From bc79ed718786b08dc086b4cf9e818068961de307 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" Date: Sun, 20 Sep 2026 22:36:51 +0000 Subject: [PATCH] docs(config): replace sampled ruleset counts with the full 453-repo scan --- config/README.adoc | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/config/README.adoc b/config/README.adoc index ff4110314..2c82d1e21 100644 --- a/config/README.adoc +++ b/config/README.adoc @@ -175,15 +175,20 @@ REST API. standing push right. | Integration ids 56611 (codacy), 827041 (gitar-bot), 254 (codecov), 2740 (renovate), 57789 (advanced-security), 1561, 85455, 946600 -| R1/R4 removals, advanced-security needs no bypass. Re-swept 2026-09-20 across - all 453 repos: no active ruleset grants bypass to any uninstalled app. 1561 and - 85455 have no matching app in either estate; both survive only on ONE disabled - repo ruleset (`anvomidaviser/Optimus-Branch`), which also still grants `always` - bypass to RepositoryRole 2 (maintain) and keeps `code_coverage` / - `required_deployments` / `copilot_code_review` — the exact set §7.3 retired, so - that stale ruleset should be deleted rather than re-enabled. 946600 = Codex MCP - (GitHub), on 67 repo rulesets (17 hyperpolymath, 50 metadatastician); owner - decision O5 stays open. +| R1/R4 removals, advanced-security needs no bypass. Scanned 2026-09-20: all + 1,026 rulesets over all 453 repos in both estates. No active ruleset grants bypass to + any uninstalled app. 1561, 85455 and 946600 (Codex MCP) each appear exactly once, all + on one *disabled* ruleset — `hyperpolymath/anvomidaviser` id 14968878 `Optimus-Branch`, + which also still grants `always` bypass to RepositoryRole 2 (maintain) and keeps + `code_coverage` / `required_deployments` / `copilot_code_review`, the set §7.3 retired; + delete it rather than re-enabling it. O5 closes for 1561/85455 (no such app, no active + grant) and stays open for 946600. An earlier draft of this row quoted 96-repo sample + counts, including "67 repo rulesets" for 946600, and read this table as if it listed live + grants; both are superseded by the scan above. + Same scan: the only integration bypasses on *active* repo rulesets are oikosbot (6) and + claude (2). Dependabot, github-actions, gitguardian, sonarqubecloud and coderabbitai hold + none — so installing CodeRabbit also means adding its bypass actor to the estate ruleset, + or its auto-fix and commit-queue pushes cannot reach a protected branch. Note `123` (codecov PR gate) was never a bypass actor — it only ever appears as a jtv-lang required-check context, which is the §11.3 hand-typed-context bug. |===