Development record
The settings baseline requires each status check from any source. GitHub lets any person or integration with write access set the state of any status check, and the statuses API lets a push-access token post any context, so a required check left on any source can be set to passing by someone other than the workflow that runs it. Choosing the app as the source refuses a status set by anyone else. Assessed against the abcd-fixes-what-it-adds principle: the route exists without abcd (it is GitHub's default for any required check), and abcd's apply adds no weaker state, since without it the repository requires no check at all; pinning is a tightening of a setting abcd itself writes, applied only on the person's yes, and changes nothing else about how the repository works. No released abcd has ever applied a required check: the apply that writes one ships for the first time in the change itd-2610290746077716 delivers, so abcd has put no managed repository in this state.
The settings baseline requires each status check from any source. GitHub lets any person or integration with write access set the state of any status check, and the statuses API lets a push-access token post any context, so a required check left on any source can be set to passing by someone other than the workflow that runs it. Choosing the app as the source refuses a status set by anyone else. Assessed against the abcd-fixes-what-it-adds principle: the route exists without abcd (it is GitHub's default for any required check), and abcd's apply adds no weaker state, since without it the repository requires no check at all; pinning is a tightening of a setting abcd itself writes, applied only on the person's yes, and changes nothing else about how the repository works. No released abcd has ever applied a required check: the apply that writes one ships for the first time in the change itd-2610290746077716 delivers, so abcd has put no managed repository in this state.
Grounds
- pursued: a status set by anyone but the app that reports a check no longer satisfies it once the apply runs; a pinned check that its own workflow's runs fail to satisfy, or a pin chosen from a read that was cut short, would show it wrong
Frontmatter
| id | iss-2610290913450522 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610290913450522-required-checks-accept-any-source.md
open on GitHub ↗ · commit history ↗
mentions4
- adr-2611011327164895A self-attested result is labelled as such, and only the person switches it on, by an act abcd's own verbs refuse to its agents
- dcn-26103007131753162026-10-30 — Decided by the technical facilitator, on delegation, for iss-2610290913450522: the remote audit pins each required check to the one GitHub App observed reporting it in the check runs of the default branch's three newest commits and the three newest pull requests' heads, by the app id GitHub's answer names, never a hard-coded one. A check two apps or a commit status reported, or no recent run reported, stays required from any source and is named; a read that fails or is cut short pins nothing; an existing pin is never changed; pinning a check already required from any source is a tightening applied only on the apply's yes. Grounds: GitHub's rulesets documentation says any person or integration with write access can set the state of any status check, and that a rule may name an app as a check's expected source (https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets); the rules REST API takes that source as a required check's optional integration_id (https://docs.github.com/en/rest/repos/rules); and push access is enough to post a commit status (https://docs.github.com/en/rest/commits/statuses). Assessed against abcd-fixes-what-it-adds: the any-source route is GitHub's default and exists without abcd, so this is hardening of a protection abcd writes, not a weakness it adds.
- itd-2610290746077716abcd audits and applies a repository's GitHub settings
- itd-2611011325430933A machine the person owns checks agents' work independently