gtfs-scorecard/.github/rulesets/main.json at main · ghzhost/gtfs-scorecard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
{
  "name": "main-required-checks-and-review",
  "target": "branch",
  "enforcement": "active",
  "bypass_actors": [
    {
      "actor_id": 5,
      "actor_type": "RepositoryRole",
      "bypass_mode": "always"
    }
  ],
  "conditions": {
    "ref_name": {
      "include": ["refs/heads/main"],
      "exclude": []
    }
  },
  "rules": [
    { "type": "deletion" },
    { "type": "non_fast_forward" },
    { "type": "required_linear_history" },
    {
      "type": "pull_request",
      "parameters": {
        "required_approving_review_count": 1,
        "dismiss_stale_reviews_on_push": true,
        "require_code_owner_review": true,
        "require_last_push_approval": true,
        "required_review_thread_resolution": true,
        "allowed_merge_methods": ["squash", "rebase"]
      }
    },
    {
      "type": "required_status_checks",
      "parameters": {
        "required_status_checks": [
          { "context": "pipeline" },
          { "context": "Secret scan (gitleaks)" },
          { "context": "SAST (Semgrep)" },
          { "context": "axe" },
          { "context": "e2e" },
          { "context": "Dependency audit (pip-audit + osv-scanner)" },
          { "context": "Analyze (python)" },
          { "context": "Analyze (actions)" },
          { "context": "Analyze (javascript)" },
          { "context": "standards-pin" },
          { "context": "Trivy image CVE scan (compute)" },
          { "context": "Trivy image CVE scan (instant-score)" },
          { "context": "terraform fmt + validate" },
          { "context": "zizmor (workflow security lint)" },
          { "context": "Dependency review (PRs only)" }
        ],
        "strict_required_status_checks_policy": true
      }
    }
  ]
}