From df2040604df40bde9d7765666abdc5e1bd1dfc94 Mon Sep 17 00:00:00 2001 From: Altay Date: Tue, 8 Sep 2026 23:07:29 +0300 Subject: [PATCH 1/2] docs: define default branch check policy --- README.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/README.md b/README.md index 66e45e9..17eb8bb 100644 --- a/README.md +++ b/README.md @@ -13,6 +13,24 @@ Renovate uses the shared organization preset and tracks the four scanner image tags and digests in `scan.yml`. Digest-only updates remain manual under that preset. Image tags provide update metadata; execution remains pinned by digest. +## Default-branch checks + +Repositories ready for immediate GitHub-native Renovate automerge opt in with +`platformAutomerge: true` and an active `default-branch-checks` ruleset. The +[shared preset](https://github.com/uinaf/renovate-config) keeps this opt-in off +by default. Update eligibility and release age remain preset-owned. + +Required checks constrain every update to the default branch, including direct +pushes. Approved content and release writers need repository-specific exceptions +to the checks ruleset. Signing, deletion, and force-push protections remain in +the separate organization baseline. An App's repository access alone does not +authorize an exception. + +Before changing a rule, compare its checks and exceptions with the owning +workflow or publishing contract. Preserve a before-state and review the exact +change; verify live rules after a canary and after the rollout. Fleet inventories +that include private repositories stay in their private policy owner. + ## Verify Run changed workflow checks locally with `mise run verify`. Before handoff, run From 8dcbc214762a6a3c8805830d12a39a3356928ae3 Mon Sep 17 00:00:00 2001 From: Altay Date: Tue, 8 Sep 2026 23:11:57 +0300 Subject: [PATCH 2/2] docs: clarify private inventory storage --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 17eb8bb..773df07 100644 --- a/README.md +++ b/README.md @@ -28,8 +28,8 @@ authorize an exception. Before changing a rule, compare its checks and exceptions with the owning workflow or publishing contract. Preserve a before-state and review the exact -change; verify live rules after a canary and after the rollout. Fleet inventories -that include private repositories stay in their private policy owner. +change; verify live rules after a canary and after the rollout. Keep fleet +inventories that include private repositories in a private repository. ## Verify