add public rules fix ci

.github/workflows/check.yml

@@ -13,20 +13,18 @@ jobs:
       - name: Validate package rules
         run: bash check
 
+  # Only on PRs: we validate the contributor's own commits. master's squash-merge
+  # commits are created by GitHub without a Signed-off-by trailer, so running this
+  # on push would always fail on the merge commit.
   dco:
+    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Check DCO sign-off
         env:
-          BASE: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
-          HEAD: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        run: |
-          # New branch / unknown base -> fall back to comparing against master.
-          if [[ -z "$BASE" || "$BASE" =~ ^0+$ ]]; then
-            git fetch --no-tags origin master
-            BASE=$(git rev-parse origin/master)
-          fi
-          bash dco "$BASE..$HEAD"
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: bash dco "$BASE..$HEAD"

readme.md

@@ -1,14 +1,14 @@
 # Arch Closed Repository - State
 
 - All commits require:
-	- A valid `GPG` key to sign all commits + SSH setup (web commits will not be accepted)
+	- A valid `GPG` key to sign all commits + SSH setup _(pure web commits will not be accepted)_
 	- A valid DCO trailer: using `--signoff` or `-s` with `git`
 	- Any web commits require an email linked and verified
 	- A valid review from the dictator himself
 
 - All commits on `master`:
 	- Require linear history
-	- Only through PRs
+	- Only through PRs with a valid review
 
 ## Package rules
 
@@ -63,11 +63,10 @@ Repo-root helper scripts:
 
 Packaging you'll want: `nvchecker`, `devtools`, `base-devel` and `pacman-contrib`.
 
-## CI
+---
+
+## Ruleset
 
-GitHub Actions (`.github/workflows/check.yml`) runs two jobs on **every branch
-push and every pull request**: `policy` (`bash check`) and `dco` (`bash dco`).
-A branch that violates any package rule, or carries a commit without a matching
-`Signed-off-by:` trailer, fails CI and cannot be merged into `master`.
+The current GitHub ruleset can be freely consulted through this [file](./ruleset.json)
 
 ---

ruleset.json

@@ -0,0 +1,61 @@
+{
+  "id": 17646132,
+  "name": "Sign + Linear",
+  "target": "branch",
+  "source_type": "Repository",
+  "source": "h8d13/ACR",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "exclude": [],
+      "include": [
+        "refs/heads/master"
+      ]
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_linear_history"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "policy"
+          },
+          {
+            "context": "dco"
+          }
+        ]
+      }
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "required_reviewers": [],
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": [
+          "squash",
+          "rebase"
+        ]
+      }
+    }
+  ],
+  "bypass_actors": []
+}