feat: add Phase 7 — Branch Protection
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
S
91
phase7_branch_protection.sh
Executable file
91
phase7_branch_protection.sh
Executable file
@@ -0,0 +1,91 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# phase7_branch_protection.sh — Set up branch protection rules on all repos
|
||||||
|
# Depends on: Phase 4 complete (repos exist on Gitea primary)
|
||||||
|
# For each repo:
|
||||||
|
# 1. Check if protection already exists for the target branch
|
||||||
|
# 2. Create protection rule with configurable settings from .env
|
||||||
|
# Settings include: block direct push, optionally require PR reviews.
|
||||||
|
# Idempotent: skips repos that already have protection on the target branch.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
load_env
|
||||||
|
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
|
||||||
|
REPO_1_NAME REPO_2_NAME REPO_3_NAME \
|
||||||
|
PROTECTED_BRANCH REQUIRE_PR_REVIEW REQUIRED_APPROVALS
|
||||||
|
|
||||||
|
phase_header 7 "Branch Protection"
|
||||||
|
|
||||||
|
REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
|
||||||
|
|
||||||
|
SUCCESS=0
|
||||||
|
FAILED=0
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
log_info "--- Processing repo: ${repo} ---"
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Idempotency: check if branch protection already exists
|
||||||
|
# The branch_protections endpoint returns the rule if it exists (200)
|
||||||
|
# or 404 if not. We URL-encode the branch name for safety.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
if gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1; then
|
||||||
|
log_info "Branch protection for '${PROTECTED_BRANCH}' already exists on ${repo} — skipping"
|
||||||
|
SUCCESS=$((SUCCESS + 1))
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Create branch protection rule
|
||||||
|
# Key settings:
|
||||||
|
# - enable_push=false: blocks direct pushes (must use PRs)
|
||||||
|
# - enable_status_check=true: required CI checks must pass
|
||||||
|
# - required_approvals: configurable from .env
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
log_info "Creating branch protection for '${PROTECTED_BRANCH}' on ${repo}..."
|
||||||
|
|
||||||
|
PROTECTION_PAYLOAD=$(jq -n \
|
||||||
|
--arg branch_name "$PROTECTED_BRANCH" \
|
||||||
|
--argjson enable_push false \
|
||||||
|
--argjson enable_push_whitelist false \
|
||||||
|
--argjson require_signed_commits false \
|
||||||
|
--argjson enable_status_check true \
|
||||||
|
--argjson enable_approvals_whitelist "${REQUIRE_PR_REVIEW}" \
|
||||||
|
--argjson required_approvals "${REQUIRED_APPROVALS}" \
|
||||||
|
'{
|
||||||
|
branch_name: $branch_name,
|
||||||
|
enable_push: $enable_push,
|
||||||
|
enable_push_whitelist: $enable_push_whitelist,
|
||||||
|
require_signed_commits: $require_signed_commits,
|
||||||
|
enable_status_check: $enable_status_check,
|
||||||
|
enable_approvals_whitelist: $enable_approvals_whitelist,
|
||||||
|
required_approvals: $required_approvals
|
||||||
|
}')
|
||||||
|
|
||||||
|
if gitea_api POST "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections" "$PROTECTION_PAYLOAD" >/dev/null; then
|
||||||
|
log_success "Branch protection created for ${repo}"
|
||||||
|
SUCCESS=$((SUCCESS + 1))
|
||||||
|
else
|
||||||
|
log_error "Failed to create branch protection for ${repo}"
|
||||||
|
FAILED=$((FAILED + 1))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Summary
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
printf '\n'
|
||||||
|
TOTAL=${#REPOS[@]}
|
||||||
|
log_info "Results: ${SUCCESS} succeeded, ${FAILED} failed (out of ${TOTAL})"
|
||||||
|
|
||||||
|
if [[ $FAILED -gt 0 ]]; then
|
||||||
|
log_error "Some repos failed — check logs above"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
log_success "Phase 7 complete — branch protection applied"
|
||||||
64
phase7_post_check.sh
Executable file
64
phase7_post_check.sh
Executable file
@@ -0,0 +1,64 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# phase7_post_check.sh — Verify Phase 7 (Branch Protection) succeeded
|
||||||
|
# Checks for each repo:
|
||||||
|
# 1. Branch protection rule exists for PROTECTED_BRANCH
|
||||||
|
# 2. Push is blocked (enable_push is false)
|
||||||
|
# Exits 0 only if ALL checks pass.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
load_env
|
||||||
|
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
|
||||||
|
REPO_1_NAME REPO_2_NAME REPO_3_NAME PROTECTED_BRANCH
|
||||||
|
|
||||||
|
log_info "=== Phase 7 Post-Check ==="
|
||||||
|
|
||||||
|
REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
|
||||||
|
PASS=0
|
||||||
|
FAIL=0
|
||||||
|
|
||||||
|
run_check() {
|
||||||
|
local description="$1"; shift
|
||||||
|
if "$@" 2>/dev/null; then
|
||||||
|
log_success "$description"
|
||||||
|
PASS=$((PASS + 1))
|
||||||
|
else
|
||||||
|
log_error "FAIL: $description"
|
||||||
|
FAIL=$((FAIL + 1))
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
log_info "--- Checking repo: ${repo} ---"
|
||||||
|
|
||||||
|
# Check 1: Protection rule exists
|
||||||
|
run_check "Branch protection exists for '${PROTECTED_BRANCH}' on ${repo}" \
|
||||||
|
gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" -o /dev/null
|
||||||
|
|
||||||
|
# Check 2: Push is blocked (enable_push should be false)
|
||||||
|
check_push_blocked() {
|
||||||
|
local protection
|
||||||
|
protection=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}")
|
||||||
|
local enable_push
|
||||||
|
enable_push=$(printf '%s' "$protection" | jq -r '.enable_push')
|
||||||
|
[[ "$enable_push" == "false" ]]
|
||||||
|
}
|
||||||
|
run_check "Direct push blocked on '${PROTECTED_BRANCH}' for ${repo}" check_push_blocked
|
||||||
|
done
|
||||||
|
|
||||||
|
# Summary
|
||||||
|
printf '\n'
|
||||||
|
log_info "Results: ${PASS} passed, ${FAIL} failed"
|
||||||
|
|
||||||
|
if [[ $FAIL -gt 0 ]]; then
|
||||||
|
log_error "Phase 7 post-check FAILED"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
log_success "Phase 7 post-check PASSED — branch protection active"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
37
phase7_teardown.sh
Executable file
37
phase7_teardown.sh
Executable file
@@ -0,0 +1,37 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# phase7_teardown.sh — Remove branch protection rules from all repos
|
||||||
|
# Deletes the PROTECTED_BRANCH protection rule via API.
|
||||||
|
# Safe to run if protection rules have already been removed.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
load_env
|
||||||
|
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
|
||||||
|
REPO_1_NAME REPO_2_NAME REPO_3_NAME PROTECTED_BRANCH
|
||||||
|
|
||||||
|
log_warn "=== Phase 7 Teardown: Branch Protection ==="
|
||||||
|
|
||||||
|
REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
|
||||||
|
|
||||||
|
printf 'This will remove branch protection for "%s" on all repos. Continue? [y/N] ' "$PROTECTED_BRANCH"
|
||||||
|
read -r confirm
|
||||||
|
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
|
||||||
|
log_info "Teardown cancelled"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
if gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1; then
|
||||||
|
gitea_api DELETE "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" >/dev/null 2>&1 || true
|
||||||
|
log_success "Removed branch protection from ${repo}"
|
||||||
|
else
|
||||||
|
log_info "No branch protection on ${repo} — already clean"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
log_success "Phase 7 teardown complete"
|
||||||
Reference in New Issue
Block a user