From a4dd30efc4e2ca075f88620ee75000f75317b2ea Mon Sep 17 00:00:00 2001 From: rene Date: Sun, 26 Jul 2026 19:10:15 -0700 Subject: [PATCH 1/3] chore(repos): adopt thaw-app/brand-assets Declare the shared brand-assets repository in Pulumi so org IaC tracks the proprietary headers, icons, and packaging art store. --- config/repos.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/config/repos.yaml b/config/repos.yaml index c4d21c4..33e73e5 100644 --- a/config/repos.yaml +++ b/config/repos.yaml @@ -36,6 +36,20 @@ repos: deleteBranchOnMerge: true autoInit: true + + - name: brand-assets + description: Shared Thaw brand assets — headers, icons, packaging art, marketing. + visibility: public + topics: + - thaw + - branding + - assets + mergeStrategies: + - squash + deleteBranchOnMerge: true + autoInit: false + adopt: true + - name: menubarspawner description: Small macOS menu-bar helper that spawns customizable status items. visibility: public From 6360a3b625c5b8a79111354a3f73fa9985313b70 Mon Sep 17 00:00:00 2001 From: rene Date: Sun, 26 Jul 2026 19:23:25 -0700 Subject: [PATCH 2/3] chore(repos): adopt brand-assets as a bare repo Skip org labels, rulesets, and CODEOWNERS so brand-assets stays a plain permission-free asset store with no team ACL entries. --- config/repos.yaml | 13 +++++-------- config/rulesets.yaml | 5 +++++ config/schema/repos.schema.json | 4 ++++ src/setup/resolve.ts | 13 ++++++++----- src/types/repo.ts | 1 + test/resolve.test.ts | 20 ++++++++++++++++++++ 6 files changed, 43 insertions(+), 13 deletions(-) diff --git a/config/repos.yaml b/config/repos.yaml index 33e73e5..9554753 100644 --- a/config/repos.yaml +++ b/config/repos.yaml @@ -40,15 +40,12 @@ repos: - name: brand-assets description: Shared Thaw brand assets — headers, icons, packaging art, marketing. visibility: public - topics: - - thaw - - branding - - assets - mergeStrategies: - - squash - deleteBranchOnMerge: true - autoInit: false adopt: true + bare: true + hasIssues: false + hasWiki: false + hasProjects: false + hasDiscussions: false - name: menubarspawner description: Small macOS menu-bar helper that spawns customizable status items. diff --git a/config/rulesets.yaml b/config/rulesets.yaml index 18fa01f..3985e93 100644 --- a/config/rulesets.yaml +++ b/config/rulesets.yaml @@ -19,6 +19,11 @@ rulesets: refName: includes: - "~DEFAULT_BRANCH" + repositoryName: + includes: + - "~ALL" + excludes: + - brand-assets rules: creation: true update: false diff --git a/config/schema/repos.schema.json b/config/schema/repos.schema.json index 5c2f14d..c583407 100644 --- a/config/schema/repos.schema.json +++ b/config/schema/repos.schema.json @@ -159,6 +159,10 @@ "required": ["name"], "additionalProperties": false } + }, + "bare": { + "type": "boolean", + "description": "Adopt as a plain repo: no org labels, rulesets, CODEOWNERS, or implied team access." } }, "required": ["name", "description"], diff --git a/src/setup/resolve.ts b/src/setup/resolve.ts index fd13281..2d94370 100644 --- a/src/setup/resolve.ts +++ b/src/setup/resolve.ts @@ -106,16 +106,19 @@ export function buildRepoConfig( hasWiki: repo.hasWiki ?? features.wiki, hasProjects: repo.hasProjects ?? features.projects, hasDiscussions: repo.hasDiscussions ?? features.discussions, - labels: { ...labels, ...repo.labels }, + labels: repo.bare + ? { ...(repo.labels ?? {}) } + : { ...labels, ...repo.labels }, teams: teamAccess, - resolvedRepoRulesets: provisionRepoRulesets - ? rulesetsForRepo(repo.name, rulesets) - : [], + resolvedRepoRulesets: + repo.bare || !provisionRepoRulesets + ? [] + : rulesetsForRepo(repo.name, rulesets), resolvedBranchProtection, squashMergeCommitTitle: defaults.squashMergeCommitTitle, squashMergeCommitMessage: defaults.squashMergeCommitMessage, defaultBranch: defaults.defaultBranch, - codeownersContent: ctx.codeownersContent, + codeownersContent: repo.bare ? "" : ctx.codeownersContent, pulumiName: repo.pulumiName ?? repo.name, organization, }; diff --git a/src/types/repo.ts b/src/types/repo.ts index fa36d31..2111926 100644 --- a/src/types/repo.ts +++ b/src/types/repo.ts @@ -64,6 +64,7 @@ export const RepoConfigSchema = v.pipe( adopt: v.optional(v.boolean()), pulumiName: v.optional(v.string()), archived: v.optional(v.boolean()), + bare: v.optional(v.boolean()), hasIssues: v.optional(v.boolean()), hasWiki: v.optional(v.boolean()), hasProjects: v.optional(v.boolean()), diff --git a/test/resolve.test.ts b/test/resolve.test.ts index 88f834d..d739a8d 100644 --- a/test/resolve.test.ts +++ b/test/resolve.test.ts @@ -132,6 +132,26 @@ describe("buildRepoConfig", () => { ); expect(Object.keys(built.labels ?? {})).toEqual(["global", "local"]); }); + + it("bare repos skip org labels, rulesets, and CODEOWNERS", () => { + const built = buildRepoConfig(repo({ name: "brand-assets", bare: true }), { + ...baseCtx, + labels: { global: { color: "000000" } }, + provisionRepoRulesets: true, + rulesets: [ + { + id: "main-default", + target: "branch", + enforcement: "active", + conditions: { refName: { includes: ["~DEFAULT_BRANCH"] } }, + rules: {}, + }, + ], + }); + expect(built.labels).toEqual({}); + expect(built.resolvedRepoRulesets).toEqual([]); + expect(built.codeownersContent).toBe(""); + }); }); describe("resolveTeamAccess", () => { From 7b4dbc5c61d44378c1a73ab0a4bbc4efcf50c333 Mon Sep 17 00:00:00 2001 From: rene Date: Sun, 26 Jul 2026 21:44:42 -0700 Subject: [PATCH 3/3] fix(test): provide full RulesetRules in bare-repo fixture Empty rules: {} fails tsc against the strict RulesetRulesSchema. --- test/resolve.test.ts | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/test/resolve.test.ts b/test/resolve.test.ts index d739a8d..c9bbdd8 100644 --- a/test/resolve.test.ts +++ b/test/resolve.test.ts @@ -144,7 +144,23 @@ describe("buildRepoConfig", () => { target: "branch", enforcement: "active", conditions: { refName: { includes: ["~DEFAULT_BRANCH"] } }, - rules: {}, + rules: { + creation: false, + update: false, + deletion: false, + nonFastForward: false, + requiredLinearHistory: false, + requiredSignatures: false, + copilotCodeReview: { + reviewDraftPullRequests: false, + reviewOnPush: false, + }, + pullRequest: {}, + requiredStatusChecks: { enabled: false }, + requiredCodeScanning: { enabled: false }, + mergeQueue: { enabled: false }, + requiredDeployments: { enabled: false }, + }, }, ], });