Skip to content

Commit f3b8962

Browse files
adrian207adrian207
committed
feat: Add manual branch protection setup guide and CODEOWNERS
- Add BRANCH-PROTECTION-SETUP.md with step-by-step manual configuration - Add .github/CODEOWNERS file to define code ownership rules - Add setup-branch-protection.sh script for GitHub CLI automation - Provide alternative setup methods since repository rulesets are not available - Include troubleshooting guide for common issues
1 parent b293e54 commit f3b8962

File tree

3 files changed

+180
-0
lines changed

3 files changed

+180
-0
lines changed

‎EJBCA---Automated-Lab-Docker/.github/CODEOWNERS‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Global owners - all files require review from these users
2+
* @adrian207
3+
4+
# Terraform files require additional review
5+
/terraform/ @adrian207
6+
7+
# Security-sensitive files require extra scrutiny
8+
**/*secret* @adrian207
9+
**/*key* @adrian207
10+
**/*password* @adrian207
11+
**/*credential* @adrian207
12+
**/*token* @adrian207
13+
**/*auth* @adrian207
14+
15+
# Infrastructure configuration files
16+
/kubernetes/ @adrian207
17+
/helm/ @adrian207
18+
/argocd/ @adrian207
19+
20+
# CI/CD configuration
21+
/.github/workflows/ @adrian207
22+
/.github/ @adrian207
23+
24+
# Documentation
25+
/docs/ @adrian207
26+
*.md @adrian207
27+
28+
# Configuration files
29+
/configs/ @adrian207
30+
/ansible/ @adrian207
31+
32+
# Scripts
33+
/scripts/ @adrian207

‎EJBCA---Automated-Lab-Docker/BRANCH-PROTECTION-SETUP.md‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# GitHub Branch Protection Setup Guide
2+
3+
## 🛡️ Manual Branch Protection Setup
4+
5+
Since GitHub repository rulesets are not available for your repository, follow these steps to manually configure branch protection:
6+
7+
### Step 1: Navigate to Branch Protection Settings
8+
1. Go to: `https://github.com/adrian207/EJBCA---Automated-Lab/settings/branches`
9+
2. Click **"Add rule"**
10+
11+
### Step 2: Configure Main Branch Protection
12+
**Branch name pattern:** `main`
13+
14+
**Enable these options:**
15+
- ✅ **Require a pull request before merging**
16+
- ✅ **Require approvals:** `2`
17+
- ✅ **Dismiss stale PR approvals when new commits are pushed**
18+
- ✅ **Require review from code owners**
19+
20+
- ✅ **Require status checks to pass before merging**
21+
- ✅ **Require branches to be up to date before merging**
22+
- **Status checks to require:**
23+
- `branch-protection-check`
24+
- `terraform-validate`
25+
- `security-scanning`
26+
- `kubernetes-deploy`
27+
- `ansible-lint`
28+
29+
- ✅ **Require conversation resolution before merging**
30+
- ✅ **Require signed commits**
31+
- ✅ **Require linear history**
32+
- ✅ **Do not allow force pushes**
33+
- ✅ **Do not allow deletions**
34+
35+
### Step 3: Create CODEOWNERS File
36+
Create a `.github/CODEOWNERS` file to define who can approve changes:
37+
38+
```
39+
# Global owners
40+
* @adrian207
41+
42+
# Terraform files require additional review
43+
/terraform/ @adrian207
44+
45+
# Security-sensitive files
46+
**/*secret* @adrian207
47+
**/*key* @adrian207
48+
**/*password* @adrian207
49+
**/*credential* @adrian207
50+
51+
# Documentation
52+
/docs/ @adrian207
53+
*.md @adrian207
54+
```
55+
56+
### Step 4: Test the Protection
57+
After enabling branch protection:
58+
1. Try to push directly to main - it should be blocked
59+
2. Create a pull request instead
60+
3. Verify that status checks are required
61+
62+
## 🔧 Alternative: Use GitHub CLI
63+
64+
If you have GitHub CLI installed, you can use this command:
65+
66+
```bash
67+
gh api repos/adrian207/EJBCA---Automated-Lab/branches/main/protection \
68+
--method PUT \
69+
--field required_status_checks='{"strict":true,"contexts":["branch-protection-check","terraform-validate","security-scanning","kubernetes-deploy","ansible-lint"]}' \
70+
--field enforce_admins=true \
71+
--field required_pull_request_reviews='{"required_approving_review_count":2,"dismiss_stale_reviews":true,"require_code_owner_reviews":true}' \
72+
--field restrictions=null
73+
```
74+
75+
## 📋 Status Check Requirements
76+
77+
Make sure these GitHub Actions workflows are enabled:
78+
- `branch-protection-check` ✅ (Already created)
79+
- `terraform-validate` ✅ (Already exists)
80+
- `security-scanning` ✅ (Already exists)
81+
- `kubernetes-deploy` ✅ (Already exists)
82+
- `ansible-lint` ✅ (Already exists)
83+
84+
## 🚨 Troubleshooting
85+
86+
**If status checks don't appear:**
87+
1. Make sure the GitHub Actions workflows are enabled
88+
2. Run the workflows manually to generate status check names
89+
3. Check that workflows are in `.github/workflows/` directory
90+
91+
**If CODEOWNERS doesn't work:**
92+
1. Make sure the file is in `.github/CODEOWNERS`
93+
2. Verify the usernames are correct
94+
3. Check that users have write access to the repository

‎EJBCA---Automated-Lab-Docker/scripts/setup-branch-protection.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/bash
2+
3+
# GitHub Branch Protection Setup Script
4+
# This script sets up branch protection for the main branch
5+
6+
echo "🛡️ Setting up GitHub branch protection for main branch..."
7+
8+
# Check if GitHub CLI is installed
9+
if ! command -v gh &> /dev/null; then
10+
echo "❌ GitHub CLI (gh) is not installed."
11+
echo "Please install it from: https://cli.github.com/"
12+
echo "Or follow the manual setup guide in BRANCH-PROTECTION-SETUP.md"
13+
exit 1
14+
fi
15+
16+
# Check if user is authenticated
17+
if ! gh auth status &> /dev/null; then
18+
echo "❌ Not authenticated with GitHub CLI."
19+
echo "Please run: gh auth login"
20+
exit 1
21+
fi
22+
23+
echo "✅ GitHub CLI is installed and authenticated"
24+
25+
# Set up branch protection for main branch
26+
echo "🔧 Configuring branch protection rules..."
27+
28+
gh api repos/adrian207/EJBCA---Automated-Lab/branches/main/protection \
29+
--method PUT \
30+
--field required_status_checks='{"strict":true,"contexts":["branch-protection-check","terraform-validate","security-scanning","kubernetes-deploy","ansible-lint"]}' \
31+
--field enforce_admins=true \
32+
--field required_pull_request_reviews='{"required_approving_review_count":2,"dismiss_stale_reviews":true,"require_code_owner_reviews":true,"require_last_push_approval":true}' \
33+
--field restrictions=null \
34+
--field required_linear_history=true \
35+
--field allow_force_pushes=false \
36+
--field allow_deletions=false
37+
38+
if [ $? -eq 0 ]; then
39+
echo "✅ Branch protection successfully configured!"
40+
echo ""
41+
echo "📋 Protection rules enabled:"
42+
echo " - Requires pull request before merging"
43+
echo " - Requires 2 approvals"
44+
echo " - Requires status checks to pass"
45+
echo " - Requires code owner reviews"
46+
echo " - Requires linear history"
47+
echo " - Blocks force pushes and deletions"
48+
echo ""
49+
echo "🧪 Test the protection by trying to push directly to main"
50+
else
51+
echo "❌ Failed to configure branch protection"
52+
echo "Please check your permissions and try the manual setup"
53+
fi

0 commit comments

Comments
 (0)