From e0cdc2b78e5f9a462f4f8f0346b455fa06ffa9a9 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 7 Oct 2026 00:55:33 +0000 Subject: [PATCH] feat(github): require a `required` gate check by default A PublicRepo with neither githubChecks nor requiredChecks now requires one check named `required`, a gate job at the end of the repository's CI that fails when any job it needs did. The repository decides what blocks a merge by editing that job's needs, with no change to this stack. This mirrors the default in pulumi-components. An empty list now requires nothing and omits the rule. terraform2crd, the one repository that requires no checks, sets githubChecks: [] so it keeps requiring nothing. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01KMdNARLiCQSWqzHj8WmhQu --- github/components/publicRepo.ts | 20 ++++++++++++++++---- github/repos.ts | 1 + 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/github/components/publicRepo.ts b/github/components/publicRepo.ts index a0c4b3c..55471b3 100644 --- a/github/components/publicRepo.ts +++ b/github/components/publicRepo.ts @@ -20,6 +20,13 @@ export interface PublicRepoArgs { * child resource's URN, which Pulumi would carry out as a delete and recreate. */ repoName?: Input; + /** + * Names of the GitHub Actions checks the main ruleset requires. When neither + * this nor requiredChecks is given, the ruleset requires one check named + * `required`: a gate job at the end of the repository's CI that fails when any + * job it needs did, so the repository decides what blocks a merge by editing + * that job's needs. An empty list requires nothing. + */ githubChecks?: Input[]>; requiredChecks?: RepositoryRulesetRulesRequiredStatusChecks['requiredChecks']; template?: RepositoryTemplate; @@ -62,9 +69,9 @@ export class PublicRepo extends Repo { const repo = this.repo; const vulnerabilityAlerts = this.vulnerabilityAlerts; - const statusChecks = args.githubChecks - ? getGitHubStatusChecks(args.githubChecks) - : getRequiredStatusChecks(args.requiredChecks); + const statusChecks = args.requiredChecks + ? getRequiredStatusChecks(args.requiredChecks) + : getGitHubStatusChecks(args.githubChecks ?? defaultGitHubChecks); const mainRuleset = new gh.RepositoryRuleset( name, @@ -103,6 +110,9 @@ export class PublicRepo extends Repo { } } +// The check every repository's CI ends in unless it says otherwise. +const defaultGitHubChecks = ['required']; + function getGitHubStatusChecks( checks: PublicRepoArgs['githubChecks'], ): RepositoryRulesetRules['requiredStatusChecks'] { @@ -123,5 +133,7 @@ function getRequiredStatusChecks( ): RepositoryRulesetRules['requiredStatusChecks'] { if (!checks) return; - return { requiredChecks: checks }; + // An empty list means no checks are required, which is the absence of the + // rule rather than a rule listing nothing. + return output(checks).apply(c => c.length > 0 ? { requiredChecks: c } : undefined); } diff --git a/github/repos.ts b/github/repos.ts index 9368913..99a9268 100644 --- a/github/repos.ts +++ b/github/repos.ts @@ -168,6 +168,7 @@ export const strata = new PublicRepo('strata', { export const terraform2crd = new PublicRepo('terraform2crd', { description: 'Converts Terraform provider code specs to Custom Resource Definitions (CRDs)', topics: ['terraform', 'crd', 'kubernetes', 'codegen'], + githubChecks: [], // Moved from gitlab.com/unmango/terraform/2crd, so the repository already exists. repoOptions: { import: 'terraform2crd' }, });