Compliance: ruleset-drift-pr-quality-require_last_push_approval

[don-petry]

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-require_last_push_approval

Detail

Ruleset pr-quality parameter require_last_push_approval has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/broodly to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #409 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

Scope

The codified remediation script scripts/apply-rulesets.sh already sets the pr-quality ruleset parameter require_last_push_approval: true, matching the standard's source of truth. The live-GitHub convergence itself is performed by the org admin apply script (petry-projects/.github) outside this repo's PR flow and requires an administration:write token. The in-repo deliverable is a regression test that guards the codified pr-quality parameters so the script can never silently drift from the standard again — mirroring the existing guard tests/scripts/apply-repo-settings.test.sh for the sibling settings script.

Implementation Checklist

• Add tests/scripts/apply-rulesets.test.sh — runs scripts/apply-rulesets.sh in --dry-run --force with a mocked gh CLI and asserts the codified pr-quality payload sets require_last_push_approval: true plus the other codified pull_request parameters (required_approving_review_count: 1, dismiss_stale_reviews_on_push: true, require_code_owner_review: true, required_review_thread_resolution: true).

Tests to Write

• tests/scripts/apply-rulesets.test.sh — regression guard for pr-quality ruleset parameters (drift demonstrated by temporarily flipping the value to confirm the test fails, then restoring).

Test Command

bash tests/scripts/apply-rulesets.test.sh (plus bash tests/scripts/apply-repo-settings.test.sh and bash .dev-lead/scripts/dev-lead-lint.sh for full verification)

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Confirmed the codified remediation script scripts/apply-rulesets.sh already sets the pr-quality parameter require_last_push_approval: true (line 104), matching the standard's source of truth.
• Added tests/scripts/apply-rulesets.test.sh — a regression guard for the codified pr-quality ruleset parameters, mirroring the existing tests/scripts/apply-repo-settings.test.sh pattern.
• TDD: demonstrated the guard fails when the codified value drifts to false, then confirmed it passes with the correct true.

Note on scope

The live-GitHub ruleset convergence (expected true, actual false) is applied by the org admin script in petry-projects/.github via scripts/apply-rulesets.sh --repo petry-projects/broodly, which requires an administration:write token and is out of band for this repo's PR flow. This repo's contribution to compliance is the codified apply-rulesets.sh, which was already correct. The added test prevents the codified source from silently drifting from the standard in the future.

Test Results

===== RED (temporarily flipped codified value to false) =====
not ok - codifies pr-quality param "require_last_push_approval": true (output missing: "require_last_push_approval": true)
FAIL — see assertions above

===== GREEN (codified value restored to true) =====
ok - emits the pr-quality ruleset
ok - codifies pr-quality param "require_last_push_approval": true
ok - codifies pr-quality param "required_approving_review_count": 1
ok - codifies pr-quality param "dismiss_stale_reviews_on_push": true
ok - codifies pr-quality param "require_code_owner_review": true
ok - codifies pr-quality param "required_review_thread_resolution": true
---
PASS — 6 assertion(s) passed

===== sibling regression (tests/scripts/apply-repo-settings.test.sh) =====
PASS — 7 assertion(s) passed

===== .dev-lead/scripts/dev-lead-lint.sh =====
  [lint] shellcheck on 2 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

===== shellcheck --severity=warning -x tests/scripts/apply-rulesets.test.sh =====
shellcheck-clean

Files Changed

• tests/scripts/apply-rulesets.test.sh (new): Runs scripts/apply-rulesets.sh in --dry-run --force with a stubbed gh CLI and asserts the codified pr-quality payload sets require_last_push_approval: true plus the other codified pull_request parameters.

Notes

• No production code changed; scripts/apply-rulesets.sh was already compliant and remains byte-for-byte unchanged.
• The new shell test is a standalone guard (runnable via bash tests/scripts/apply-rulesets.test.sh), consistent with the sibling apply-repo-settings.test.sh, which is likewise not wired into the jest/go CI jobs.
• Phase 2 TDD was demonstrated by temporarily flipping the codified value; the flip was reverted before completion.

[don-petry]

Dev-Lead Implementation Plan

Issue: #409 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

Scope

Lock in the codified pr-quality ruleset standard by adding regression tests that assert scripts/apply-rulesets.sh sets require_last_push_approval: true, so this repo's codified source-of-truth mirror can never silently drift back to false.

Findings

• The live GitHub pr-quality ruleset has require_last_push_approval: false (the drift). Converging the live state requires an admin to run scripts/apply-rulesets.sh with an administration:write token — that is a live GitHub API operation outside this agent's scope and is called out in the completion report.
• The codified payload in scripts/apply-rulesets.sh:104 already sets require_last_push_approval: true, matching the org standard. It currently has no test coverage (unlike its sibling apply-repo-settings.sh).

Implementation Checklist

• Add tests/scripts/apply-rulesets.test.sh — plain-bash test (mirrors apply-repo-settings.test.sh) mocking gh and asserting the pr-quality dry-run payload contains require_last_push_approval: true and the other required pull_request review parameters.
• Add tests/integration/apply-rulesets.bats — bats integration test mirroring apply-repo-settings.bats conventions for the same assertions.

Tests to Write

• pr-quality ruleset codifies require_last_push_approval: true
• pr-quality ruleset codifies required_approving_review_count, require_code_owner_review, required_review_thread_resolution
• dry-run makes no mutating (POST/PUT) API call

Test Command

bash tests/scripts/apply-rulesets.test.sh (plain bash) and bats tests/integration/apply-rulesets.bats (bats, run in CI)

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Investigated the drift: the codified pr-quality payload in scripts/apply-rulesets.sh:104 already sets require_last_push_approval: true (matches org source of truth) — but had no test coverage, unlike its sibling apply-repo-settings.sh.
• Added tests/scripts/apply-rulesets.test.sh (plain-bash, mirrors apply-repo-settings.test.sh).
• Added tests/integration/apply-rulesets.bats (bats, mirrors apply-repo-settings.bats).
• TDD verified: temporarily flipping the codified value to false makes the test FAIL (red); restoring true makes it PASS (green).

Test Results

# tests/scripts/apply-rulesets.test.sh
ok - pr-quality codifies require_last_push_approval: true
ok - pr-quality codifies required_approving_review_count: 1
ok - pr-quality codifies dismiss_stale_reviews_on_push: true
ok - pr-quality codifies require_code_owner_review: true
ok - pr-quality codifies required_review_thread_resolution: true
ok - dry-run made no mutating API call
PASS — 6 assertion(s) passed

# tests/integration/*.bats (bats-core)
1..7
ok 1 applies check-suite preferences via the plural check-suites/preferences endpoint
ok 2 never targets the non-existent singular check-suite/preferences endpoint
ok 3 dry-run makes no PATCH call
ok 4 pr-quality ruleset codifies require_last_push_approval: true
ok 5 pr-quality ruleset never codifies require_last_push_approval: false
ok 6 pr-quality ruleset codifies the required review parameters
ok 7 dry-run makes no mutating (POST/PUT) API call

# lint
.dev-lead/scripts/dev-lead-lint.sh — all checks passed
shellcheck --severity=warning -x tests/scripts/apply-rulesets.test.sh — OK

Files Changed

• tests/scripts/apply-rulesets.test.sh (new): plain-bash regression test asserting the codified pr-quality dry-run payload contains require_last_push_approval: true plus the other required pull_request review parameters, and that dry-run performs no mutating API call. Stubs gh so it runs offline.
• tests/integration/apply-rulesets.bats (new): bats equivalent of the same assertions, including an explicit guard that the payload never codifies require_last_push_approval: false.

Notes

• No source change was required. The codified ruleset (scripts/apply-rulesets.sh), which is this repo's mirror of the org source of truth (standards/rulesets/pr-quality.json), already sets require_last_push_approval: true. This change adds the missing regression coverage so the codified value can never silently drift back to false.
• Live-state convergence is out of this agent's scope. The compliance finding is about the live GitHub ruleset (actual: false). Converging it requires an org admin to run GH_TOKEN=<administration:write> scripts/apply-rulesets.sh against petry-projects/broodly — a live GitHub API mutation this agent does not perform. Once run, the live pr-quality ruleset will match the codified true.
• TS/Go workspace suites (pnpm run test) were not run: the toolchain is not provisioned in this environment and the change is isolated to shell test files under tests/, touching no TypeScript or Go source.