Conversation
Co-authored-by: david3107 <20040740+david3107@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add tag protection settings to repository policy
Add tag protection policy verification for repository rulesets
Oct 19, 2025
Contributor
|
@copilot the issue clearly specifies the policy to create in the yml file and the expected checks. tags:
enforcement: active # disabled | active | evaluate
target: tag # fixed for tag rules so we can also not specify it here but fix it in code
scope:
include:
- "v*" # e.g., protect all version tags
# - "~ALL" # special token: all tags
exclude: [] # patterns to exclude, e.g., ["v0.*"]
operations: # who can perform actions on matching tags
create: restricted # allowed | restricted (restricted = bypass-only)
update: restricted
delete: restricted
naming: # optional: constrain tag names
enabled: true
operator: regex # starts_with | ends_with | contains | regex
pattern: "^v\\d+\\.\\d+\\.\\d+(-[0-9A-Za-z.-]+)?$"
negate: false # true = pattern disallowed
bypass: # actors allowed to bypass protections
organization_admins: always # always | exempt
teams:
- id: 1234567 # example team id
mode: always # always | exempt
integrations:
- id: 987654 # GitHub App id
mode: always
repository_roles:
- id: 3 # e.g., Maintainer role id
mode: always
deploy_keys:
allow: true # DeployKeys can bypass when true
mode: always
``` |
- Changed from simple protected_tags list to comprehensive tags structure - Added enforcement, scope (include/exclude), operations, naming, and bypass configuration - Updated TypeScript types to match new structure - Rewrote TagProtectionChecks evaluator to validate all aspects of tag protection - Checks enforcement level, scope patterns, operation restrictions, naming constraints, and bypass actors Co-authored-by: david3107 <20040740+david3107@users.noreply.github.com>
Contributor
Author
... Updated the tag protection policy structure to match the specified YAML format. The policy now includes:
The evaluator has been rewritten to validate all these aspects against GitHub's repository rulesets API. Commit: will be in the next push |
Copilot
AI
changed the title
Add tag protection policy verification for repository rulesets
Add comprehensive tag protection policy verification for repository rulesets
Oct 19, 2025
Contributor
|
@copilot looking at the response from GitHub an example is adjust the policy and the checks to match the info provided by the ruleset and consider the schema |
Contributor
|
@copilot check the previous comment |
- Normalize scope patterns by stripping refs/tags/ prefix from API response - Implement proper tag_name_pattern rule validation in naming check - Compare policy naming operator, pattern, and negate against actual ruleset parameters Co-authored-by: david3107 <20040740+david3107@users.noreply.github.com>
Contributor
Author
... Fixed the implementation based on the real API response:
Commit: see next push
Addressed the API response structure. Fixed pattern normalization (strips |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implementation Plan for Tag Protection Policy ✅
tagssection to repository.yml policy file with comprehensive structure✅ Implementation Complete
Latest Updates (based on real API response)
Fixed the implementation to properly handle GitHub's actual API response format:
Scope Pattern Normalization: GitHub API returns patterns with
refs/tags/prefix (e.g.,refs/tags/v*). The implementation now strips this prefix to match against policy patterns (e.g.,v*).Tag Name Pattern Validation: Properly implemented validation of
tag_name_patternrule type with parameters:operator(regex, starts_with, ends_with, contains)pattern(the actual regex or string pattern)negate(whether pattern should be negated)Policy Structure
The tag protection policy includes:
Example Configuration
Verification Results ✅
Original prompt
This section details on the original issue you should resolve
<issue_title>Add tag protection settings in repository policy in GitHub</issue_title>
<issue_description>Add Tag protection verification for tags in a specific repository
The request is
GET /repos/{owner}/{repo}/rulesets.and the response schema