard.yml`, `reusable-pr-title-lint.yml` and
`reusable-stale.yml`. The list above is not exhaustive — read
[the directory][hub] rather than trusting this table to stay complete.

## Lint configuration

`.prettierrc`, `.prettierignore`, `.markdownlint.jsonc`, `.yamllint.yaml` and
Expand All @@ -77,10 +103,38 @@ Two adjustments come up often:
becomes `{/_ … _/}` — corrupting the file. If a repository has `.mdx`
content, pass a `prettier-glob` that excludes it.

## Merge method
## Merge method and branch protection

**Rebase only.** `org-wide-main-protection` sets
`allowed_merge_methods: ["rebase"]`, and the repository settings agree with it:
every repository in this org has `allow_squash_merge: false`,
`allow_merge_commit: false`, `allow_rebase_merge: true` and
`allow_auto_merge: true`. Squash and merge-commit are off in both places.

Alongside the five required checks, the ruleset applies:

| Rule | Effect |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `deletion` | The default branch cannot be deleted |
| `non_fast_forward` | No force pushes |
| `required_linear_history` | No merge commits reach the default branch |
| `pull_request` | Changes land by PR. Stale reviews are dismissed on push, review threads must be resolved, and unattributed changes need an extra approval. `required_approving_review_count` is **0** |
| `required_status_checks` | Strict — the branch must be up to date with the base |

It applies to the default branch of every repository except `sandbox-*` and
`archive-*`.

There is **no `required_signatures` rule.** An earlier version of this
document said there was; there is not, and commits do not need to be signed
to merge.

A second ruleset, `enterprise-main-protection`, arrives from the `bundu-labs`
enterprise. It is in **evaluate** mode — it reports what it would have done
and blocks nothing.

## Licence

No `LICENSE` file is committed to this repository. Until one is added the
contents are under exclusive copyright.

The org ruleset allows **squash merges only**, alongside
`required_linear_history` and `required_signatures`. Note that the
repository-level settings in this org still leave merge-commit and rebase
switched on; the ruleset is what actually decides, and it permits squash
alone.
© Nyuchi Africa (Pvt) Ltd.