Repository navigation
chore(settings): the release App, the release environment, the squash settings and the required checks are in place #1864
Description
Friction
The release workflow of #1861 needs repository settings that no pull request can change. Only a person changes them. An agent reads each result with the read-only command in its step.
Before #1861 merges
The merge of #1861 pushes to main, and that push runs the Release Please job. The job fails until steps 1 to 3 are done.
- Create a GitHub App with these repository permissions: contents, issues and pull requests, read and write. Grant no other permission. Install it on this repository only. Do not use the identity of the roadmap Service (chore(service): the roadmap service stays at 0 replicas, and its development is blocked, while its machine account is suspended #1562).
- Create the environment
releaseand limit it to the branchmain. Set the variableRELEASE_APP_CLIENT_IDand the secretRELEASE_APP_PRIVATE_KEYin it. Check:devops gh api repos/dan-petty/devops-cli/environments/release. - Set the squash commit title to
PR_TITLEand the squash commit message toPR_BODY. Disable merge commits and rebase merges. Check:devops gh api repos/dan-petty/devops-clishowssquash_merge_commit_title: PR_TITLE,squash_merge_commit_message: PR_BODY,allow_merge_commit: falseandallow_rebase_merge: false.
After #1861 merges
- Add
Static Analysis,Tests & CoverageandSemantic PR titleas required checks of themainruleset. Keep the strict policy. Check:devops gh api repos/dan-petty/devops-cli/rulesets/<id>. - Delete the
releaseruleset (23059172). Check:devops gh api repos/dan-petty/devops-cli/rulesetslists noreleaseruleset. - Turn off any automatic Copilot review of pull requests. Copilot reviews only when a person asks.
- Rename or delete the open milestones that have version titles (v0.2.40, v0.2.41 and v0.2.42). A milestone is a planning bucket and never names a version. Check:
devops gh milestones list.
A tag ruleset is optional. Argo CD tracks main, so a tag deploys nothing.
Acceptance criteria
- The check of each step shows the expected result.
Proposed design
Problem statement
The release workflow of issue #1861 needs GitHub repository settings that no pull request can change. A person must create a dedicated GitHub App, a release environment with credentials, and squash-only merge settings before #1861 merges. After #1861 merges, the person adds required checks to the main ruleset. The person deletes the old release ruleset. The person turns off automatic Copilot review. The person renames or deletes version-named milestones.
Acceptance criteria
- Criterion 1: A GitHub App exists with contents, issues, and pull requests permissions (read and write), installed on this repository only.
Verification: Open the repository Settings, check the App's permissions in the Apps section, and confirm no other permission is granted. - Criterion 2: The release environment exists, is limited to the main branch, and holds RELEASE_APP_CLIENT_ID and RELEASE_APP_PRIVATE_KEY.
Verification: Run: devops gh api repos/dan-petty/devops-cli/environments/release. Confirm the response shows the environment, the branch restriction, and both the variable and the secret. - Criterion 3: Squash merge is the only allowed merge method, with title set to PR_TITLE and message set to PR_BODY.
Verification: Run: devops gh api repos/dan-petty/devops-cli. Confirm squash_merge_commit_title is PR_TITLE, squash_merge_commit_message is PR_BODY, allow_merge_commit is false, and allow_rebase_merge is false. - Criterion 4: The main ruleset requires Static Analysis, Tests & Coverage, and Semantic PR title, with the strict policy kept.
Verification: Run: devops gh api repos/dan-petty/devops-cli/rulesets/. Confirm the three checks are listed and strict_required_status_checks_policy is true. - Criterion 5: The release ruleset (23059172) is deleted.
Verification: Run: devops gh api repos/dan-petty/devops-cli/rulesets. Confirm no release ruleset appears in the list. - Criterion 6: Automatic Copilot review of pull requests is turned off.
Verification: Open the repository Settings, confirm Copilot code review is not set to automatic, and confirm it runs only when a person requests it. - Criterion 7: No open milestone has a version title such as v0.2.40, v0.2.41, or v0.2.42.
Verification: Run: devops gh milestones list. Confirm no milestone name starts with v.
Key questions
- What permissions does the release GitHub App need?: Contents, issues, and pull requests, each read and write. No other permission. [sources: docs/adr/0011-releases-come-from-trunk-towncrier-uv-and-semver-tags-instead-of-a-bespoke-cut.md:82, docs/adr/0012-releases-are-derived-by-release-please-from-trunk-and-milestones-are-planning-buckets.md:261]
- Which identity must the release App NOT use?: The roadmap Service identity from issue chore(service): the roadmap service stays at 0 replicas, and its development is blocked, while its machine account is suspended #1562. [sources: docs/adr/0002-roadmap-jobs-act-as-a-machine-account.md, docs/adr/0011-releases-come-from-trunk-towncrier-uv-and-semver-tags-instead-of-a-bespoke-cut.md:82]
- What variable and secret go in the release environment?: The variable RELEASE_APP_CLIENT_ID and the secret . [sources: docs/adr/0011-releases-come-from-trunk-towncrier-uv-and-semver-tags-instead-of-a-bespoke-cut.md:82, .github/workflows/release.yml:44, .github/workflows/release.yml:45]
- What squash settings are required?: squash_merge_commit_title is PR_TITLE, squash_merge_commit_message is PR_BODY, merge commits disabled, rebase merges disabled. [sources: docs/adr/0012-releases-are-derived-by-release-please-from-trunk-and-milestones-are-planning-buckets.md:143, docs/adr/0012-releases-are-derived-by-release-please-from-trunk-and-milestones-are-planning-buckets.md:217]
- Which checks are required on the main ruleset?: Static Analysis, Tests & Coverage, and Semantic PR title. [sources: docs/adr/0004-ci-is-the-authoritative-gate.md]
- Should the strict policy be kept on the main ruleset?: Yes. The body states: Keep the strict policy. (proposed)
- Which ruleset must be deleted?: The release ruleset with id 23059172. [sources: docs/adr/0004-ci-is-the-authoritative-gate.md]
- How should Copilot review be handled?: Turn off automatic Copilot review. Copilot reviews only when a person asks. (proposed)
- What happens to open milestones with version titles?: Rename or delete them. A milestone is a planning bucket and never names a version. (proposed)
Fit
Needs splitting into 2 items:
- Steps 1-3 (before feat(release): release-please opens the release pull request, topic pull requests target main, and its merge publishes #1861 merges): Create the release GitHub App, create the release environment with credentials, and set squash-only merge settings.
- Steps 4-7 (after feat(release): release-please opens the release pull request, topic pull requests target main, and its merge publishes #1861 merges): Add required checks to the main ruleset, delete the release ruleset, turn off automatic Copilot review, and rename or delete version-named milestones.
Suspected block
Person-run GitHub repository configuration. No pull request can deliver these steps.
Dependencies
None.
Alternatives check of 2026-11-01: not-applicable.
Tool: none found.
Activity
dan-petty commentedon Oct 22, 2026
Intake placed this item to the backlog: at intake only a critical fix goes into a release; a release start pulls Ready items in, P0 features first.
The item is about setting up repository configurations and does not introduce new features, fixes, or tests.It sets up infrastructure for the release process but does not directly affect current functionality or user experience.Improves the reliability of the release process by ensuring proper settings are in place, which benefits long-term maintainability.Requires manual steps and careful coordination with repository settings and permissions.[-]chore(settings): the release App, environment and rulesets are in place[/-][+]chore(settings): the release App and environment, squash settings, required checks and tag ruleset are in place[/+][-]chore(settings): the release App and environment, squash settings, required checks and tag ruleset are in place[/-][+]chore(settings): the release App, the release environment, the squash settings and the required checks are in place[/+]feat(release): release-please makes every release from main (#1952)
dan-petty commentedon Oct 28, 2026
The proposal at 4da1e34 needs splitting into 2 items. A person splits the item into the items below, or replies in a comment or edits the body to keep one item, and the next refine round looks at the item again.
The next refine round also looks at the item again when a commit on the default branch changes one of these files:
.github/workflows/release.yml.devops-cli-service commentedon Nov 1, 2026
Alternatives check: not-applicable
Tool: none found
Checked on 2026-11-01. A person decides what this means for the item. The check changes no label and closes no issue.
dan-petty commentedon Nov 4, 2026
@dan-petty the API shows that the steps of this item are delivered, where it can read them. Please confirm the three points at the end. Only a person can read them, in Settings. After that, a person ends this item as completed.
The check of each step, on 2026-11-04:
dan-petty-release[bot]. The last 3release.ymlruns on main succeeded.GET /apps/dan-petty-releasegave 404.environments/releasemain. The variableRELEASE_APP_CLIENT_IDand the secret of step 2 exist.repos/dan-petty/devops-clisquash_merge_commit_title: PR_TITLE,squash_merge_commit_message: PR_BODY,allow_merge_commit: false,allow_rebase_merge: false.rulesets/21466414Static Analysis,Tests & CoverageandSemantic PR titleare required.strict_required_status_checks_policyisfalse.rulesetsmain.copilot_code_reviewrule. 14 sampled pull requests have no review, and no comment in the window has a Copilot author.copilot/code-reviewgave 404.milestones?state=openStep 4 says "Keep the strict policy". That text no longer applies. ADR 0014 records the owner decision of 2026-10-24: the strict policy stays off.
Please confirm:
#1496 cites step 6, so tell #1496 when you confirm point 3. This item has no change folder, and no job or dependency link holds it.
dan-petty commentedon Nov 4, 2026
The owner asked to close this item on 2026-11-04. The API checks in the previous comment show steps 2 to 5 and step 7 as delivered, and they show the release App in use.
The API could not read three points, and no check has confirmed them: the permissions of the release App, its single installation, and the Copilot setting at the repository and user level.
dan-petty commentedon Nov 4, 2026
The owner read the App settings on 2026-11-04:
dan-petty-releasehas read and write on only contents, issues and pull requests. This confirms the permissions point of the previous comment. The single installation and the Copilot setting stay unconfirmed.dan-petty commentedon Nov 4, 2026
The owner read the App settings on 2026-11-04:
dan-petty-releaseis installed on all repositories of the account. Step 1 of this item says to install it on this repository only, so this point differs from the text of the step. The Copilot setting stays unconfirmed.