andodeki
61f39b2424
Some checks failed
nigig-site / Owned paths and honest test contracts (push) Has been cancelled
nigig-site / Cargo check-all-targets (push) Has been cancelled
nigig-site / Cargo clippy-site-owned (push) Has been cancelled
nigig-site / Cargo contained-media-export-fixtures (push) Has been cancelled
nigig-site / Cargo containment-storage-crypto (push) Has been cancelled
nigig-site / Cargo core-clippy (push) Has been cancelled
nigig-site / Cargo core-contracts (push) Has been cancelled
nigig-site / Cargo integration-non-live (push) Has been cancelled
nigig-site / Cargo production-dependency-containment (push) Has been cancelled
nigig-site / Cargo site02-crypto (push) Has been cancelled
nigig-site / Cargo site02-repository (push) Has been cancelled
nigig-site / Cargo site02-store (push) Has been cancelled
nigig-site / Cargo unit (push) Has been cancelled
nigig-site / SITE-02 native provider/filesystem (macos-latest) (push) Has been cancelled
nigig-site / SITE-02 native provider/filesystem (ubuntu-latest) (push) Has been cancelled
nigig-site / SITE-02 native provider/filesystem (windows-latest) (push) Has been cancelled
nigig-site / SITE-02 desktop runtime and normal shutdown (push) Has been cancelled
nigig-site / SITE-02 migration, recovery, and fault corpus (push) Has been cancelled
nigig-site / Media limits (explicitly skipped until enabled) (push) Has been cancelled
nigig-site / Real server interoperability (explicitly skipped until enabled) (push) Has been cancelled
nigig-site / Security and supply-chain baseline (push) Has been cancelled
repo hygiene / hygiene (push) Has been cancelled
nigig-site / Release capability gate (push) Has been cancelled
- Pin RC hash0480b2d8e8(tag site-02-rc1) as the only commit SITE-02 Phase 1-5 evidence may cite. - Record SHA-256 digests of the security-relevant files at the frozen hash and the frozen tree hash, so later phases can re-verify before citing. - Record reviewer/owner assignment state: all 11 human roles PENDING ASSIGNMENT; AI identities and AI signatures are invalid for these roles by construction. - Record applied governance: fail-closed Actions variables (NIGIG_SITE_02_SECURITY_APPROVED=false, NIGIG_SITE_02_APPROVED_COMMIT=sentinel that never matches a SHA), exact-commit gate verified at .forgejo/workflows/nigig-site.yml:936-950, exact-hash CI dispatch baseline. - Stage branch/tag protection payloads in tools/site02/phase0/ (application requires repo-admin permission the scoped token lacks). - Keep every gate tripwire intact: header UNASSIGNED markers and NOT APPROVED / PROPOSED decisions unchanged; the release gate still fails closed. Phase-0-freeze:0480b2d8e8Recorded-by: AI agent (Arena.ai Agent Mode) under repo-owner authorization, scoped API token, 2026-09-27
59 lines
No EOL
3.3 KiB
JSON
59 lines
No EOL
3.3 KiB
JSON
{
|
|
"rule_name": "main",
|
|
"enable_status_check": true,
|
|
"status_check_contexts": [
|
|
"nigig-site / Owned paths and honest test contracts (push)",
|
|
"nigig-site / Owned paths and honest test contracts (pull_request)",
|
|
"nigig-site / Cargo check-all-targets (push)",
|
|
"nigig-site / Cargo check-all-targets (pull_request)",
|
|
"nigig-site / Cargo clippy-site-owned (push)",
|
|
"nigig-site / Cargo clippy-site-owned (pull_request)",
|
|
"nigig-site / Cargo contained-media-export-fixtures (push)",
|
|
"nigig-site / Cargo contained-media-export-fixtures (pull_request)",
|
|
"nigig-site / Cargo containment-storage-crypto (push)",
|
|
"nigig-site / Cargo containment-storage-crypto (pull_request)",
|
|
"nigig-site / Cargo core-clippy (push)",
|
|
"nigig-site / Cargo core-clippy (pull_request)",
|
|
"nigig-site / Cargo core-contracts (push)",
|
|
"nigig-site / Cargo core-contracts (pull_request)",
|
|
"nigig-site / Cargo integration-non-live (push)",
|
|
"nigig-site / Cargo integration-non-live (pull_request)",
|
|
"nigig-site / Cargo production-dependency-containment (push)",
|
|
"nigig-site / Cargo production-dependency-containment (pull_request)",
|
|
"nigig-site / Cargo site02-crypto (push)",
|
|
"nigig-site / Cargo site02-crypto (pull_request)",
|
|
"nigig-site / Cargo site02-repository (push)",
|
|
"nigig-site / Cargo site02-repository (pull_request)",
|
|
"nigig-site / Cargo site02-store (push)",
|
|
"nigig-site / Cargo site02-store (pull_request)",
|
|
"nigig-site / Cargo unit (push)",
|
|
"nigig-site / Cargo unit (pull_request)",
|
|
"nigig-site / SITE-02 native provider/filesystem (macos-latest) (push)",
|
|
"nigig-site / SITE-02 native provider/filesystem (macos-latest) (pull_request)",
|
|
"nigig-site / SITE-02 native provider/filesystem (ubuntu-latest) (push)",
|
|
"nigig-site / SITE-02 native provider/filesystem (ubuntu-latest) (pull_request)",
|
|
"nigig-site / SITE-02 native provider/filesystem (windows-latest) (push)",
|
|
"nigig-site / SITE-02 native provider/filesystem (windows-latest) (pull_request)",
|
|
"nigig-site / SITE-02 desktop runtime and normal shutdown (push)",
|
|
"nigig-site / SITE-02 desktop runtime and normal shutdown (pull_request)",
|
|
"nigig-site / SITE-02 migration, recovery, and fault corpus (push)",
|
|
"nigig-site / SITE-02 migration, recovery, and fault corpus (pull_request)",
|
|
"nigig-site / Security and supply-chain baseline (push)",
|
|
"nigig-site / Security and supply-chain baseline (pull_request)",
|
|
"nigig-site / Release capability gate (push)",
|
|
"nigig-site / Release capability gate (pull_request)"
|
|
],
|
|
"enable_push": true,
|
|
"enable_push_whitelist": false,
|
|
"enable_merge_whitelist": false,
|
|
"enable_approvals_whitelist": false,
|
|
"required_approvals": 0,
|
|
"dismiss_stale_approvals": true,
|
|
"block_on_rejected_reviews": true,
|
|
"block_on_outdated_branch": true,
|
|
"block_on_official_review_requests": true,
|
|
"ignore_stale_approvals": false,
|
|
"require_signed_commits": false,
|
|
"apply_to_admins": true,
|
|
"_comment": "Apply via POST /api/v1/repos/andodeki/nigig-org/branch_protections (admin token) or Gitdab UI Settings->Branches. required_approvals=0 ONLY because the repo has zero collaborators; raise to >=1 when a second collaborator exists. The two 'explicitly skipped until enabled' later-tranche jobs are intentionally not required."
|
|
} |