diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index 872f13e..4c02e24 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -19,7 +19,7 @@ The operator's personal CV and portfolio, served at https://roanny.github.io/. T ## Serving -GitHub Pages serves the root of `main`; a push to `main` is live in 1–2 minutes. There is no release and no `/release`: the fleet's `release` shared block does not apply, and a landing that changes the pages is a deploy (`git-hygiene.md`). +GitHub Pages serves the root of `main`; a push to `main` is live in 1–2 minutes. Two rulesets guard `main`: "Protect main branch" (24806684: no deletion, no force push, linear history; no bypass) and "Require Validate" (24807145: `Validate` green; the repository admin bypasses it so the operator can fix by hand — a session never does, `git-hygiene.md`). There is no release and no `/release`: the fleet's `release` shared block does not apply, and a landing that changes the pages is a deploy (`git-hygiene.md`). ## The one coupling @@ -31,7 +31,7 @@ The content is English by default with Spanish, by audience; the working documen ## Git identity -Commits are authored as the operator's global git config has it: `Roanny Lamas `. +Commits are authored as `Roanny Lamas `, set in this checkout's local git config; the corporate address is never used here. ## Index diff --git a/.claude/rules/git-hygiene.md b/.claude/rules/git-hygiene.md index 51e18f3..60196d9 100644 --- a/.claude/rules/git-hygiene.md +++ b/.claude/rules/git-hygiene.md @@ -5,10 +5,11 @@ Loads in every session: it carries the authorization clause, which has to be pre ## History and landing - **Linear history.** A branch lands on `main` by fast-forward, `git push origin :main`, once `Validate` is green on the pull request's head SHA. No merge commits; `gh pr merge` is denied, because it and the UI button collapse or rewrite the branch's commits. +- **A session never pushes to `main` on its own.** The ruleset "Require Validate" (24807145) requires a green `Validate` but lets the repository admin bypass it, so the operator can push a fix by hand; sessions push with his credentials and inherit that bypass, so for them this rule is the gate, not the server. A session pushes to `main` only the head of a pull request whose `Validate` is green, by the fast-forward above. - **Commit subjects.** The whole first line at most 72 characters, no trailing period; measure it before the push (`printf '%s' "$subject" | wc -m`), because correcting a pushed subject is a force push. CI's "Commit subjects" step reads every commit a pull request adds. - **No force push, in any spelling** — `--force`, `-f`, `--force-with-lease`, a `+refspec` — on any branch. - **A landing can be a deploy.** GitHub Pages publishes `main` within minutes of every push to it: a landing that changes what a visitor sees is a deploy of the public site, and Round authorization says whose word that takes. -- **No remote-ref deletion.** Deleting a remote branch or tag is the operator's act. The colon-refspec deletion (`git push origin :`) has no working deny; the rule is the guard, and the server rulesets on `main` and tags, once the operator adds them, are the floor. +- **No remote-ref deletion.** Deleting a remote branch or tag is the operator's act. The colon-refspec deletion (`git push origin :`) has no working deny; the rule is the guard, and the ruleset "Protect main branch" (24806684: deletion, non-fast-forward, linear history; no bypass) is the floor on `main`. There are no tags here. ## Dependabot diff --git a/README.md b/README.md index 558498c..d68155e 100644 --- a/README.md +++ b/README.md @@ -58,7 +58,7 @@ python3 .github/scripts/check_site.py i18n python3 .github/scripts/check_site.py sitemap ``` -`Validate` (`.github/workflows/ci.yml`) runs on every pull request and every push to `main`: HTML validity of both pages, the `i18n` key parity, the sitemap, the fleet's shared blocks and the commit subjects (at most 72 characters, no trailing period). Changes land on `main` by fast-forward once `Validate` is green. +`Validate` (`.github/workflows/ci.yml`) runs on every pull request and every push to `main`: HTML validity of both pages, the `i18n` key parity, the sitemap, the fleet's shared blocks and the commit subjects (at most 72 characters, no trailing period). Changes land on `main` by fast-forward once `Validate` is green. Two rulesets guard `main`: "Protect main branch" (no deletion, no force push, linear history; nobody bypasses it) and "Require Validate" (a green `Validate` before a push lands; the repository admin may bypass it to push a hand fix, and `Validate` still runs on that push). ## Deployment