From b9446759dce049fd4be9487ef15b2be2481b2595 Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Mon, 29 Jun 2026 10:52:50 -0400 Subject: [PATCH 1/2] feat(fleet): add branch-protection example repo lane Signed-off-by: Joshua Temple --- .github/workflows/fleet-e2e.yaml | 10 +++++----- docs/src/content/docs/coverage-matrix.md | 7 ++++--- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/fleet-e2e.yaml b/.github/workflows/fleet-e2e.yaml index 0b08eea3..b760161c 100644 --- a/.github/workflows/fleet-e2e.yaml +++ b/.github/workflows/fleet-e2e.yaml @@ -207,7 +207,7 @@ jobs: PRIMARY_REPO="primary" DEPENDENTS="artifact-a artifact-b" HEAVY_REPO="4env" - REMAINDER="3env 2env single-env release-only no-env callbacks rollback-dispatch" + REMAINDER="3env 2env single-env release-only no-env callbacks rollback-dispatch branch-protection" # ------------------------------------------------------------------- RAW="${REPOS_INPUT:-all}" @@ -369,13 +369,13 @@ jobs: - name: Repin each example repo to the rc run: | set -euo pipefail - # The full roster of 10 example repos. Repinning means: set manifest + # The full roster of 11 example repos. Repinning means: set manifest # cli_version to the rc, replace any other in-repo prerelease refs (rc/dryrun), # regenerate the workflows with the rc binary, then commit + push only # if something changed. This preserves every hand-written suite feature: # regeneration only rewrites the generated workflows, and we touch # nothing else. - REPOS="primary artifact-a artifact-b 4env 3env 2env single-env release-only no-env callbacks rollback-dispatch" + REPOS="primary artifact-a artifact-b 4env 3env 2env single-env release-only no-env callbacks rollback-dispatch branch-protection" # Apply the repin mutation to the checkout in the current directory: # point cli_version at the rc, rewrite any other in-repo rc refs, then @@ -652,11 +652,11 @@ jobs: echo "" echo "| Lane | Result |" echo "|---|---|" - echo "| repin (all 10 repos to rc) | $R_REPIN |" + echo "| repin (all 11 repos to rc) | $R_REPIN |" echo "| primary | $R_PRIMARY |" echo "| dependents (artifact-a, artifact-b) | $R_DEPENDENTS |" echo "| 4env (heavy, alone) | $R_HEAVY |" - echo "| remainder (3env, 2env, single-env, release-only, no-env, callbacks, rollback-dispatch) | $R_REMAINDER |" + echo "| remainder (3env, 2env, single-env, release-only, no-env, callbacks, rollback-dispatch, branch-protection) | $R_REMAINDER |" echo "" echo "> rc gate: this conclusion is the fleet validation signal for" echo "> the rc tag. The repin step pinned each suite to this rc before" diff --git a/docs/src/content/docs/coverage-matrix.md b/docs/src/content/docs/coverage-matrix.md index 5eb0efc7..9465d261 100644 --- a/docs/src/content/docs/coverage-matrix.md +++ b/docs/src/content/docs/coverage-matrix.md @@ -18,9 +18,9 @@ below explains those choices. :::tip[Last validated] This matrix was last validated against the fully green live-fleet run behind `v0.5.1`: -all eleven example repos (primary, artifact-a, artifact-b, single-env, 2env, 3env, 4env, -release-only, no-env, callbacks, rollback-dispatch) passed every probe, and the shared -fail-closed reconcile gate accounted for every run in each scenario window. +all twelve example repos (primary, artifact-a, artifact-b, single-env, 2env, 3env, 4env, +release-only, no-env, callbacks, rollback-dispatch, branch-protection) passed every probe, +and the shared fail-closed reconcile gate accounted for every run in each scenario window. ::: ## Why two layers, restated for this matrix @@ -77,6 +77,7 @@ only under real installation tokens on the fleet, never in the token-free harnes | External update and notify (cross-repo) | `21-cross-repo-callback`, `multi-repo/*` | external-update from artifact-a and artifact-b, concurrent no-loss (primary) | `internal/external` | A satellite deploy writes the primary's shared manifest with no lost update | | Manage-release verbs (create, update, lock, prerelease, publish, delete) | `05-publish-callback` | `manage-release-verbs` lock to prerelease, orphan delete (primary); single-env stages | `internal/release` | Each release verb mutates the real release object as specified | | State write (Contents API) and retry-on-conflict | `08-state-push-retry` | state read-back after every step (all multi-step repos) | `internal/statewrite`, `internal/promote` | State commits land and survive a concurrent-writer race | +| Branch-protection JSON generator | | `branch-protection-suite-orchestrate` (cascade-example-branch-protection) | `internal/branchprotection` | Generated JSON accepted by the GitHub classic branch-protection API; required-status-checks, enforce-admins, and PR-review fields match the hardcoded defaults | ## Guards and registered negatives From a3132e0542cfd2f733c8426f73a6b1c3a317b964 Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Mon, 29 Jun 2026 10:59:20 -0400 Subject: [PATCH 2/2] fix(fleet): correct 11->12 repo count in fleet-e2e and coverage-matrix Signed-off-by: Joshua Temple --- .github/workflows/fleet-e2e.yaml | 4 ++-- docs/src/content/docs/coverage-matrix.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/fleet-e2e.yaml b/.github/workflows/fleet-e2e.yaml index b760161c..b0fd0d28 100644 --- a/.github/workflows/fleet-e2e.yaml +++ b/.github/workflows/fleet-e2e.yaml @@ -369,7 +369,7 @@ jobs: - name: Repin each example repo to the rc run: | set -euo pipefail - # The full roster of 11 example repos. Repinning means: set manifest + # The full roster of 12 example repos. Repinning means: set manifest # cli_version to the rc, replace any other in-repo prerelease refs (rc/dryrun), # regenerate the workflows with the rc binary, then commit + push only # if something changed. This preserves every hand-written suite feature: @@ -652,7 +652,7 @@ jobs: echo "" echo "| Lane | Result |" echo "|---|---|" - echo "| repin (all 11 repos to rc) | $R_REPIN |" + echo "| repin (all 12 repos to rc) | $R_REPIN |" echo "| primary | $R_PRIMARY |" echo "| dependents (artifact-a, artifact-b) | $R_DEPENDENTS |" echo "| 4env (heavy, alone) | $R_HEAVY |" diff --git a/docs/src/content/docs/coverage-matrix.md b/docs/src/content/docs/coverage-matrix.md index 9465d261..d1926461 100644 --- a/docs/src/content/docs/coverage-matrix.md +++ b/docs/src/content/docs/coverage-matrix.md @@ -62,7 +62,7 @@ only under real installation tokens on the fleet, never in the token-free harnes | Feature | act plus gitea scenario | Live-fleet probe (repo) | Unit | What the layer proves | |---|---|---|---|---| -| Orchestrate trunk build to release candidate | `01`, `02`, `03`, `04`, `34-extra-orchestrate-triggers` | every repo, orchestrate-on-merge (all 11) | `internal/orchestrate` | A trunk merge mints an RC draft and writes state, across every topology, on real Actions | +| Orchestrate trunk build to release candidate | `01`, `02`, `03`, `04`, `34-extra-orchestrate-triggers` | every repo, orchestrate-on-merge (all 12) | `internal/orchestrate` | A trunk merge mints an RC draft and writes state, across every topology, on real Actions | | Default promotion (env to next env) | `04`, `promote/cascade-deploy-enabled` | `promote-staging` (2env, 3env, primary) | `internal/promote` | One promotion step copies source state into the target on a real release object | | Cascade-mode promotion (atomic multi-step) | `04-cascade-promotion` | `lifecycle` dev to prod (4env) | `internal/promote` | The full ladder advances through intermediates and publishes at the top | | Standalone release lane (draft, prerelease, publish) | `05-publish-callback`, `37`, `38` | dispatch prerelease then release (single-env); `release-only` | `internal/release` | A real release transitions draft to prerelease to published with RC reaping |