Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push

[don-petry]

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push

Detail

Ruleset pr-quality parameter dismiss_stale_reviews_on_push has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/google-app-scripts to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #538 — Compliance: ruleset-drift-pr-quality-dismiss_stale_reviews_on_push

Scope

Reconcile the pr-quality ruleset parameter dismiss_stale_reviews_on_push (expected true) with this repository's codified source of truth, and converge live state.

Investigation Checklist

• Locate every codified representation of the pr-quality ruleset in this repo
• Confirm the codified value of dismiss_stale_reviews_on_push
• Confirm the guard tests assert the expected value and pass
• Read the live GitHub ruleset (read-only) to confirm the actual drifted value
• Determine whether convergence requires a code change or a live admin apply

Tests to Verify

• scripts/tests/setup-pr-quality-ruleset.test.js — asserts codified dismiss_stale_reviews_on_push: true

Test Command

npx jest scripts/tests/setup-pr-quality-ruleset.test.js

Note: In this repo the codified source of truth for this ruleset is
scripts/setup-pr-quality-ruleset.sh (heredoc payload), not a standards/*.json
file. If the codified value already matches the standard, the drift is in live
GitHub ruleset state and convergence is a gh api admin apply, which falls outside
the code-change scope of this task and will be reported for a maintainer to run.

[don-petry]

Dev-Lead: Investigation Complete — Codified standard already compliant

Summary

The repository's codified source of truth is already compliant: no code change is
required (or appropriate) to satisfy dismiss_stale_reviews_on_push = true. The drift
flagged by the audit exists only in live GitHub ruleset state, which converges via an
admin gh api apply — outside the code-change scope of this task.

Investigation Execution

• Located every codified representation of the pr-quality ruleset in this repo
• Confirmed the codified value of dismiss_stale_reviews_on_push
• Confirmed the guard tests assert the expected value and pass
• Read the live GitHub ruleset (read-only) to confirm the actual drifted value
• Determined convergence requires a live admin apply, not a code change

Evidence

Codified value — already true (scripts/setup-pr-quality-ruleset.sh, heredoc payload):

"parameters": {
  "required_approving_review_count": 1,
  "dismiss_stale_reviews_on_push": true,
  "require_code_owner_review": false,
  "require_last_push_approval": true,
  "required_review_thread_resolution": true
}

A repo-wide search finds no other file carrying this parameter (only the script above and
unrelated comments in .dev-lead/scripts/review-one-pr.sh).

Guard test — passes (scripts/tests/setup-pr-quality-ruleset.test.js):

Test Suites: 1 passed, 1 total
Tests:       5 passed, 5 total

The toEqual assertion already pins dismiss_stale_reviews_on_push: true, guarding against
future codified drift.

Live GitHub ruleset — drifted (read-only gh api repos/.../rulesets/14872172):

"dismiss_stale_reviews_on_push": false,   // <- audit finding
"require_code_owner_review": true,        // also drifted vs codified (false)
"require_last_push_approval": false       // also drifted vs codified (true)

Required lint (.dev-lead/scripts/dev-lead-lint.sh): all checks passed.

Why no code change

The codified standard in this repo (scripts/setup-pr-quality-ruleset.sh) already sets the
expected value and is regression-guarded by a passing test. Editing code would not change the
audit outcome, since the audit inspects live ruleset state, not the script. Fabricating a diff
would add noise without addressing the finding.

Recommended convergence (admin action — not performed here)

An admin should reconcile live state by running the codified script:

bash scripts/setup-pr-quality-ruleset.sh petry-projects/google-app-scripts

⚠️ Caveat: that script PUTs the full codified payload, so in addition to fixing
dismiss_stale_reviews_on_push (false→true) it will also flip the two other live-drifted
params to match the standard: require_code_owner_review (true→false) and
require_last_push_approval (false→true). This is the intended org standard, but is broader
than this single finding — confirm before applying.

I did not mutate the live ruleset: it is a shared-state admin operation outside this task's
authorized scope (code changes + issue comments), with blast radius across the repo's PR flow.

Files Changed

• None — codified standard already compliant.

Notes

Phase 2 (test-first) intentionally skipped: no observable behavior change to implement; the
existing guard test already covers the parameter. Root cause of the audit finding is
un-applied live state, not a codified defect.