diff --git a/quest/m0/helpers/README.md b/quest/m0/helpers/README.md index 14fec2d4..55b7af5e 100644 --- a/quest/m0/helpers/README.md +++ b/quest/m0/helpers/README.md @@ -59,6 +59,10 @@ commands from Sep-Oct. Session counts in each child come from that window. merge gate, `quest land`, joins this epic. It ranks after the existing children, and kixelated/quest adopts it first. moq-dev/moq, moq-dev/moq.pro, and kixelated/rust2 plan their own adoption. +- Decided 2026-10-27 (user), from the follow-ups of + [kixelated/quest#229](https://github.com/kixelated/quest/pull/229): the + gate's rule and setup fixes rank after its adoption, which verifies forks + live. ## Required @@ -69,6 +73,7 @@ commands from Sep-Oct. Session counts in each child come from that window. - [Headless agents](/quest/m0/helpers/headless-agents.md) - `/quest-spawn api` launches, resumes, and stops billed agents through one command auto mode allows - [Sibling PRs through a server-side merge](/quest/m0/helpers/queue-siblings.md) - children of one epic land back to back through a merge queue without conflicting on its link list - [kixelated/quest lands through quest land](/quest/m0/helpers/land-adopt.md) - this repository's `main` changes only through its own gate +- [quest land upholds only the rules GitHub lets it](/quest/m0/helpers/land-rules.md) - `resolve` refuses `update` rules, and the README names only credentials and check sources GitHub accepts ## Related diff --git a/quest/m0/helpers/land-adopt.md b/quest/m0/helpers/land-adopt.md index ece98fb3..231b6700 100644 --- a/quest/m0/helpers/land-adopt.md +++ b/quest/m0/helpers/land-adopt.md @@ -1,11 +1,11 @@ -# [S] kixelated/quest lands through quest land +# [M] kixelated/quest lands through quest land ## Goal PRs to kixelated/quest's `main` land only through `quest land`, on a hosted runner, running `just check` and `just test` once per batch. GitHub's merge button cannot -land around it. +land around it. A PR from a fork lands through it too. ## Plan @@ -13,11 +13,28 @@ Decided 2026-10-26 (user): the repository adopts its own gate first. Being user-owned, it cannot use GitHub's merge queue ([landing](/quest/m0/helpers/landing.md)). -- The push credential is GitHub Actions in the `main` ruleset's bypass list, - guarded by a test that refuses `contents: write` anywhere but the land job, - as moq.pro's `queue.test.ts` does. The admin role keeps its emergency - bypass. Ruleset writes are the user's. -- The ruleset requires the `quest land` check, which PR heads never carry, so - auto-merge only waits for the gate. +- **Push credential (user, 2026-10-27).** A GitHub App owned by the kixelated + account, installed only on this repository, is the `main` ruleset's bypass + actor. Only the land job mints its token, from a key in an environment only + `main` can use, as moq-dev/quest-land-scratch verified with moq-bot. + GitHub Actions cannot be the bypass: a disabled probe ruleset on this + repository was refused on 2026-10-27 with "must be part of the ruleset + source or owner organization". The user creates the App and stores its + key. +- A test refuses `contents: write` anywhere but the land job, as moq.pro's + `queue.test.ts` does. The land job keeps it on `GH_TOKEN`, which ejecting a + PR needs. The admin role keeps its emergency bypass. Ruleset writes are the + user's. +- The ruleset requires the `quest land` check, pinned to an app installed on + this repository that never reports it, so auto-merge only waits for the + gate. It replaces the classic protection that requires `check`. +- **Forks (user, 2026-10-27).** The fork path was never verified live, since + moq-dev forbids private forks. This quest is done only once a fork PR that + allows maintainer edits lands through the gate and shows as merged; any fix + that needs lands here. - Update `CONTRIBUTING.md`'s landing section; the user asked for it through this plan. + +## Related + +- [quest land upholds only the rules GitHub lets it](/quest/m0/helpers/land-rules.md) - the README setup guidance this follows diff --git a/quest/m0/helpers/land-rules.md b/quest/m0/helpers/land-rules.md new file mode 100644 index 00000000..4b660f28 --- /dev/null +++ b/quest/m0/helpers/land-rules.md @@ -0,0 +1,37 @@ +# [XS] quest land upholds only the rules GitHub lets it + +## Goal + +`quest land resolve` fails on a base whose ruleset has an `update` rule, and +the README's gate setup names only credentials and check sources GitHub +accepts, so an adopter's first ruleset write succeeds. + +## Plan + +Decided 2026-10-27 (user), from the follow-ups of +[kixelated/quest#229](https://github.com/kixelated/quest/pull/229): + +- **Refuse `update` (user).** An `update` rule lets only its bypass actors + move the base, but the gate's bypass lands any PR someone with write access + queues, so treating the rule as upheld widens who can update. Drop `update` + from `UPHELD` in `src/cli/land.ts`, so `resolve` names it among the rules it + does not uphold, and fix the README sentence that lists what the push + satisfies. Rejected: landing only PRs whose auto-merge a bypass actor + enabled (it needs bypass, role, and team reads with admin access), and + accepting `update` when the gate is the only bypass actor (it rules out an + admin emergency bypass). No planned adopter uses the rule. Test that + `resolve` refuses it. +- **Installed check app (user).** A ruleset's `required_status_checks` can pin + only an app installed on the repository; GitHub rejects others with + "Invalid integration ids". Say so where the README tells adopters to pin the + `quest land` check's source. +- **No GitHub Actions bypass.** A repository ruleset refused GitHub Actions + (`Integration` 15368) as a bypass actor on an organization repository + (moq-dev/quest-land-scratch, 2026-10-26) and a personal one + (kixelated/quest, 2026-10-27), both with "must be part of the ruleset source + or owner organization". The README's credential paragraph stops offering it + and names an App installed on the repository as the push bypass. + +## Related + +- [kixelated/quest lands through quest land](/quest/m0/helpers/land-adopt.md) - the first adopter, which follows this guidance