Skip to content

ci: enforce canonical issue branch policy - #16

Merged
codeforester merged 1 commit into
mainfrom
ci/15-20261005-ci-enforce-the-canonical-issue-branch-policy
Oct 5, 2026
Merged

codeforester merged 1 commit into
mainfrom
ci/15-20261005-ci-enforce-the-canonical-issue-branch-policy

Conversation

@codeforester

Copy link
Copy Markdown
Collaborator

Closes #15

Summary

  • add the trusted issue-branch policy workflow to base-workspace;
  • validate canonical branch names, referenced issues, and matching category labels;
  • require the workflow in the repository baseline validation.

Security

The workflow runs from the default branch via pull_request_target, does not check out or execute contributor-controlled code, and uses only the declared status/action permissions needed to publish and revalidate policy statuses.

Validation

  • ./tests/validate.sh
  • bash -n tests/validate.sh
  • Ruby YAML parse of .github/workflows/issue-branch-policy.yml
  • ShellCheck at warning level on the workflow run script
  • git diff --cached --check

actionlint was unavailable locally; hosted workflow checks should provide the final validation.

@codeforester
codeforester merged commit 7aea79f into main Oct 5, 2026
2 checks passed
@codeforester
codeforester deleted the ci/15-20261005-ci-enforce-the-canonical-issue-branch-policy branch October 5, 2026 14:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ci: enforce the canonical issue branch policy

1 participant