From 2b891a2761353bb02af2added1e466193d9e61f1 Mon Sep 17 00:00:00 2001 From: Leonardo Dionizio Date: Tue, 27 Oct 2026 16:07:43 -0300 Subject: [PATCH] docs: stop describing the branch-model feature flag Conviso Platform removed the asset-branch-model-write flag: branch association now depends only on sending repository-url. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 ++ README.md | 3 --- docs/branch-association.md | 18 ++++++------------ docs/publishing-marketplace.md | 3 +-- 4 files changed, 9 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 36a93ae..6afecbd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ All notable changes to this project are documented here. The format follows - Marketplace display name from **Conviso GitHub Sync Task** to **Sync External Scans with Conviso**. Workflows keep using `convisoappsec/github-sync-task@v1`. +- Branch association no longer depends on a per-company feature flag in Conviso Platform: sending + `repository-url` is enough. The docs stop describing the flag. ## [1.0.0] — 2026-08-10 diff --git a/README.md b/README.md index ef13f32..51d3461 100644 --- a/README.md +++ b/README.md @@ -127,9 +127,6 @@ Three things to know before turning this on: succeeds. - **The Asset gets renamed.** Once associated with a repository, the Asset in Conviso Platform is named after the repository (`org/repo`) rather than the project name reported by the scanner. -- Branch association also depends on the feature being enabled for your company in Conviso - Platform. Until then the action behaves exactly as it would without the two inputs, and sending - them is harmless. ### Pull requests diff --git a/docs/branch-association.md b/docs/branch-association.md index a352180..3620390 100644 --- a/docs/branch-association.md +++ b/docs/branch-association.md @@ -19,19 +19,13 @@ The `associateProject` mutation accepts: ## The gate that defines everything -`branches` **only takes effect** when both conditions hold: +`branches` **only takes effect** when `repositoryUrl` is present. -1. `repositoryUrl` is present, **and** -2. the `asset-branch-model-write` feature flag is enabled for the company. - -Two consequences the action is designed around: - -- **Sending `branches` without `repositoryUrl` is a silent no-op.** No error, no warning from the - API — the value is discarded and the association falls back to the legacy, name-based path. That - is why the action warns locally instead of relying on the response, and why `repositoryUrl` and - `branch` were introduced together rather than one after the other. -- **The flag is per company.** With it off, behaviour is identical to not sending the fields at - all. The change is backward-compatible by construction. +The consequence the action is designed around: **sending `branches` without `repositoryUrl` is a +silent no-op.** No error, no warning from the API — the value is discarded and the association +falls back to the legacy, name-based path. That is why the action warns locally instead of relying +on the response, and why `repositoryUrl` and `branch` were introduced together rather than one +after the other. When the gate passes, the backend identifies the Asset by repository rather than by name, creates a `Branch` per declared branch, and stamps a separate `ImportedScan` per branch. An older scan diff --git a/docs/publishing-marketplace.md b/docs/publishing-marketplace.md index 2290bfb..5df5d65 100644 --- a/docs/publishing-marketplace.md +++ b/docs/publishing-marketplace.md @@ -192,8 +192,7 @@ decision rather than a surprise: 2. **A branch without a repository is dropped silently by the API.** The action warns (`branch was resolved but repository-url is empty…`) but still succeeds, because the API's - answer is a `200`. Branch association additionally depends on a per-company feature flag in - Conviso Platform; while it is off, the two inputs are accepted and have no effect. + answer is a `200`. ---