Skip to content

feat: 建立安全的合并与分支清理治理 - #6

Merged
HyxiaoGe merged 5 commits into
masterfrom
feat/auto-merge-governance-v1
Aug 9, 2026
Merged

HyxiaoGe merged 5 commits into
masterfrom
feat/auto-merge-governance-v1

Conversation

@HyxiaoGe

@HyxiaoGe HyxiaoGe commented Aug 9, 2026 •

Copy link
Copy Markdown
Owner

背景

在已接入官方 Codex Code Review、master 门禁与分支清理能力的基础上,明确 GitHub Auto-merge 与当前官方 Review 能力之间的安全边界。目标是复用官方能力,不自建合并 Bot 或平行状态机。

最终方案

  • GitHub 官方文档只保证无写权限者推送新提交时关闭 Auto-merge;维护者推送后不保证关闭。
  • 官方 Codex Review 当前不是与 HEAD 绑定的 required check,因此 v1 强制保持仓库 Auto-merge 关闭,不为单个 PR 开启。
  • 人工合并前必须确认官方 Review 覆盖当前 HEAD、全部 review thread 已解决、required checks 成功且风险已分类。
  • 新提交必须重新 Review;Dependabot 不因 CI 绿灯自动获得合并资格。
  • 分支自动删除不是所有项目的公共强制项:只有 PR head 仅使用临时分支,或长期 head 分支均受保护时才允许启用。
  • 中央审计只强制 allow_auto_merge=false;分支清理按项目真实分支模型配置。
  • 不创建 HEAD 监听器、自动合并 Bot、Action 或定时任务。

TDD 与验证

  • RED:旧审计曾放行仓库级 Auto-merge。
  • RED:旧公共规则无条件要求 delete_branch_on_merge=true,会错误阻断依赖未保护长期 head 分支的合法项目。
  • GREEN:中央审计稳定拒绝 Auto-merge;文档和模板明确分支自动删除的适用条件,不再静态强制该仓库级开关。
  • bash tests/test-audit.sh
  • python3 -m ruff check scripts/audit_github_baseline.py
  • python3 -m ruff format --check scripts/audit_github_baseline.py
  • shellcheck / bash -n
  • python3 -m py_compile scripts/audit_github_baseline.py
  • 82 个 YAML 文件解析通过
  • git diff --check
  • 当前 HEAD 的 Baseline contract validation 通过

风险边界

本 PR 不创建自动合并服务,不开启任何产品 PR 的 Auto-merge,也不触发 Fusion/Audio 生产发布。

明确仅在官方 Codex Review 覆盖当前 HEAD、全部 review thread 已解决且风险已分类后,才允许为单个 PR 开启 GitHub 原生 Auto-merge。

中央审计新增仓库级 Auto-merge 与合并后远端分支自动删除检查,并以失败 fixture 锁定两项设置;同步更新契约、模板、README 与维护手册。

验证:bash tests/test-audit.sh;ruff check/format;ShellCheck;bash -n;py_compile;git diff --check。

Co-Authored-By: Codex <noreply@anthropic.com>
@HyxiaoGe
HyxiaoGe marked this pull request as ready for review August 9, 2026 15:50

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e6e4366ea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread contracts/codex-code-review.md Outdated
Comment thread README.md Outdated
Comment thread scripts/audit_github_baseline.py Outdated
根据官方 Codex Review 与 GitHub 官方文档,维护者推送新提交后 Auto-merge 不保证自动关闭,而官方 Review 当前又不是 required check。

因此 v1 改为强制关闭 Auto-merge、保留合并后远端分支自动删除,并把当前 HEAD Review、thread 解决和风险分类作为人工合并前置;同步补齐新项目接入步骤与审计范围说明。

验证:bash tests/test-audit.sh;ruff check/format;ShellCheck;bash -n;py_compile;82 个 YAML 解析;git diff --check。

Co-Authored-By: Codex <noreply@anthropic.com>
@HyxiaoGe HyxiaoGe changed the title feat: 建立自动合并治理基线 feat: 建立安全的合并与分支清理治理 Aug 9, 2026

HyxiaoGe commented Aug 9, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e326b4414

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread tests/fixtures/repository-branch-auto-delete-disabled/repo.json Outdated
让关闭远端分支自动删除的失败 fixture 保持 Auto-merge 为合法关闭状态,确保测试只由目标约束触发。

mutation 验证:临时移除 delete_branch_on_merge 审计后,该 fixture 错误 PASS;恢复实现后 fixture 稳定失败,全量 tests/test-audit.sh 通过。

Co-Authored-By: Codex <noreply@anthropic.com>

HyxiaoGe commented Aug 9, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edf423ca25

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread templates/AGENTS.md
在项目 AGENTS 模板的 CI/CD 公共门禁中明确 allow_auto_merge=false 与 delete_branch_on_merge=true,并增加模板断言防止后续遗漏。

验证:新增断言先因模板缺失取得 RED,补齐模板后 tests/test-audit.sh 全量通过。

Co-Authored-By: Codex <noreply@anthropic.com>

HyxiaoGe commented Aug 9, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a91a9d9317

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread scripts/audit_github_baseline.py Outdated
Co-Authored-By: Codex <noreply@anthropic.com>
@HyxiaoGe

HyxiaoGe commented Aug 9, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 👍

Reviewed commit: a349517e34

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@HyxiaoGe
HyxiaoGe merged commit c5dfd59 into master Aug 9, 2026
1 check passed
@HyxiaoGe
HyxiaoGe deleted the feat/auto-merge-governance-v1 branch August 9, 2026 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant