chore(ospo): close Hardening Controls 5 + 7 findings#22
Merged
Conversation
- Task 3: tolerate auto-merge failure when 'Allow auto-merge' is off - Task 4: downgrade live workflow_dispatch smoke test to static validation - Task 1: add ruleset semantic validation via gh api PUT .../check - Task 5: drop stale line-number reference in Files header - Task 8: guard empty RULESET_ID with actionable error message
- Drop fake gh api PUT .../check call (endpoint doesn't exist) - Remove two stale CLAUDE.md line-233 references - Update verification-note to reflect static-only pre-merge validation
Removes RepositoryRole 5 (Admin) bypass with mode 'always' and replaces it with Integration 15368 (github-actions[bot]) bypass scoped to 'pull_request' merges only. Effect: humans (including admins) can no longer push directly to main or merge PRs that fail the rules. The bot can self-merge its own PRs (e.g. news-sync) without an approver, but the required 'test' status check still gates the merge. Addresses OSPO Hardening Control 5. Spec: docs/superpowers/specs/2026-06-01-ospo-hardening-design.md
…group
Prepares news-sync for PR-based flow (Task 3).
- pull-requests: write needed for 'gh pr create' and 'gh pr merge'
- concurrency: news-sync serializes overlapping cron + manual runs to
prevent force-push races on bot/news-sync-update
The previous flow ran 'git commit && git push' directly to main. After
the OSPO hardening ruleset takes effect (sister commit), direct pushes
to main are blocked even for the bot. This step instead:
1. Pushes to a stable bot branch (bot/news-sync-update, force-push)
2. Opens a PR via 'gh pr create' if one isn't already open
3. Arms 'gh pr merge --auto --squash' which fires when the test check
passes
The bot's narrow ruleset bypass (Integration 15368 / pull_request mode)
allows the auto-merge to proceed without a human approver.
Spec: docs/superpowers/specs/2026-06-01-ospo-hardening-design.md
Admins no longer bypass the main ruleset; only github-actions[bot] has a narrow PR-merge bypass for automation.
Classifies all 25 current admins into project leads (3, keep), org-mandated (6, cannot demote at repo level), and inherited/unclear (16, propose demote to maintain). No demotions are executed by this PR. The project owner reviews and acts per-account.
The Task 3 implementation amended its initial commit to fix two bugs: 1. jq expression now uses '.[0].number // empty' (was returning literal string 'null' for empty PR list, breaking the existence check) 2. --label 'automation,news-sync' removed (labels don't exist in repo) The spec and plan still showed the original buggy code blocks. This commit syncs them with what actually shipped.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the OSPO Hardening Controls 5 ("Action Required") and partially addresses Control 7 ("Warning") findings on this repo.
Changes
Spec
docs/superpowers/specs/2026-06-01-ospo-hardening-design.md
Deployment ordering (post-merge)
Rollback
`git revert` this PR's merge commit and re-import the previous ruleset version. One `gh api` call away.