Repository navigation
security: require independent review and immutable release refs #484
Description
Goal
Make a compromised maintainer credential insufficient to merge a release-path change or move a production release tag.
Current evidence
The live default-branch ruleset currently requires zero approving reviews and has no CODEOWNERS review requirement. The repository rulesets also do not include a protected v* tag rule.
Scope
- Require at least one independent approval for merges to
main. - Require code-owner review for release workflows, packaging metadata, dependency locks, release validators, and
VERSION. - Require approval from the last-push reviewer and dismiss stale approvals.
- Add an immutable protected-tag ruleset for
v*: no deletion, force-update, or unreviewed creation. - Keep bypass actors empty and document the emergency recovery procedure.
Acceptance criteria
- A pull request changing a release-path file cannot merge without the required independent review.
- A production tag cannot be force-moved or deleted through normal repository permissions.
- A regression test or auditable configuration check proves the rules are active.
- CONTRIBUTING/releasing documentation explains the review and tag controls.
This is a v1.0 supply-chain security gate motivated by the 2026 PyPI compromise review.
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
codeforester commentedon Oct 27, 2026
Implementation PR #498 adds release-path CODEOWNERS and documents independent review/tag recovery controls. After merge, apply the protected-main and v* tag ruleset configuration.
security: define release-path code owners (#498)
codeforester commentedon Oct 31, 2026
Completed. The live repository controls now match the issue acceptance criteria:\n\n- ruleset requires one approval, CODEOWNERS review, last-push approval, stale-review dismissal, thread resolution, and has no bypass actors.\n- Tag ruleset targets , blocks deletion and non-fast-forward updates, requires signed tags/commits, and has no bypass actors.\n- The release-path CODEOWNERS and recovery documentation are present from merged PR #498.\n\nRead back from the GitHub rulesets API on 2026-10-31. Closing #484 as completed.
codeforester commentedon Oct 31, 2026
Correction to the completion comment: the live repository controls now match the issue acceptance criteria. The main branch ruleset requires one approval, CODEOWNERS review, last-push approval, stale-review dismissal, and thread resolution, with no bypass actors. The immutable release-tag ruleset targets refs/tags/v*, blocks deletion and non-fast-forward updates, requires signatures, and has no bypass actors. The release-path CODEOWNERS and recovery documentation are present from merged PR #498. Read back from the GitHub rulesets API on 2026-10-31.