9f9c1a7909
Checks in JSON specs for three rulesets (main-protection, release-branches, tag-immutability), a CODEOWNERS file (advisory), and scripts/sync-rulesets.sh to apply them. Enforcement is `disabled` in all three files — PR-2 will apply with `evaluate` for a 1-week dry-run, PR-3 will flip to `active`. See docs/branch-protection.md for the full rollout plan.
35 lines
1.0 KiB
Bash
Executable File
35 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO="${REPO:-GSD-redux/get-shit-done-redux}"
|
|
ENFORCEMENT="${ENFORCEMENT:-evaluate}"
|
|
|
|
case "$ENFORCEMENT" in
|
|
disabled|evaluate|active) ;;
|
|
*)
|
|
echo "ERROR: ENFORCEMENT must be one of: disabled|evaluate|active" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
RULESETS_DIR="$SCRIPT_DIR/../.github/rulesets"
|
|
|
|
for ruleset_file in "$RULESETS_DIR"/*.json; do
|
|
name="$(jq -r '.name' "$ruleset_file")"
|
|
|
|
body="$(jq --arg enforcement "$ENFORCEMENT" '.enforcement = $enforcement' "$ruleset_file")"
|
|
|
|
existing_id="$(gh api "repos/$REPO/rulesets" --jq ".[] | select(.name==\"$name\") | .id" 2>/dev/null || true)"
|
|
|
|
if [ -n "$existing_id" ]; then
|
|
gh api --method PUT "repos/$REPO/rulesets/$existing_id" \
|
|
--input - <<< "$body" > /dev/null
|
|
echo "[update] $name -> enforcement=$ENFORCEMENT"
|
|
else
|
|
gh api --method POST "repos/$REPO/rulesets" \
|
|
--input - <<< "$body" > /dev/null
|
|
echo "[create] $name -> enforcement=$ENFORCEMENT"
|
|
fi
|
|
done
|