Add support for repository rulesets by vaindil · Pull Request #7650 · cli/cli

vaindil · 2023-07-01T00:02:21Z

Repository rulesets are a new GitHub feature, essentially the evolution of branch protections. This PR adds support for them via a new command (ruleset/rs) with 3 subcommands.

rs list: Lists rulesets for the provided repo or org
rs view <id>: View info about a specific ruleset by ID, or choose interactively
rs check <branch>: List the rules that apply to the given branch in a repo

Sample output

List:

Showing 2 of 2 rulesets in my-org/repo-name and its parents

ID    NAME            SOURCE                   STATUS  RULES
1234  My Org Ruleset  my-org (org)             active  3
5678  Test Ruleset    my-org/repo-name (repo)  active  3

View:

Test Ruleset
ID: 5678
Source: my-org/repo-name (Repository)
Enforceument: Active

Bypass List
- OrganizationAdmin (ID: 1), mode: always
- RepositoryRole (ID: 5), mode: always

Conditions
- ref_name: [exclude: []] [include: [~ALL]] 

Rules
- commit_author_email_pattern: [name: ] [negate: false] [operator: ends_with] [pattern: @example.com] 
- commit_message_pattern: [name: ] [negate: false] [operator: contains] [pattern: asdf] 
- creation

Check:

6 rules apply to branch foo in repo my-org/repo-name

- commit_author_email_pattern: [name: ] [negate: false] [operator: ends_with] [pattern: @example.com] 
  (configured in ruleset 1234 from organization my-org)

- commit_author_email_pattern: [name: ] [negate: false] [operator: ends_with] [pattern: @example.me] 
  (configured in ruleset 5678 from repository my-org/repo-name)

- commit_message_pattern: [name: ] [negate: false] [operator: starts_with] [pattern: fff] 
  (configured in ruleset 1234 from organization my-org)

- commit_message_pattern: [name: ] [negate: false] [operator: contains] [pattern: asdf] 
  (configured in ruleset 5678 from repository my-org/repo-name)

- creation
  (configured in ruleset 5678 from repository my-org/repo-name)

- required_signatures
  (configured in ruleset 1234 from organization my-org)

Notes

The list subcommand and interactive mode for the view subcommand both use GraphQL, but the others use the REST API. This is because each rule type within the GraphQL response is its own type, so if everything were to use the GraphQL API, then the CLI would have to be updated each time a new rule is added to rulesets. We don't want to tie the CLI logic to the API shape like that.
- I could standardize both on the REST API if desired, but I already had the GraphQL logic written when I figured that out so I just left it.
None of the commands support the --json flag for that same reason, as it seems to require using the GraphQL API and providing a list of supported fields, which would continue to tie them together. I'd love to add support if it's possible!

cliAutomation · 2023-07-05T19:24:41Z

Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message.

vilmibm

Requested some very minor changes; otherwise it's looking great. thank you for the awesome work.

pkg/cmd/ruleset/list/list.go

pkg/cmd/ruleset/view/view.go

pkg/cmd/ruleset/view/view_test.go

vilmibm · 2023-07-05T23:38:48Z

the CLI would have to be updated each time a new rule is added to rulesets

This is frustrating but might be worth it in order to support --json.

Alternatively, can we support --json but just treat actual rule definitions as raw json? in other words, the only keys you can select are top level to a ruleset.

vaindil · 2023-07-06T20:44:46Z

This is frustrating but might be worth it in order to support --json.

Alternatively, can we support --json but just treat actual rule definitions as raw json? in other words, the only keys you can select are top level to a ruleset.

@vilmibm This is theoretically possible, but several of the fields are paginated, and many of them require more fields underneath that may change:

bypassActors
- paginated
- future additions would require a CLI update
conditions
- future additions would require a CLI update
rules
- paginated
- future additions would require CLI update
source
- can be multiple response types (either Repository or Organization)
- future additions would require CLI update

Based on this, I think the only feasible way to add support would be to use the REST API, since those top-level fields will rarely change. Nothing else in the CLI uses the REST API for that command though. There's just too much weird behavior with this GraphQL setup because rulesets are a bit unique, it's not really feasible.

vilmibm and others added 22 commits July 5, 2023 13:57

start on gh rs

87fabeb

WIP compute branch, call API

bcb4194

start writing up structs for rules API payloads

79113bd

start on rs list

24911ff

wip

a742e9f

GQL query works but it's messy

bb9a9fa

refactor and support org rulesets

7b2c8ab

updates, initial list test

5155844

basic ruleset view works

7f81645

allow getting parents, move list to shared package

3e64192

split ruleset types by API type

e91670e

don't allow both --repo and --org, add docs

8fa69c4

gracefully handle missing admin:org scope

ef30d87

interactive ruleset selection, move shared logic

f25b2af

update tests, add rules to view command

8328a0a

update bypass response and parents logic, tests

2f7caf8

list test updates

3add672

initial view tests

5c5dcd2

add ruleset check command

e4aa5ba

misc cleanup

77df68e

fix merge errors

159ac8b

add rs check tests

dcefe34

vaindil force-pushed the vaindil/rulesets branch from d02bcba to dcefe34 Compare July 5, 2023 17:57

vaindil added 2 commits July 5, 2023 14:29

refactor graphql query a bit

069faef

split org/repo graphql queries, better tests

ab921f9

vaindil marked this pull request as ready for review July 5, 2023 19:24

vaindil requested a review from a team as a code owner July 5, 2023 19:24

vaindil requested review from samcoe and removed request for a team July 5, 2023 19:24

cliAutomation added the external pull request originating outside of the CLI core team label Jul 5, 2023

vilmibm suggested changes Jul 5, 2023

View reviewed changes

pkg/cmd/ruleset/list/list.go Outdated Show resolved Hide resolved

pkg/cmd/ruleset/view/view.go Outdated Show resolved Hide resolved

pkg/cmd/ruleset/view/view_test.go Show resolved Hide resolved

make IDs cyan, add prompter test

d82c119

vilmibm approved these changes Jul 6, 2023

View reviewed changes

vilmibm merged commit 4ba2f2f into cli:trunk Jul 10, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for repository rulesets#7650

Add support for repository rulesets#7650
vilmibm merged 25 commits intocli:trunkfrom
vaindil:vaindil/rulesets

vaindil commented Jul 1, 2023 •

edited

Loading

Uh oh!

cliAutomation commented Jul 5, 2023

Uh oh!

vilmibm left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vilmibm commented Jul 5, 2023

Uh oh!

vaindil commented Jul 6, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

vaindil commented Jul 1, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Notes

Uh oh!

cliAutomation commented Jul 5, 2023

Uh oh!

vilmibm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vilmibm commented Jul 5, 2023

Uh oh!

vaindil commented Jul 6, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vaindil commented Jul 1, 2023 •

edited

Loading