docs(config): org rulesets are writable with admin scope — matrix correction + what was applied tonight - #883
Merged
Conversation
… matrix correction `config/rulesets/README.adoc` recorded `PATCH /orgs/ORG/rulesets/ID` as a 404 and the metadatastician EstateBranching fix as owner-session-only. Both were true of one token, not of the API. With org admin, `PUT /orgs/ORG/rulesets/ID` works; `?dry-run=true` validates without writing; per-repo `PUT .../rulesets/ID` is still 403 for that same token. Applied today on that basis: EstateBranching lost `code_coverage` + `code_quality` and the bypass grants to `827041` (gitar-bot) and `1658531` (Linear Code, which GitHub reported as not installed). Inherited by every metadatastician repo, so gitar's default-branch bypass is gone across all 43 in one write — closing the half of the estate cleanup that could not be done by PR. Two durable rules came out of being rejected: * PUT bodies must be read back from the live ruleset, not reconstructed — a snapshot that dropped `repository_name` from `conditions` produced `422 Invalid property /conditions`. * a `422` naming a bypass actor is a dangling-grant detector: it means that app is not installed on the target, which no read endpoint tells you. Actors that validate cleanly are installed even when unnamed, so `946600` and `262318` were left alone rather than removed for convenience.
Contributor
|
Warning Review limit reachedNext included review available in 8 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
config/rulesets/README.adoc(added in #878) records thatPATCH /orgs/ORG/rulesets/IDis a 404 and that themetadatasticianEstateBranchingrepair must be an owner session. Both were properties of the token I had, not of the API.What happened, factually
PUT /orgs/metadatastician/rulesets/18225024(EstateBranching, active,~DEFAULT_BRANCHx~ALL) returned 200 after?dry-run=truereturned 200. Removed: rulescode_coverage,code_quality; bypass actors827041(gitar-bot) and1658531(Linear Code). Preserved verbatim:conditions,enforcement,target, every other rule and every other actor (2always,5pull_request,12526,29110,1236702,262318, Team18237148,OrganizationAdmin,RepositoryMigration). Re-read confirms it.Because that ruleset is inherited, one write removed gitar-bot's default-branch bypass from all 43 metadatastician repos — all 43 grants in the last full sweep were this org ruleset (
source_type: Organizationx43), and no sampled repo-level ruleset grants it.The two durable rules
conditionscame from my own sweep summary:422 Invalid property /conditions: data matches no possible input. The live object carriesrepository_namealongsideref_name; the snapshot had dropped it. Any summariser that flattensconditionsyields bodies that either fail or silently rewrite policy.Actor Linear Code integration must be part of the ruleset source or owner organizationproves the app is not installed — no read endpoint says that. It cuts the other way too: actors that validate cleanly are installed, which is why946600and262318were left alone. Stripping a working bypass from a live-but-unnamed app is a decision, not a cleanup.Not included
copilot_code_review(enforced on 152 repos) awaits your ruling. Repo-levelPUT .../rulesets/IDis 403 for the token that made the org write, so the 96 per-repo entries in the repair plan stay owner-run — andruleset-repair/apply-ruleset-repair.shnow derives bodies from live state and dry-runs each write, because with the frozen bodies it would have 422'd on all 97. Docs-only PR.