Add branch protection for medik8s org#76526
Add branch protection for medik8s org#76526openshift-merge-bot[bot] merged 2 commits intoopenshift:mainfrom
Conversation
Required by Red Hat source code controls audit (Section 6.1). https://redhat.atlassian.net/browse/RHWA-788 Assisted-by: Claude claude-opus-4-6
openshift-ci-robot
added
the
rehearsals-ack
openshift-ci
bot
added
the
approved
Assisted-by: Claude claude-opus-4-6
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@razo7: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| dismiss_stale_reviews: true | ||
| require_code_owner_reviews: true | ||
| required_approving_review_count: 1 |
There was a problem hiding this comment.
IIUC this part is already enforced.
Is it because it's set on each repo individually , or am I missing something here ?
There was a problem hiding this comment.
IIUC this part is already enforced.
Please elaborate on how
There was a problem hiding this comment.
Sure,
For example taking this dismiss_stale_reviews: true
IIUC this means that pushing will prevent a previous confirmation.
ATM when we push new code it'll indeed remove the lgtm label.
| branch-protection: | ||
| orgs: | ||
| medik8s: | ||
| enforce_admins: true |
There was a problem hiding this comment.
Not sure about that.
Don't we want to allow admins more flexibility ?
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: razo7, slintes The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@razo7: Updated the
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
Why we need this MR:
Branch protection on medik8s repos currently only has required status checks, force push blocked, and deletion blocked (from Prow's
protect-tested-repos: truedefaults). PR review requirements were never configured, meaning anyone with write access can push directly to protected branches bypassing the PR workflow. Required by Red Hat source code controls audit — Section 6.1.Changes made:
Add a
branch-protectionstanza to medik8s_prowconfig.yamlthat applies org-wide via the Prow branchprotector:required_approving_review_count: 1— require at least 1 approving review before mergedismiss_stale_reviews: true— auto-dismiss approvals when new commits are pushedrequire_code_owner_reviews: true— require CODEOWNERS-designated reviewers to approveenforce_admins: true— prevent admins from bypassing branch protectionWhich issue(s) this MR fixes:
RHWA-788