From 78537e6c95f37af9b021a9f2b38124852691655e Mon Sep 17 00:00:00 2001 From: Nils Lehnen <30603423+iderex@users.noreply.github.com> Date: Sun, 30 Aug 2026 10:10:00 +0200 Subject: [PATCH] Re-take the ruleset pastes against the rules the branches carry now [#217] Five pasted outputs in CONTRIBUTING.md, GOVERNANCE.md and docs/parity.md were taken on 2026-08-08 and 2026-08-09 and none of them reproduces: the ruleset on this repository's default branch was last written on 2026-08-28 and carries required_signatures, and the target's ruleset carries it too. Four of the five were a stale rule list under prose that stayed true. The fifth was worse: the parity ledger answers Nothing to what this repository requires that the target does not, and argued it from neither ruleset carrying the rule and from nothing at either branch refusing an unsigned commit. Both clauses are false now. The answer survives because both branches gained the rule rather than one, so the row reached the right answer from two readings that had stopped holding, and a ledger read to learn where two gates differ is the worst place for that. This prevents a reader taking any of the five for the state of a branch, and it prevents a contributor reading the sign-off section and learning nothing about the rule that refuses the merge: CONTRIBUTING.md now says beside its own paste that a commit has to be signed as well as signed off. It was found by re-running the command under the paste in CONTRIBUTING.md while reading the rule types for #47, rather than by anything in this tree. No leg of the gate reaches the network and no verb here reads a ruleset, so nothing could have caught it. Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com> --- CONTRIBUTING.md | 6 ++++-- GOVERNANCE.md | 4 ++-- docs/parity.md | 25 +++++++++++++++++-------- 3 files changed, 23 insertions(+), 12 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ca33fb8..37db927 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -94,9 +94,11 @@ bypass actors: gh api repos/Flowfin/site/rulesets/20572614 \ --jq '{enforcement, bypass: .bypass_actors, required: [.rules[].type]}' - {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request"]} + {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request","required_signatures"]} -Run 2026-08-09. +Run 2026-08-30. The last rule in that list is why a commit reaching `main` here +has to be signed as well as signed off: the trailer below is the assertion, and +the signature is what the branch refuses a merge without. Nothing refuses a pull request that closes no issue, and nothing checks that the number in a commit subject belongs to an issue that exists. The rule is held by diff --git a/GOVERNANCE.md b/GOVERNANCE.md index 67cba2d..696aa13 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -36,9 +36,9 @@ Every change starts as an issue and lands as a pull request. Direct pushes to 20572614 gh api repos/Flowfin/site/rulesets/20572614 \ --jq '{enforcement, bypass: .bypass_actors, required: [.rules[].type]}' - {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request"]} + {"bypass":[],"enforcement":"active","required":["deletion","non_fast_forward","pull_request","required_signatures"]} -Run 2026-08-08. Two things that output does not carry are worth naming rather +Run 2026-08-30. Two things that output does not carry are worth naming rather than leaving a reader to notice. The ruleset requires no approving review, so a pull request here is merged by diff --git a/docs/parity.md b/docs/parity.md index ddc8aa8..f954cad 100644 --- a/docs/parity.md +++ b/docs/parity.md @@ -19,9 +19,9 @@ Run 2026-08-08. ## Where this repository stands gh api repos/Flowfin/site/rulesets/20572614 --jq '[.rules[].type]' - ["deletion","non_fast_forward","pull_request"] + ["deletion","non_fast_forward","pull_request","required_signatures"] -Run 2026-08-08. No status check is required here at all, so the gap is the whole +Run 2026-08-30. No status check is required here at all, so the gap is the whole list. Every row below says what the check becomes; none of them says that anything is required yet. @@ -200,16 +200,25 @@ left on with a reason recorded here, is not a change to this tree either. ## What this repository requires that the target does not Nothing, today, and the sentence is written this way round because the plan -expected the opposite. Verified signatures on the default branch would be an -addition rather than parity, and neither ruleset carries the rule: +expected the opposite. Verified signatures on the default branch would have been +an addition rather than parity, and both rulesets carry the rule: gh api repos/Flowfin/jellyfin-plugin-sso/rulesets/18802863 --jq '[.rules[].type]' - ["deletion","non_fast_forward","required_status_checks","pull_request"] + ["deletion","non_fast_forward","required_status_checks","pull_request","required_signatures"] gh api repos/Flowfin/site/rulesets/20572614 --jq '[.rules[].type]' - ["deletion","non_fast_forward","pull_request"] + ["deletion","non_fast_forward","pull_request","required_signatures"] -Run 2026-08-08. Commits reaching this repository are signed in practice, and -nothing at either branch refuses one that is not. +Run 2026-08-30. The answer above is unchanged and what holds it up is not. It +held because neither branch carried the rule; it holds because both do, so the +difference this section would have recorded never became one. Each branch now +refuses an unsigned commit rather than leaving it to the practice of whoever +pushes, and the readings that said otherwise were taken three weeks before this +repository's ruleset was last written: + + gh api repos/Flowfin/site/rulesets/20572614 --jq '.updated_at' + "2026-08-28T14:22:58.455+02:00" + +Run 2026-08-30. ## What this repository adds, because it serves pages rather than shipping a plugin