Repository navigation
The required-checks guard reads rulesets as well as branch protection - #847
Merged
Merged
Conversation
…tion The setting lives in two places, and they disagree: classic branch protection requires 21 checks, and the "main branch protection" ruleset requires 5, one of which (`CodeQL`, code scanning's own result) was in no document. The guard read only the classic rule, so a ruleset change was invisible to it, and moving protection to rulesets would have turned main red. It now holds .github/required-checks.json to the union of both layers, and fails if neither requires anything. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Iris gate — 1 of 2 tripped
|
| Trace | Verdict | Basis | Rules, classes or missing inputs | Evidence |
|---|---|---|---|---|
ee094df25f7a0b3134bcbd1b7adc3fa4 |
failed | detector_veto + risk_over_loss |
no_pii, pii_leak, credential_leak | no_pii: AWS Access Key (output 45–65) |
| Verdict basis | Traces |
|---|---|
detector_veto |
2 |
clean |
1 |
Unjudged questions: task_completed (3), tool_use_correct (3) — a trace that did not carry what a rule needs.
tests/fixtures/ci-gate/traces.ndjson · 3 evaluated · dataset release-gate: 2 in the gate · exit 1 · what the bases mean
Iris gate — 1 stored, nothing tripped
|
| Verdict basis | Traces |
|---|---|
clean |
1 |
Unjudged questions: task_completed (1), tool_use_correct (1) — a trace that did not carry what a rule needs.
tests/fixtures/ci-gate/clean.ndjson · 1 evaluated · exit 0 · what the bases mean
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
The checks a merge to
mainwaits for are set in two places, and today they disagree:.github/required-checks.jsonlint-and-typecheck,test (22),build,security-exposure, andCodeQL(code scanning's own result), which was in no documentscripts/ci/check-required-checks.mjsread only the classic layer, so a change to the ruleset was invisible to it, and moving protection to rulesets would have turnedmainred. It now holds the file to the union of both layers (classic protection from the branch endpoint, every active ruleset rule fromrules/branches/main), and fails if neither requires anything.CodeQLjoins.github/required-checks.jsonand the CONTRIBUTING table, since a merge already waits for it.Tests
tests/required-checks-documented.test.ts: the union of classic contexts and ruleset rules, once each; GitHub's ownCodeQLcontext is recognised as not being one of our jobs.OK — .github/required-checks.json lists the 22 contexts iris-eval/mcp-server@main requires (branch protection and rulesets together).npm run preflightpassed on this commit.🤖 Generated with Claude Code