From 341c32011379076bd22636ed7de63e8e74aa8322 Mon Sep 17 00:00:00 2001
From: h8d13 <hadean-eon-dev@proton.me>
Date: Mon, 15 Jun 2026 17:54:30 +0200
Subject: [PATCH 1/2] chore(rules): publish public json file

Signed-off-by: h8d13 <hadean-eon-dev@proton.me>
---
 readme.md    | 13 ++++++-----
 ruleset.json | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 67 insertions(+), 7 deletions(-)
 create mode 100644 ruleset.json

diff --git a/readme.md b/readme.md
index fc62155..45d50ce 100644
--- a/readme.md
+++ b/readme.md
@@ -1,14 +1,14 @@
 # Arch Closed Repository - State
 
 - All commits require:
-	- A valid `GPG` key to sign all commits + SSH setup (web commits will not be accepted)
+	- A valid `GPG` key to sign all commits + SSH setup _(pure web commits will not be accepted)_
 	- A valid DCO trailer: using `--signoff` or `-s` with `git`
 	- Any web commits require an email linked and verified
 	- A valid review from the dictator himself
 
 - All commits on `master`:
 	- Require linear history
-	- Only through PRs
+	- Only through PRs with a valid review
 
 ## Package rules
 
@@ -63,11 +63,10 @@ Repo-root helper scripts:
 
 Packaging you'll want: `nvchecker`, `devtools`, `base-devel` and `pacman-contrib`.
 
-## CI
+---
+
+## Ruleset
 
-GitHub Actions (`.github/workflows/check.yml`) runs two jobs on **every branch
-push and every pull request**: `policy` (`bash check`) and `dco` (`bash dco`).
-A branch that violates any package rule, or carries a commit without a matching
-`Signed-off-by:` trailer, fails CI and cannot be merged into `master`.
+The current GitHub ruleset can be freely consulted through this [file](./ruleset.json)
 
 ---
diff --git a/ruleset.json b/ruleset.json
new file mode 100644
index 0000000..eb58753
--- /dev/null
+++ b/ruleset.json
@@ -0,0 +1,61 @@
+{
+  "id": 17646132,
+  "name": "Sign + Linear",
+  "target": "branch",
+  "source_type": "Repository",
+  "source": "h8d13/ACR",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "refs/heads/master"
+      ]
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_linear_history"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "policy"
+          },
+          {
+            "context": "dco"
+          }
+        ]
+      }
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": [
+          "squash",
+          "rebase"
+        ]
+      }
+    }
+  ],
+  "bypass_actors": []
+}

From 9932728bfed1a43b485891162dfbd77683ef8d14 Mon Sep 17 00:00:00 2001
From: h8d13 <hadean-eon-dev@proton.me>
Date: Mon, 15 Jun 2026 17:56:25 +0200
Subject: [PATCH 2/2] ci: run DCO check on pull_request only

GitHub squash-merge commits land on master without a Signed-off-by
trailer, so the dco job failed on every push to master. The required
check is evaluated on the PR head anyway, so scope dco to pull_request
events and validate just the PR's own commits (base..head).

Signed-off-by: h8d13 <hadean-eon-dev@proton.me>
---
 .github/workflows/check.yml | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index bc5c95a..4cfc401 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -13,7 +13,11 @@ jobs:
       - name: Validate package rules
         run: bash check
 
+  # Only on PRs: we validate the contributor's own commits. master's squash-merge
+  # commits are created by GitHub without a Signed-off-by trailer, so running this
+  # on push would always fail on the merge commit.
   dco:
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -21,12 +25,6 @@ jobs:
           fetch-depth: 0
       - name: Check DCO sign-off
         env:
-          BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
-          HEAD: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        run: |
-          # New branch / unknown base -> fall back to comparing against master.
-          if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]]; then
-            git fetch --no-tags origin master
-            BASE=$(git rev-parse origin/master)
-          fi
-          bash dco "$BASE..$HEAD"
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: bash dco "$BASE..$HEAD"