From ea9cfe32e96b115a1f3469d63f52ae2e62adeea0 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Thu, 3 Sep 2026 17:34:25 +0200 Subject: [PATCH 1/2] chore: add release tag protection ruleset for code repos Add org-level ruleset to prevent deletion and force-push of release tags (v*) across all code repositories. This protects supply chain integrity by ensuring published version tags remain immutable. Replaces the manual "tags" ruleset on complypack (id=18348763) and extends the same protection to all code repos. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- safe-settings/settings.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/safe-settings/settings.yml b/safe-settings/settings.yml index 1da8119..617cc25 100644 --- a/safe-settings/settings.yml +++ b/safe-settings/settings.yml @@ -21,6 +21,7 @@ # org-infra: Branch Protection (active) # community: Branch Protection (active) # website: general-rules (active) +# complypack: tags (active) # # Excluded from safe-settings management: # complyscribe: archived @@ -172,3 +173,34 @@ rulesets: require_code_owner_review: true require_last_push_approval: false required_review_thread_resolution: false + + # Ruleset for tag protection — prevent deletion or modification + # of release tags. Protects supply chain integrity by ensuring + # published version tags remain immutable. Replaces the manual + # "tags" ruleset on complypack (id=18348763). + - name: "safe-settings: release tag protection" + target: tag + enforcement: active + + conditions: + ref_name: + include: + - "refs/tags/v*" + exclude: [] + repository_name: + include: + - complyctl + - complypack + - complytime-collector-components + - complytime-policies + - complytime-providers + - homebrew-tap + - org-infra + exclude: [] + + rules: + # Prevent deletion of release tags. + - type: deletion + + # Prevent force-pushing release tags to a different commit. + - type: non_fast_forward From af7c55235d746c0411f4bf969f664313269be5de Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Thu, 3 Sep 2026 17:45:22 +0200 Subject: [PATCH 2/2] chore: update migration notes to reflect cleanup progress MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Most manual repo-level rulesets have been removed. Update the migration comment to list only the two remaining: - complypack: tags — replaced by the new release tag protection - complytime: main — replaced by repos/complytime.yml Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- safe-settings/settings.yml | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/safe-settings/settings.yml b/safe-settings/settings.yml index 617cc25..2412f81 100644 --- a/safe-settings/settings.yml +++ b/safe-settings/settings.yml @@ -7,21 +7,15 @@ # See MAINTAINING.md for the full tool boundary. # # MIGRATION NOTE: Existing repo-level rulesets (created manually via the -# GitHub UI) use inconsistent names across repos. Safe-settings creates -# NEW org-level rulesets alongside the existing ones. GitHub evaluates -# all active rulesets and the most restrictive rule wins, so this is -# safe. After verifying the org-level rulesets work correctly, the old -# repo-level rulesets should be deleted manually. +# GitHub UI) are being replaced by safe-settings managed rulesets. +# GitHub evaluates all active rulesets and the most restrictive rule +# wins, so both can coexist during migration. After verifying the +# safe-settings rulesets work correctly, the old repo-level rulesets +# should be deleted manually. # -# Current repo-level rulesets to clean up after migration: -# complyctl: general-rules (active), verify-1-approver (disabled) -# complytime-collector-components: Default Protection (active) -# complytime-policies: general-rules (disabled) -# complytime-providers: branch-protection (active) -# org-infra: Branch Protection (active) -# community: Branch Protection (active) -# website: general-rules (active) -# complypack: tags (active) +# Remaining repo-level rulesets to clean up: +# complypack: tags (active) — replaced by "release tag protection" +# complytime: main (active) — replaced by repos/complytime.yml # # Excluded from safe-settings management: # complyscribe: archived