Shared configs rulesets (#122)

* move branch protection rules to workflows

* remove unnecessary config

* update deps

* start tests

* add shared-configs as a valid branch prefix.

* add permissions

* rename plugins

* fix typos

* fix json

* lint

* lint

* Update vitest.config.mts

Co-authored-by: Copilot <[email protected]>

* Update vitest.config.shared.mts

Co-authored-by: Copilot <[email protected]>

* lint

---------

Co-authored-by: Copilot <[email protected]>

Author: thedannywahl

.github/policies/branch-naming.yml

@@ -0,0 +1,6 @@
+# Branch must start with:
+# - any folder under apps/
+# - any folder under packages/
+# - shared-configs/
+# - release/
+branch_name_regex: '^(apps|packages)\/[^\/]+[\/_.-].+|^(shared-configs|release)[\/_.-].+'

.github/rulesets/require-pr-main.json

@@ -0,0 +1,5 @@
+import yaml
+import sys
+
+with open('.github/policies/branch-naming.yml') as f:
+    print(yaml.safe_load(f)['branch_name_regex'])

.github/rulesets/require-pr-package.json

@@ -0,0 +1,16 @@
+import os
+import re
+import sys
+
+branch = os.environ.get('BRANCH')
+pattern = os.environ.get('REGEX')
+
+if not branch or not pattern:
+    print('❌ Missing BRANCH or REGEX environment variable.')
+    sys.exit(1)
+
+if re.fullmatch(pattern, branch):
+    print('✅ Branch name is valid.')
+else:
+    print(f'❌ Branch name {branch} does not match policy:\n  {pattern}')
+    sys.exit(1)

.github/scripts/read_branch_policy.py

@@ -0,0 +1,30 @@
+name: Branch naming policy
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, edited, ready_for_review]
+
+jobs:
+  check-branch-name:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (no submodules needed)
+        uses: actions/checkout@v4
+
+      - name: Read policy
+        id: policy
+        run: |
+          regex=$(python .github/scripts/read_branch_policy.py)
+          echo "regex=$regex" >> $GITHUB_OUTPUT
+
+      - name: Validate branch name
+        env:
+          BRANCH: ${{ github.head_ref || github.ref_name }}
+          REGEX: ${{ steps.policy.outputs.regex }}
+        run: |
+          echo "Branch: $BRANCH"
+          echo "Regex : $REGEX"
+          python .github/scripts/validate_branch_name.py

.github/scripts/validate_branch_name.py

@@ -33,19 +33,23 @@ jobs:
           fi
           echo "Package/app branches: ${PKGS[@]}"
 
-          # If base is main, allow only main-* or <packagename>-* branches
+          # If base is main, allow only main-*, shared-configs-*, or <packagename>-* branches
           if [[ "$BASE" == "main" ]]; then
             for pkg in "${PKGS[@]}"; do
               if [[ "$HEAD" =~ ^"${pkg}-" ]]; then
                 echo "✅ Allowed: PR from branch '$HEAD' (package prefix)"
                 exit 0
               fi
             done
+            if [[ "$HEAD" =~ ^"shared-configs-" ]]; then
+              echo "✅ Allowed: PR from branch '$HEAD' (shared-configs prefix)"
+              exit 0
+            fi
             if [[ "$HEAD" =~ ^"main-" ]]; then
               echo "✅ Allowed: PR from branch '$HEAD' (main- prefix)"
               exit 0
             fi
-            echo "❌ Only PRs from branches starting with 'main-' or '<package>-' may target main."
+            echo "❌ Only PRs from branches starting with 'main-', 'shared-configs-', or '<package>-' may target main."
             exit 1
           fi
 

.github/workflows/branch-naming-check.yml

@@ -1,4 +1,3 @@
-# Logs
 logs
 *.log
 npm-debug.log*
@@ -11,7 +10,8 @@ node_modules
 dist-ssr
 dist
 pub
-coverage  
+coverage/*
+!coverage.yml
 *.local
 
 .idea

.github/workflows/validate-pr-prefixes.yml

@@ -0,0 +1,7 @@
+import { describe, it, expect } from 'vitest';
+
+describe('Package exists', () => {
+  it('should return true', () => {
+    expect(true).toBe(true);
+  });
+});

.gitignore

@@ -0,0 +1,6 @@
+import baseConfig from "@instructure.ai/shared-configs/vitest";
+import { mergeConfig } from "vitest/config";
+
+export default mergeConfig(baseConfig, {
+
+});