Repository navigation
Vendor the release gate fix for ruleset-only branch protection - #32
Merged
Merged
Conversation
A branch protected only by repository rulesets reports protected: true, but the classic required_status_checks endpoint answers 404 "Branch not protected", so the CI eligibility check always failed closed. The reviewed runtime now treats that 404 as "no classic checks", reads required status checks from the branch's active rulesets, and still fails closed on any other error. Vendored with .project/install.py; the runtime lock is refreshed and the justfile is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Vendors the reviewed project-command runtime with
.project/install.py. Only.project/projectctl.py,.project/tests/test_projectctl.pyand.project/runtime.lock.jsonchange; thejustfileregenerates unchanged.Why
The release gate's CI check asked the classic
protection/required_status_checksendpoint whenevermainreportedprotected: true. A branch protected only by repository rulesets answers404 Branch not protectedthere, so the gate always failed closed. The runtime now treats that one 404 as "no classic checks", reads required checks from the branch's active rulesets, keepsrelease.required_checksas the base set, and still fails closed on any other error.No behaviour change here today:
mainin this repository is not protected, so the gate skips both protection queries, exactly as before. This keeps the vendored runtime byte-identical with the reviewed source.Verification
just checkpasses, including 54 contract tests (five new regressions for the gate).🤖 Generated with Claude Code