chore: add release tag protection ruleset for code repos - #214
Open
marcusburghardt wants to merge 2 commits into
Open
chore: add release tag protection ruleset for code repos#214marcusburghardt wants to merge 2 commits into
marcusburghardt wants to merge 2 commits into
Conversation
Add org-level ruleset to prevent deletion and force-push of release tags (v*) across all code repositories. This protects supply chain integrity by ensuring published version tags remain immutable. Replaces the manual "tags" ruleset on complypack (id=18348763) and extends the same protection to all code repos. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
marcusburghardt
requested review from
gxmiranda,
jflowers and
jpower432
as code owners
September 3, 2026 15:35
Most manual repo-level rulesets have been removed. Update the migration comment to list only the two remaining: - complypack: tags — replaced by the new release tag protection - complytime: main — replaced by repos/complytime.yml Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add an org-level ruleset to prevent deletion and force-push of release
tags (
v*) across all code repositories. Protects supply chain integrityby ensuring published version tags remain immutable.
What it does
deletionv*tagsnon_fast_forwardv*tags to a different commitScope
All code repos:
complyctl, complypack, complytime-collector-components, complytime-policies,
complytime-providers, homebrew-tap, org-infra
Non-code repos (community, complytime, complytime-demos, website) are excluded
since they do not publish versioned artifacts.
Context
This replaces the manually created "tags" ruleset on complypack (id=18348763),
which was the only repo with tag protection. The same rules are now applied
consistently to all code repos.
Post-merge steps