Skip to content

docs: align required checks with stable gates #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 1 commit into from
Mar 12, 2026
Merged

docs: align required checks with stable gates #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/security/code-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,5 @@ BandScope treats GitHub Code Security as part of bootstrap governance.

- `main` and `develop` must require the stable checks documented in `docs/repository/bootstrap-plan.md`
- Code Security controls must not be arbitrarily disabled or bypassed
- External AI-review status contexts may be requested but should not be the sole required status gate when the provider is operationally flaky.
- missing permissions to enable GitHub-native controls are `BLOCKED`, not justification to weaken the baseline
10 changes: 7 additions & 3 deletions docs/security/github-required-checks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ These are the merge-gate status checks that should be required on protected bran

### `develop`

- `CodeRabbit`
- `ci / build-and-test`
- `dependency-review`
- `security-audit`
Expand All @@ -21,7 +20,6 @@ These are the merge-gate status checks that should be required on protected bran

### `main`

- `CodeRabbit`
- `ci / build-and-test`
- `dependency-review`
- `security-audit`
Expand All @@ -40,7 +38,7 @@ These are required repository settings or GitHub security features, not branch s
- Dependency graph: required
- Dependency submission coverage: required where GitHub supports it for the repository setup
- Dependency review gate on PRs: required
- CodeRabbit review gate substitution: required
- CodeRabbit review request and review-equivalent policy: required

## Workflow-managed baseline

Expand All @@ -67,5 +65,11 @@ These controls are expressed by repo workflows and are expected to be connected
The files in this repository define the workflows and the intended check names.
Actual branch protection, required checks, and GitHub security feature activation must be enforced in the GitHub repository settings or rulesets with repository admin permissions.

## CodeRabbit enforcement note

BandScope still requests CodeRabbit on PRs and treats it as the default AI review path.
However, the hosted `CodeRabbit` status context has shown repeated stale `PENDING` and stale `CHANGES_REQUESTED` states after all actionable review was cleared.
Because of that operational behavior, protected branches require the stable repository-owned checks above rather than the external `CodeRabbit` status context itself.

Missing repository state should trigger GitHub bootstrap per `docs/workflow/github-bootstrap-execution-policy.md`.
Only missing admin permissions or platform capability should be reported as `BLOCKED`.
3 changes: 2 additions & 1 deletion docs/workflow/github-bootstrap-execution-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,8 @@ Bootstrap or setup work is not complete unless GitHub-facing supply-chain contro
- `.github/workflows/codeql.yml`
- `.github/workflows/sbom.yml`
- `.github/workflows/release.yml`
- branch protection or rulesets for `main` and `develop` that require `CodeRabbit`, `ci / build-and-test`, `dependency-review`, `security-audit`, `CodeQL`, `sbom`, `release-preflight`, `gate / build / windows`, and `gate / build / macos`
- branch protection or rulesets for `main` and `develop` that require `ci / build-and-test`, `dependency-review`, `security-audit`, `CodeQL`, `sbom`, `release-preflight`, `gate / build / windows`, and `gate / build / macos`
- PR workflow that still requests CodeRabbit review and records its result when the provider responds cleanly
- release retention for the generated SBOM and supplemental inventory

Do not treat these as TODOs, later hardening, or optional recommendations.
Expand Down
Loading