feat: branching & deploy baseline — two-branch flow, workflows, init script#2
Open
feat: branching & deploy baseline — two-branch flow, workflows, init script#2
Conversation
…script Bakes HRL's two-branch promotion model into every new repo created from this template. After Muster adoption (muster#97, muster#98) and the Pirates-Codex canonical doc (Pirates-Codex#15), this completes the loop so new projects start compliant without any additional setup work. Additions: - docs/BRANCHING.md — project-scoped doc template; picks env tier, points to the org-wide canonical in Pirates-Codex - .github/workflows/deploy-dev.yml — placeholder deploy workflow for develop - .github/workflows/deploy.yml — placeholder deploy workflow for main, with security gate scanning for BYPASS_AUTH before prod push - .github/workflows/prune-merged-branches.yml — weekly scheduled cleanup of merged feature branches older than 14 days (dry-run on manual dispatch) - scripts/init-repo.sh — one-shot gh-CLI setup that creates develop branch, enables auto-delete-on-merge, and adds baseline branch protection Updates: - CONTRIBUTING.md — replaces "branch from main" with "branch from develop", adds hotfix flow, dev-only callout, and naming conventions aligned with the prune workflow - README.md — Deployment section documents the two-branch flow and points to init-repo.sh for first-run setup This PR coordinates with PR #1 (standards alignment) — both touch CONTRIBUTING.md and README.md but in different sections. Merge order should be PR #1 first, then this PR will rebase cleanly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
🔍 OpenGrep SAST ResultsBranch: 🔍 OpenGrep SASTStatus: Completed Findings Summary
No security findings detected. Artifacts: OpenGrep Reports Generated by Argus |
🐍 Bandit Python Security ResultsBranch: 🔍 Bandit Python SecurityStatus: ✅ Completed 📊 Findings Summary
✅ No security findings detected! 📁 Artifacts: Bandit Reports Generated by Argus |
Same class of bug Muster had in muster#105: pull_request workflows scoped to `branches: [main]` only, which skips every check on feature PRs into develop. Fixes it in the template so new repos don't inherit the gap. Changes: - .github/workflows/security.yml — add develop to push + pull_request branches - .github/workflows/ci.yml — new placeholder workflow that runs on PRs into main OR develop; ships with TODOs for contributors to fill in real lint/typecheck/test/build steps for their stack - docs/BRANCHING.md — new "CI / Required Checks" section explaining the required-status-check story - scripts/init-repo.sh — branch protection now requires the "Lint, Type Check, Build" status check on both main and develop, so red CI blocks merging from day one Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bakes HRL's two-branch promotion model into every new repo created from this template. After the Muster adoption (muster#97, muster#98) and the Pirates-Codex canonical doc (Pirates-Codex#15), this completes the loop so new projects start compliant without any additional setup work.
What new projects get out of the box
docs/BRANCHING.md— project-scoped doc template with an environment-tier picker; points to the org-wide canonical in Pirates-Codex.github/workflows/deploy-dev.yml+deploy.yml— placeholder deploy workflows (Dev triggers ondevelop, Prod triggers onmainwith a security gate scanning forBYPASS_AUTH).github/workflows/prune-merged-branches.yml— weekly scheduled cleanup of merged feature branches older than 14 days; manual dispatch defaults to dry-runscripts/init-repo.sh— one-shotghCLI setup that createsdevelop, enables auto-delete-on-merge, and adds baseline branch protectionWhat got updated
CONTRIBUTING.md— the key fix: "Create a branch from `main`" → "Branch from `develop`"; adds hotfix flow, dev-only callout, and prefix conventions aligned with the prune workflowREADME.md— Deployment section documents the two-branch flow and points toinit-repo.shfor first-run setupCoordination with PR #1
PR #1 (Adopt HRL org-wide tracking standards) is currently open and touches
CONTRIBUTING.md,README.md, and.github/pull_request_template.md.pull_request_template.mdto avoid a conflict. Recommend adding a target-branch check to PR Adopt HRL org-wide tracking standards #1's template before or after merge.CONTRIBUTING.mdandREADME.mdthan PR Adopt HRL org-wide tracking standards #1 — should merge cleanly with a rebase but may need review.Recommended merge order: PR #1 first → rebase this PR on top → merge.
First-time user flow (after this merges)
Related
Test plan
docs/BRANCHING.md— confirms tier menu and references look rightscripts/init-repo.shon a throwaway repo (or a new repo spun up from the template after this merges)CONTRIBUTING.md+README.mdedits don't break PR Adopt HRL org-wide tracking standards #1's edits semanticallyFollow-ups
pull_request_template.mdto include a target-branch check sectionsandbox-ecs(separate repo or module) for Tier 3+ projects🤖 Generated with Claude Code