Repository navigation
Require a change record on the first hop - #63
Merged
Merged
Conversation
A pull request into the first branch has to name a real Linear issue, use nolinear/ with a description, or come from Dependabot. Image repos also record the staging test on the way to main.
dijaropacity
requested review from
adrianopacity and
oscar-opacity
as code owners
October 22, 2026 14:30
A dependabot/ branch only skips the Linear check when Dependabot opened the pull request. Staging fields need real text, and the checkbox accepts a Windows line ending.
DEVOPS-162 The workflow now checks out .github/scripts/branch_flow_guard.py from the default branch and runs it in two modes. The script reads the pull request live from the GitHub API (base, head, head SHA, author, description) and: - lets Linear match the branch name first (issueVcsBranchSearch), then falls back to the issue key, and fails closed only when both fail - treats back-merges (main into dev, main into staging, staging into dev) as needing no ticket - accepts dev, staging, and main only from this repository, not from forks - recognises Dependabot by the pull request author, not the branch name - retries transient Linear and GitHub errors, and fails on auth errors - parses the staging record (Staging URL, Exercised, Result, Tested commit, ticked box) in the common Markdown forms and ties it to the head SHA .github/PULL_REQUEST_TEMPLATE/to-main.md holds the staging record fields, used with ?template=to-main.md on a staging -> main pull request. .github/scripts/test_branch_flow_guard.py has the 15 offline cases; run with python3 -m unittest discover -s .github/scripts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: DEVOPS-162
Summary
nolinear/<reason>with a description, or come from Dependabot.LINEAR_API_KEYhas to be available to this repository or the check fails closed. The GitHub Linear app does not provide that lookup.stagingintomainrecords a staging test when the repository variableREQUIRE_STAGING_TESTistrue. Editing the description re-runs the check.This does not change the org ruleset.
guardstays the only required check until this file is on the default branch of every release-pipeline repo. After that,refs/heads/devand thestaging-testcheck can be added to Branch Flow Guard Status Check.This revision
The check is now
.github/scripts/branch_flow_guard.py, checked out from the default branch and run by the workflow in two modes, with.github/scripts/test_branch_flow_guard.py(15 offline cases,python3 -m unittest discover -s .github/scripts) and.github/PULL_REQUEST_TEMPLATE/to-main.mdfor the staging record (?template=to-main.mdon astagingintomainpull request). Reviewed on sdk#901: Linear matches the branch name first with the issue key as fallback, back-merges need no ticket,dev/staging/mainare trusted only from this repository, Dependabot is recognised by author, transient API errors are retried, and the staging record is tied to the head SHA.Test plan
guardENG-999999-fakefailsguardnolinear/reasonwith an empty description fails, and adding a description passes on the next runguardREQUIRE_STAGING_TESTis true,stagingintomainfailsstaging-testuntil the attestation block is filled in