tofu-github/rulesets-gitflow.tf at develop · dryvist/tofu-github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
# Git-flow `base` protection — common rules for main and develop.
#
# Binds local.gitflow_repos on both refs/heads/main and refs/heads/develop.
# Enforces required signatures, and blocks branch deletion and non-fast-forward
# (force) pushes, on both branches in a single ruleset, as requested.
resource "github_organization_ruleset" "org_gitflow_base" {
  name        = "org-gitflow-base"
  target      = "branch"
  enforcement = var.org_gitflow_base_enforcement

  conditions {
    ref_name {
      include = ["refs/heads/main", "refs/heads/develop"]
      exclude = []
    }
    repository_property {
      include = [{
        name            = "gitflow"
        property_values = ["true"]
        source          = "custom"
      }]
    }
  }

  rules {
    required_signatures = true
    deletion            = true
    non_fast_forward    = true
  }
}

# Git-flow `main` protection — the release branch on opted-in repos.
#
# Binds only local.gitflow_repos (derived from `gitflow: true` in
# config/repos.yml) on the literal refs/heads/main — NOT ~DEFAULT_BRANCH, which
# now points at develop on these repos. main is release-only: PRs required (no
# direct pushes), merge-commit the sole merge method so release/hotfix history is
# preserved, PR threads must resolve, and commit messages match the
# Conventional-Commits-or-merge pattern. Signatures are enforced by
# org_gitflow_base (and the org-wide all-branch ruleset).
# These repos are excluded from org_branch_protection
# above, so this is their main-branch policy in full.
resource "github_organization_ruleset" "org_gitflow_main" {
  name        = "org-gitflow-main"
  target      = "branch"
  enforcement = var.org_gitflow_main_enforcement

  conditions {
    ref_name {
      include = ["refs/heads/main"]
      exclude = []
    }
    repository_property {
      include = [{
        name            = "gitflow"
        property_values = ["true"]
        source          = "custom"
      }]
    }
  }

  rules {
    commit_message_pattern {
      name     = "conventional-commits-or-merge"
      operator = "regex"
      pattern  = local.gitflow_defaults.commit_message_pattern
      negate   = false
    }

    pull_request {
      required_approving_review_count   = 0
      dismiss_stale_reviews_on_push     = false
      require_code_owner_review         = false
      require_last_push_approval        = false
      required_review_thread_resolution = true
      allowed_merge_methods             = local.gitflow_defaults.main_allowed_merge_methods
    }
  }
}

# Git-flow `develop` protection — the integration branch on opted-in repos.
#
# Binds only local.gitflow_repos on the literal refs/heads/develop. develop is
# the integration branch: PRs required to enforce merge methods (squash, merge,
# rebase). The single commit rule is the
# Conventional-Commits-or-merge message pattern, keeping subject quality without
# rejecting "Merge branch ..." commits. Signatures come from the org-gitflow-base
# ruleset.
resource "github_organization_ruleset" "org_gitflow_develop" {
  name        = "org-gitflow-develop"
  target      = "branch"
  enforcement = var.org_gitflow_develop_enforcement

  conditions {
    ref_name {
      include = ["refs/heads/develop"]
      exclude = []
    }
    repository_property {
      include = [{
        name            = "gitflow"
        property_values = ["true"]
        source          = "custom"
      }]
    }
  }

  rules {
    commit_message_pattern {
      name     = "conventional-commits-or-merge"
      operator = "regex"
      pattern  = local.gitflow_defaults.commit_message_pattern
      negate   = false
    }

    pull_request {
      required_approving_review_count   = 0
      dismiss_stale_reviews_on_push     = false
      require_code_owner_review         = false
      require_last_push_approval        = false
      required_review_thread_resolution = true
      allowed_merge_methods             = local.gitflow_defaults.develop_allowed_merge_methods
    }
  }
}