Skip to content

Commit 2becd44

Browse files
d-oitd-oit
committed
feat: implement comprehensive branch protection rules
- Added CODEOWNERS file for mandatory code reviews - Created branch protection configuration for main and develop branches - Added automated setup script for branch protection rules - Created PR template with quality gate checklist - Added issue templates for bugs and feature requests - Comprehensive documentation for branch protection setup Quality gates enforced: - Required status checks: lint, build, test, security, performance - Mandatory PR reviews with code owner approval - Conversation resolution required - Force pushes and deletions disabled - Admin enforcement enabled for main branch This ensures all code changes go through proper quality validation before merge.
1 parent 8810b00 commit 2becd44

File tree

7 files changed

+436
-0
lines changed

7 files changed

+436
-0
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: '[BUG] '
5+
labels: bug
6+
assignees: ''
7+
8+
---
9+
10+
## 🐛 Bug Description
11+
A clear and concise description of what the bug is.
12+
13+
## 🔄 To Reproduce
14+
Steps to reproduce the behavior:
15+
1. Go to '...'
16+
2. Click on '....'
17+
3. Scroll down to '....'
18+
4. See error
19+
20+
## ✅ Expected behavior
21+
A clear and concise description of what you expected to happen.
22+
23+
## 📸 Screenshots
24+
If applicable, add screenshots to help explain your problem.
25+
26+
## 🖥️ Environment
27+
- OS: [e.g. Ubuntu 22.04, Windows 11, macOS 13]
28+
- Rust version: [e.g. 1.75.0]
29+
- Code Guardian version: [e.g. 0.1.0]
30+
31+
## 📋 Additional context
32+
Add any other context about the problem here.
33+
34+
## 🔍 Quality Gate Impact
35+
- [ ] This bug affects build process
36+
- [ ] This bug affects test execution
37+
- [ ] This bug affects security scanning
38+
- [ ] This bug affects performance

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: '[FEATURE] '
5+
labels: enhancement
6+
assignees: ''
7+
8+
---
9+
10+
## 🚀 Feature Description
11+
A clear and concise description of what the feature is.
12+
13+
## 💡 Motivation
14+
Is your feature request related to a problem? Please describe.
15+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
16+
17+
## 📝 Proposed Solution
18+
A clear and concise description of what you want to happen.
19+
20+
## 🔄 Alternatives Considered
21+
A clear and concise description of any alternative solutions or features you've considered.
22+
23+
## 📋 Implementation Checklist
24+
- [ ] Core logic implementation
25+
- [ ] Unit tests added
26+
- [ ] Integration tests added
27+
- [ ] Documentation updated
28+
- [ ] Performance impact assessed
29+
- [ ] Security implications reviewed
30+
31+
## 🎯 Quality Gates
32+
How will this feature be tested?
33+
- [ ] Linting requirements met
34+
- [ ] Build process updated (if needed)
35+
- [ ] Test coverage maintained
36+
- [ ] Security scanning passes
37+
- [ ] Performance benchmarks updated (if applicable)
38+
39+
## 📋 Additional context
40+
Add any other context or screenshots about the feature request here.

‎.github/branch-protection-config.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"main": {
3+
"required_status_checks": {
4+
"strict": true,
5+
"contexts": [
6+
"Test (ubuntu-latest, stable)",
7+
"Test (windows-latest, stable)",
8+
"Test (macos-latest, stable)",
9+
"Coverage",
10+
"Security Audit",
11+
"Performance Benchmark",
12+
"CodeQL / Analyze (rust)",
13+
"CodeQL / Analyze (javascript)",
14+
"Lint",
15+
"Build"
16+
]
17+
},
18+
"enforce_admins": true,
19+
"required_pull_request_reviews": {
20+
"required_approving_review_count": 1,
21+
"dismiss_stale_reviews": true,
22+
"require_code_owner_reviews": true,
23+
"require_last_push_approval": false
24+
},
25+
"restrictions": null,
26+
"allow_force_pushes": false,
27+
"allow_deletions": false,
28+
"block_creations": false,
29+
"required_conversation_resolution": true,
30+
"lock_branch": false,
31+
"allow_fork_syncing": true
32+
},
33+
"develop": {
34+
"required_status_checks": {
35+
"strict": true,
36+
"contexts": [
37+
"Test (ubuntu-latest, stable)",
38+
"Coverage",
39+
"Security Audit",
40+
"Lint",
41+
"Build"
42+
]
43+
},
44+
"enforce_admins": false,
45+
"required_pull_request_reviews": {
46+
"required_approving_review_count": 1,
47+
"dismiss_stale_reviews": true,
48+
"require_code_owner_reviews": false,
49+
"require_last_push_approval": false
50+
},
51+
"restrictions": null,
52+
"allow_force_pushes": false,
53+
"allow_deletions": false,
54+
"block_creations": false,
55+
"required_conversation_resolution": true,
56+
"lock_branch": false,
57+
"allow_fork_syncing": true
58+
}
59+
}

‎.github/pull_request_template.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## Pull Request Checklist
2+
3+
### 🔍 Quality Gates
4+
Please ensure all quality gates pass before requesting review:
5+
6+
- [ ] **Lint**: Code passes `cargo fmt` and `cargo clippy` checks
7+
- [ ] **Build**: All crates build successfully (`cargo build --workspace`)
8+
- [ ] **Test**: All tests pass (`cargo test --workspace`)
9+
- [ ] **Security**: No security vulnerabilities detected
10+
- [ ] **Performance**: Performance impact assessed (if applicable)
11+
- [ ] **Documentation**: Code is properly documented
12+
13+
### 📝 Description
14+
<!-- Provide a brief description of the changes -->
15+
16+
### 🎯 Type of Change
17+
- [ ] Bug fix (non-breaking change which fixes an issue)
18+
- [ ] New feature (non-breaking change which adds functionality)
19+
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
20+
- [ ] Documentation update
21+
- [ ] Performance improvement
22+
- [ ] Security enhancement
23+
24+
### 🧪 Testing
25+
<!-- Describe the tests you ran and how to reproduce them -->
26+
27+
- [ ] Unit tests added/updated
28+
- [ ] Integration tests added/updated
29+
- [ ] Manual testing performed
30+
31+
### 📚 Documentation
32+
- [ ] Code comments added/updated
33+
- [ ] API documentation updated
34+
- [ ] User documentation updated (if applicable)
35+
- [ ] CHANGELOG.md updated
36+
37+
### 🔒 Security Considerations
38+
- [ ] No sensitive data exposed
39+
- [ ] Security implications reviewed
40+
- [ ] Dependencies are secure and up-to-date
41+
42+
### 📋 Additional Notes
43+
<!-- Any additional information, breaking changes, or considerations -->
44+
45+
---
46+
47+
**By submitting this PR, I confirm that:**
48+
- [ ] I have read and followed the contributing guidelines
49+
- [ ] My code follows the project's style guidelines
50+
- [ ] I have performed a self-review of my own code
51+
- [ ] All quality gates are passing

‎CODEOWNERS‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Global code owners for the code-guardian project
2+
# These users will be requested for review when anyone opens a pull request
3+
4+
# Global owners - will be requested for review on all files
5+
* @d-oit
6+
7+
# Core library changes require core team review
8+
/crates/core/ @d-oit
9+
10+
# CLI changes require CLI maintainer review
11+
/crates/cli/ @d-oit
12+
13+
# GitHub workflows and CI/CD require DevOps review
14+
/.github/ @d-oit
15+
/scripts/ @d-oit
16+
/Makefile @d-oit
17+
18+
# Documentation changes
19+
/docs/ @d-oit
20+
/README.md @d-oit
21+
/CONTRIBUTING.md @d-oit
22+
23+
# Security and configuration files
24+
/deny.toml @d-oit
25+
/Cargo.toml @d-oit
26+
/.gitignore @d-oit

‎docs/BRANCH_PROTECTION_SETUP.md‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
# Branch Protection Setup Guide
2+
3+
This guide provides instructions for setting up branch protection rules to enforce the quality gates in the code-guardian project.
4+
5+
## 🎯 Overview
6+
7+
Branch protection rules ensure that all code changes go through proper quality gates before being merged into protected branches. This maintains code quality, security, and stability.
8+
9+
## 🔧 Automated Setup
10+
11+
### Prerequisites
12+
- GitHub CLI (`gh`) installed and authenticated
13+
- Repository admin permissions
14+
- All workflows successfully running
15+
16+
### Quick Setup
17+
```bash
18+
# Run the automated setup script
19+
./scripts/setup-branch-protection.sh
20+
```
21+
22+
## 📱 Manual Setup (GitHub Web Interface)
23+
24+
If the automated script fails due to permissions, follow these manual steps:
25+
26+
### 1. Navigate to Branch Settings
27+
1. Go to your repository on GitHub
28+
2. Click **Settings** tab
29+
3. Click **Branches** in the left sidebar
30+
31+
### 2. Configure Main Branch Protection
32+
33+
Click **Add rule** or edit existing rule for `main` branch:
34+
35+
#### Required Status Checks
36+
- ✅ **Require status checks to pass before merging**
37+
- ✅ **Require branches to be up to date before merging**
38+
39+
**Required checks:**
40+
- `Test (ubuntu-latest, stable)`
41+
- `Test (windows-latest, stable)`
42+
- `Test (macos-latest, stable)`
43+
- `Coverage`
44+
- `Security Audit`
45+
- `Performance Benchmark`
46+
- `CodeQL / Analyze (rust)`
47+
- `CodeQL / Analyze (javascript)`
48+
- `Lint`
49+
- `Build`
50+
51+
#### Pull Request Reviews
52+
- ✅ **Require a pull request before merging**
53+
- ✅ **Require approvals: 1**
54+
- ✅ **Dismiss stale reviews when new commits are pushed**
55+
- ✅ **Require review from code owners**
56+
57+
#### Additional Settings
58+
- ✅ **Restrict pushes that create files**
59+
- ✅ **Require conversation resolution before merging**
60+
- ✅ **Include administrators**
61+
- ❌ **Allow force pushes**
62+
- ❌ **Allow deletions**
63+
64+
### 3. Configure Develop Branch Protection
65+
66+
Create a similar rule for `develop` branch with these differences:
67+
- Fewer required status checks (core quality gates only)
68+
- ❌ **Include administrators** (disabled for flexibility)
69+
- Same review requirements
70+
71+
#### Required Status Checks for Develop
72+
- `Test (ubuntu-latest, stable)`
73+
- `Coverage`
74+
- `Security Audit`
75+
- `Lint`
76+
- `Build`
77+
78+
## 🛡️ Quality Gates Enforced
79+
80+
### Code Quality
81+
- **Linting**: `cargo fmt` and `cargo clippy` must pass
82+
- **Building**: All workspace crates must build successfully
83+
- **Testing**: All tests must pass on multiple platforms
84+
85+
### Security
86+
- **Security Audit**: No known vulnerabilities in dependencies
87+
- **CodeQL Analysis**: Static analysis for security issues
88+
- **License Compliance**: All dependencies have approved licenses
89+
90+
### Performance
91+
- **Benchmarks**: Performance regressions are detected
92+
- **Coverage**: Code coverage requirements are met
93+
94+
## 🔍 Verification
95+
96+
After setup, verify the protection rules:
97+
98+
```bash
99+
# Check current protection status
100+
gh api repos/:owner/:repo/branches/main/protection
101+
102+
# List required status checks
103+
gh api repos/:owner/:repo/branches/main/protection/required_status_checks
104+
```
105+
106+
## 🚫 Common Issues
107+
108+
### Permission Errors
109+
- Ensure you have admin permissions on the repository
110+
- Check that your GitHub token has the `repo` scope
111+
112+
### Missing Status Checks
113+
- Ensure all workflows have run at least once
114+
- Status check names must match exactly (case-sensitive)
115+
116+
### Code Owner Issues
117+
- Verify `CODEOWNERS` file is in the repository root
118+
- Check that specified users/teams exist and have access
119+
120+
## 📋 Maintenance
121+
122+
### Adding New Status Checks
123+
When adding new workflows:
124+
1. Update `.github/branch-protection-config.json`
125+
2. Run `./scripts/setup-branch-protection.sh` or update manually
126+
3. Test with a test PR
127+
128+
### Updating Code Owners
129+
Edit the `CODEOWNERS` file in the repository root to modify review requirements.
130+
131+
## 🎉 Best Practices
132+
133+
1. **Start with develop branch** - Test protection rules on develop before applying to main
134+
2. **Gradual rollout** - Add protection rules incrementally
135+
3. **Monitor impact** - Watch for blocked PRs and adjust as needed
136+
4. **Regular review** - Periodically review and update protection rules
137+
5. **Team communication** - Ensure all team members understand the quality gates
138+
139+
## 📞 Support
140+
141+
If you encounter issues with branch protection setup:
142+
1. Check the GitHub documentation on branch protection
143+
2. Verify your permissions and token scopes
144+
3. Test with a simple PR to identify specific failing checks
145+
4. Review workflow logs for detailed error messages

0 commit comments

Comments
 (0)