You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by pk...@apache.org on 2026/05/12 21:54:35 UTC
(commons-parent) branch feat/rulesets created (now e929ebe)
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a change to branch feat/rulesets
in repository https://gitbox.apache.org/repos/asf/commons-parent.git
at e929ebe Add GitHub Rulesets via `.asf.yaml`
This branch includes the following new commits:
new e929ebe Add GitHub Rulesets via `.asf.yaml`
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(commons-parent) 01/01: Add GitHub Rulesets via `.asf.yaml`
Posted by pk...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ppkarwasz pushed a commit to branch feat/rulesets
in repository https://gitbox.apache.org/repos/asf/commons-parent.git
commit e929ebe4ffc90cf0594ec8256358acd9ee921477
Author: Piotr P. Karwasz <pk...@apache.org>
AuthorDate: Tue May 12 23:51:01 2026 +0200
Add GitHub Rulesets via `.asf.yaml`
Configure a minimal Ruleset to:
- Prevent deletion and force-push on the default (`master`) branch and the `release` branch.
- Prevent deletion, force-push, or update of any `rel/*` tag.
Together, these rules satisfy the Tier 1 protection level defined by [Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection) and should allow for [SLSA Source L3](https://slsa.dev/spec/v1.2/source-requirements#source-l3) compliance, once we introduce a workflow to push provenance attestation at each commit.
---
.asf.yaml | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/.asf.yaml b/.asf.yaml
index ac7409d..3ae43cd 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -13,6 +13,13 @@
# See the License for the specific language governing permissions and
# limitations under the License.
+#
+# Additional non-standard features
+#
+meta:
+ environments:
+ - github_rulesets
+
github:
description: "Apache Commons Parent"
homepage: https://commons.apache.org/parent/
@@ -28,3 +35,29 @@ notifications:
pullrequests_bot_dependabot: dependabot@commons.apache.org
issues_bot_codecov-commenter: notifications@commons.apache.org
pullrequests_bot_codecov-commenter: notifications@commons.apache.org
+
+ # Clear Protected Branches configuration: it is replaced by GitHub Rulesets
+ protected_branches: ~
+
+ rulesets:
+ # Use minimum level of protection: restrict deletion and force pushes.
+ - name: "Branch protection"
+ type: branch
+ branches:
+ includes:
+ - "~DEFAULT_BRANCH"
+ - "release"
+ # Use raw rules, until a convenience notation for `restrict_update` is introduced.
+ # See: https://github.com/apache/infrastructure-asfyaml/issues/96
+ #
+ # The raw rules need to follow the syntax given in:
+ # https://docs.github.com/en/rest/repos/rules?apiVersion=2026-03-10#update-a-repository-ruleset
+ - name: "Tag protection"
+ type: tag
+ branches:
+ includes:
+ - "rel/*"
+ rules:
+ - type: deletion
+ - type: non_fast_forward
+ - type: update