Re: Protecting master branch on GitHub?
Peter Cock <[email protected]> Thu, 21 Sep 2017 11:18:06 +0100
| Newsgroups | gmane.comp.python.bio.devel |
|---|---|
| Message-ID | <CAKVJ-_4B3cJYM7TrO6XO0TRLE5J1Bm=V8d8foMEhFSvjOd_jZg@mail.gmail.com> |
--===============4551232087558619414== Content-Type: multipart/alternative; boundary="001a11497e3e8a3ee80559b068d5" --001a11497e3e8a3ee80559b068d5 Content-Type: text/plain; charset="UTF-8" Thank you everyone - including the off list replies, master branch protections are now live! I have deliberately NOT required the codecov checks to pass - the test coverage numbers have proved far too noisy to use as a simple yes/no check. Also since there are two AppVeyor entries, I may not have ticked the right one(s) - but initially the setup is as follows (see below). Question for later: Should we go further and require a pull request be reviewed prior to merging? See also: http://mailman.open-bio.org/pipermail/biopython-dev/2017-September/021871.html Regards, Peter -- Branch protection for *master* Protect this branchDisables force-pushes to this branch and prevents it from being deleted. Require pull request reviews before mergingWhen enabled, all commits must be made to a non-protected branch and submitted via a pull request with at least one approved review and no changes requested before it can be merged into master. Require status checks to pass before mergingChoose which status checks <https://developer.github.com/v3/repos/statuses/> must pass before branches can be merged into master. When enabled, commits must first be pushed to another branch, then merged or pushed directly to master after status checks have passed. Require branches to be up to date before mergingThis ensures the branch has been tested with the latest code on master. Status checks found in the last week for this repository codecov/patch codecov/project continuous-integration/appveyor/branch continuous-integration/appveyor/prRequired continuous-integration/travis-ciRequired Restrict who can push to this branchSpecify people or teams allowed to push to this branch. Required status checks will still prevent these people from merging if the checks fail. Include administratorsEnforce all configured restrictions for administrators. On Wed, Aug 30, 2017 at 11:24 PM, Christian Brueffer <[email protected]> wrote: > On 2017-08-24 12:34, Peter Cock wrote: > > On Wed, Nov 11, 2015 at 5:19 PM, Peter Cock <[email protected]> > wrote: > >> On Fri, Sep 4, 2015 at 11:20 AM, Peter Cock <[email protected]> > wrote: > >>> On Fri, Sep 4, 2015 at 10:07 AM, Christian Brueffer > >>> <[email protected]> wrote: > >>>> On 2015-09-04 11:02, Peter Cock wrote: > >>>>> > >>>>> Hi all, > >>>>> > >>>>> GitHub have rolled out some interesting new functionality: > >>>>> https://github.com/blog/2051-protected-branches-and- > required-status-checks > >>>>> > >>>>> The ability to protect the main branch should prevent any accidental > >>>>> rewriting of the history (from a forced push), which would cause > >>>>> widespread inconvenience now we have so many forks. I'd like to > >>>>> enable this if no one objects. > > > > We turned this on in November 2015. > > > >>>>> The second new feature would disable the web-GUI merge button > >>>>> until our TravisCI tests have passed. I usually do the merges at > >>>>> the command line anyway (sometimes rebasing, often to add a > >>>>> note to the NEWS and CONTRIB files), but again these seems like > >>>>> a sensible precaution? What do people think? > >> > >> ... > >> > >> Right now I have not enabled this higher level of protection, the > >> text for which reads: > >> > >> "Require status checks to pass before merging. > >> Choose which status checks must pass before branches can be > >> merged into master. When enabled, commits must first be pushed > >> to another branch, then merged or pushed directly to master after > >> status checks have passed." > > > > Many times we as a group have broken the builds on the master > > branch (TravisCI and/or AppVeyor tests were failing). This can > > cause work for each other, but worse it causes false-positives for > > testing pull requests which may deter new contributors. > > > > If anyone can push directly to the master branch this is all too > > easy to do, even a "harmless" edit can sometimes surprise us > > (e.g. fails a style check, or impacts a doctest), and I'm guilty of > > this too. > > > > How do people feel about changing our policy to say changes > > should all happen via pull requests (and take advantage of the > > GitHub settings to enforce this)? > > > > +1 from me, seems like a good idea. > > Chris > _______________________________________________ > Biopython-dev mailing list > [email protected] > http://mailman.open-bio.org/mailman/listinfo/biopython-dev > --001a11497e3e8a3ee80559b068d5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thank you everyone - including the off list replies,<div>m= aster branch protections are now live!</div><div><br></div><div>I have deli= berately NOT required the codecov checks</div><div>to pass - the test cover= age numbers have proved far</div><div>too noisy to use as a simple yes/no c= heck.</div><div><br></div><div>Also since there are two AppVeyor entries, I= may</div><div>not have ticked the right one(s) - but initially the</div><d= iv>setup is as follows (see below).</div><div><br></div><div>Question for l= ater: Should we go further and require</div><div>a pull request be reviewed= prior to merging? See also:</div><div><br></div><div><a href=3D"http://mai= lman.open-bio.org/pipermail/biopython-dev/2017-September/021871.html">http:= //mailman.open-bio.org/pipermail/biopython-dev/2017-September/021871.html</= a><br></div><div><br></div><div>Regards,</div><div><br></div><div>Peter</di= v><div><br></div><div>--</div><div><br></div><div><div class=3D"gmail-Subhe= ad" style=3D"box-sizing:border-box;display:flex;padding-bottom:8px;margin-b= ottom:16px;border-bottom:1px solid rgb(225,228,232);color:rgb(36,41,46);fon= t-family:-apple-system,system-ui,"Segoe UI",Helvetica,Arial,sans-= serif,"Apple Color Emoji","Segoe UI Emoji","Segoe = UI Symbol";font-size:14px"><h2 class=3D"gmail-Subhead-heading" style= =3D"box-sizing:border-box;margin-top:0px;margin-bottom:0px;font-size:24px;f= ont-weight:normal">Branch protection for<span>=C2=A0</span><strong style=3D= "box-sizing:border-box;font-weight:600">master</strong></h2><h2 class=3D"gm= ail-Subhead-heading" style=3D"box-sizing:border-box;margin-top:0px;margin-b= ottom:0px;font-size:24px;font-weight:normal"><div class=3D"gmail-Subhead" s= tyle=3D"box-sizing:border-box;display:flex;padding-bottom:8px;margin-bottom= :16px;border-bottom:1px solid rgb(225,228,232);font-size:14px"></div><div c= lass=3D"gmail-form-checkbox" style=3D"box-sizing:border-box;padding-left:20= px;margin:15px 0px;vertical-align:middle;font-size:14px"><label style=3D"bo= x-sizing:border-box;font-weight:600"><input type=3D"checkbox" name=3D"secur= e" class=3D"gmail-js-protect-branch" checked style=3D"font-style:inherit;fo= nt-variant:inherit;font-weight:inherit;font-stretch:inherit;font-size:inher= it;line-height:inherit;font-family:inherit;margin-top:4px;overflow:visible;= padding:0px;float:left;vertical-align:middle">Protect this branch</label><s= pan class=3D"gmail-note" style=3D"box-sizing:border-box;min-height:17px;mar= gin:0px;font-size:13px;color:rgb(88,96,105);display:block">Disables force-p= ushes to this branch and prevents it from being deleted.</span></div><div c= lass=3D"gmail-js-protected-branch-options gmail-js-toggler-container gmail-= protected-branch-options gmail-protected-branch-reviews gmail-active" style= =3D"box-sizing:border-box;margin-left:20px;opacity:1;font-size:14px"><div c= lass=3D"gmail-form-checkbox" style=3D"box-sizing:border-box;padding-left:20= px;margin:15px 0px;vertical-align:middle"><label style=3D"box-sizing:border= -box;font-weight:600"><input type=3D"checkbox" name=3D"has_required_reviews= " class=3D"gmail-js-protected-branch-option gmail-js-toggler-target" style= =3D"font-style:inherit;font-variant:inherit;font-weight:inherit;font-stretc= h:inherit;font-size:inherit;line-height:inherit;font-family:inherit;margin-= top:4px;overflow:visible;padding:0px;float:left;vertical-align:middle">Requ= ire pull request reviews before merging</label><span class=3D"gmail-note" s= tyle=3D"box-sizing:border-box;min-height:17px;margin:0px;font-size:13px;col= or:rgb(88,96,105);display:block">When enabled, all commits must be made to = a non-protected branch and submitted via a pull request with at least one a= pproved review and no changes requested before it can be merged into=C2=A0<= span style=3D"box-sizing:border-box;font-weight:600">master</span>.</span><= /div></div><div class=3D"gmail-js-protected-branch-options gmail-protected-= branch-options gmail-active" style=3D"box-sizing:border-box;margin-left:20p= x;opacity:1;font-size:14px"><div class=3D"gmail-form-checkbox" style=3D"box= -sizing:border-box;padding-left:20px;margin:15px 0px;vertical-align:middle"= ><label style=3D"box-sizing:border-box;font-weight:600"><input type=3D"chec= kbox" name=3D"has_required_statuses" class=3D"gmail-js-protected-branch-opt= ion gmail-js-required-status-toggle" checked style=3D"font-style:inherit;fo= nt-variant:inherit;font-weight:inherit;font-stretch:inherit;font-size:inher= it;line-height:inherit;font-family:inherit;margin-top:4px;overflow:visible;= padding:0px;float:left;vertical-align:middle">Require status checks to pass= before merging</label><span class=3D"gmail-note" style=3D"box-sizing:borde= r-box;min-height:17px;margin:0px;font-size:13px;color:rgb(88,96,105);displa= y:block">Choose which=C2=A0<a href=3D"https://developer.github.com/v3/repos= /statuses/" style=3D"box-sizing:border-box;background-color:transparent;col= or:rgb(3,102,214);text-decoration-line:none">status checks</a>=C2=A0must pa= ss before branches can be merged into=C2=A0<span style=3D"box-sizing:border= -box;font-weight:600">master</span>. When enabled, commits must first be pu= shed to another branch, then merged or pushed directly to=C2=A0<span style= =3D"box-sizing:border-box;font-weight:600">master</span>=C2=A0after status = checks have passed.</span><div class=3D"gmail-js-required-statuses" style= =3D"box-sizing:border-box"><div class=3D"gmail-form-checkbox" style=3D"box-= sizing:border-box;padding-left:20px;margin:15px 0px;vertical-align:middle">= <label style=3D"box-sizing:border-box;font-weight:600"><input type=3D"check= box" name=3D"strict_required_status_checks_policy" class=3D"gmail-js-protec= ted-branch-option" checked style=3D"font-style:inherit;font-variant:inherit= ;font-weight:inherit;font-stretch:inherit;font-size:inherit;line-height:inh= erit;font-family:inherit;margin-top:4px;overflow:visible;padding:0px;float:= left;vertical-align:middle">Require branches to be up to date before mergin= g</label><span class=3D"gmail-note" style=3D"box-sizing:border-box;min-heig= ht:17px;margin:0px;font-size:13px;color:rgb(88,96,105);display:block">This = ensures the branch has been tested with the latest code on=C2=A0<span style= =3D"box-sizing:border-box;font-weight:600">master</span>.</span></div><div = class=3D"gmail-listgroup gmail-listgroup-sm gmail-automated-check-options" = style=3D"box-sizing:border-box;list-style:none;border:1px solid rgb(229,229= ,229);border-radius:3px;margin-top:10px"><div class=3D"gmail-listgroup-item= gmail-listgroup-header" style=3D"box-sizing:border-box;line-height:26px;mi= n-height:inherit;padding:5px 10px;font-size:13px;color:rgb(88,96,105);borde= r-top:0px;border-bottom:1px solid rgb(229,229,229)">Status checks found in = the last week for this repository</div><div class=3D"gmail-listgroup-overfl= ow" style=3D"box-sizing:border-box;max-height:240px;overflow-y:auto;backgro= und-color:rgb(245,245,245)"><div class=3D"gmail-listgroup-item gmail-js-pro= tected-branches-item" style=3D"box-sizing:border-box;line-height:26px;min-h= eight:inherit;padding:5px 10px;font-size:13px;color:rgb(88,96,105)"><label = style=3D"box-sizing:border-box;font-weight:600;font-size:inherit"><input ty= pe=3D"checkbox" class=3D"gmail-js-required-status-checkbox" name=3D"context= s[]" value=3D"codecov/patch" style=3D"font-style:inherit;font-variant:inher= it;font-weight:inherit;font-stretch:inherit;font-size:inherit;line-height:i= nherit;font-family:inherit;margin-right:5px;overflow:visible;padding:0px;fl= oat:none;vertical-align:middle">=C2=A0codecov/patch</label></div><div class= =3D"gmail-listgroup-item gmail-js-protected-branches-item" style=3D"box-siz= ing:border-box;line-height:26px;min-height:inherit;padding:5px 10px;font-si= ze:13px;color:rgb(88,96,105);border-top:1px solid rgb(229,229,229)"><label = style=3D"box-sizing:border-box;font-weight:600;font-size:inherit"><input ty= pe=3D"checkbox" class=3D"gmail-js-required-status-checkbox" name=3D"context= s[]" value=3D"codecov/project" style=3D"font-style:inherit;font-variant:inh= erit;font-weight:inherit;font-stretch:inherit;font-size:inherit;line-height= :inherit;font-family:inherit;margin-right:5px;overflow:visible;padding:0px;= float:none;vertical-align:middle">=C2=A0codecov/project</label></div><div c= lass=3D"gmail-listgroup-item gmail-js-protected-branches-item" style=3D"box= -sizing:border-box;line-height:26px;min-height:inherit;padding:5px 10px;fon= t-size:13px;color:rgb(88,96,105);border-top:1px solid rgb(229,229,229)"><la= bel style=3D"box-sizing:border-box;font-weight:600;font-size:inherit"><inpu= t type=3D"checkbox" class=3D"gmail-js-required-status-checkbox" name=3D"con= texts[]" value=3D"continuous-integration/appveyor/branch" style=3D"font-sty= le:inherit;font-variant:inherit;font-weight:inherit;font-stretch:inherit;fo= nt-size:inherit;line-height:inherit;font-family:inherit;margin-right:5px;ov= erflow:visible;padding:0px;float:none;vertical-align:middle">=C2=A0continuo= us-integration/appveyor/branch</label></div><div class=3D"gmail-listgroup-i= tem gmail-js-protected-branches-item" style=3D"box-sizing:border-box;line-h= eight:26px;min-height:inherit;padding:5px 10px;font-size:13px;color:rgb(88,= 96,105);border-top:1px solid rgb(229,229,229)"><label style=3D"box-sizing:b= order-box;font-weight:600;font-size:inherit"><input type=3D"checkbox" class= =3D"gmail-js-required-status-checkbox" name=3D"contexts[]" value=3D"continu= ous-integration/appveyor/pr" checked style=3D"font-style:inherit;font-varia= nt:inherit;font-weight:inherit;font-stretch:inherit;font-size:inherit;line-= height:inherit;font-family:inherit;margin-right:5px;overflow:visible;paddin= g:0px;float:none;vertical-align:middle">=C2=A0continuous-integration/appvey= or/pr<span class=3D"gmail-label gmail-Label--gray-darker gmail-float-right = gmail-js-required-status-badge" style=3D"box-sizing:border-box;display:inli= ne-block;padding:3px 4px;font-size:12px;line-height:1;color:rgb(255,255,255= );border-radius:2px;background-color:rgb(106,115,125);margin-top:4px;float:= right">Required</span></label></div><div class=3D"gmail-listgroup-item gmai= l-js-protected-branches-item" style=3D"box-sizing:border-box;line-height:26= px;min-height:inherit;padding:5px 10px;font-size:13px;color:rgb(88,96,105);= border-top:1px solid rgb(229,229,229)"><label style=3D"box-sizing:border-bo= x;font-weight:600;font-size:inherit"><input type=3D"checkbox" class=3D"gmai= l-js-required-status-checkbox" name=3D"contexts[]" value=3D"continuous-inte= gration/travis-ci" checked style=3D"font-style:inherit;font-variant:inherit= ;font-weight:inherit;font-stretch:inherit;font-size:inherit;line-height:inh= erit;font-family:inherit;margin-right:5px;overflow:visible;padding:0px;floa= t:none;vertical-align:middle">=C2=A0continuous-integration/travis-ci<span c= lass=3D"gmail-label gmail-Label--gray-darker gmail-float-right gmail-js-req= uired-status-badge" style=3D"box-sizing:border-box;display:inline-block;pad= ding:3px 4px;font-size:12px;line-height:1;color:rgb(255,255,255);border-rad= ius:2px;background-color:rgb(106,115,125);margin-top:4px;float:right">Requi= red</span></label></div></div></div></div></div></div><dl class=3D"gmail-fo= rm-group gmail-js-protected-branch-options gmail-protected-branch-options g= mail-form-checkbox gmail-active" style=3D"box-sizing:border-box;padding-lef= t:20px;margin:15px 0px 15px 20px;vertical-align:middle;opacity:1;font-size:= 14px"><dt style=3D"box-sizing:border-box;margin:0px 0px 6px"><label style= =3D"box-sizing:border-box;font-weight:600"><input type=3D"checkbox" name=3D= "authorized_users_or_teams" class=3D"gmail-js-protected-branch-option gmail= -js-authorized-branch-pushers-toggle" style=3D"font-style:inherit;font-vari= ant:inherit;font-weight:inherit;font-stretch:inherit;font-size:inherit;line= -height:inherit;font-family:inherit;margin-top:4px;overflow:visible;padding= :0px;float:left;vertical-align:middle">Restrict who can push to this branch= </label><span class=3D"gmail-note" style=3D"box-sizing:border-box;min-heigh= t:17px;margin:0px;font-size:13px;color:rgb(88,96,105);display:block">Specif= y people or teams allowed to push to this branch. Required status checks wi= ll still prevent these people from merging if the checks fail.</span></dt><= /dl><div class=3D"gmail-js-protected-branch-options gmail-js-toggler-contai= ner gmail-protected-branch-options gmail-active" style=3D"box-sizing:border= -box;margin-left:20px;opacity:1;font-size:14px"><div class=3D"gmail-form-ch= eckbox" style=3D"box-sizing:border-box;padding-left:20px;margin:15px 0px;ve= rtical-align:middle"><label style=3D"box-sizing:border-box;font-weight:600"= ><input type=3D"checkbox" name=3D"enforce_all_for_admins" class=3D"gmail-js= -protected-branch-option gmail-js-protected-branch-include-admin-toggle" ch= ecked style=3D"font-style:inherit;font-variant:inherit;font-weight:inherit;= font-stretch:inherit;font-size:inherit;line-height:inherit;font-family:inhe= rit;margin-top:4px;overflow:visible;padding:0px;float:left;vertical-align:m= iddle">Include administrators</label><span class=3D"gmail-note" style=3D"bo= x-sizing:border-box;min-height:17px;margin:0px;font-size:13px;color:rgb(88,= 96,105);display:block">Enforce all configured restrictions for administrato= rs.</span></div></div><br></h2></div></div></div><div class=3D"gmail_extra"= ><br><div class=3D"gmail_quote">On Wed, Aug 30, 2017 at 11:24 PM, Christian= Brueffer <span dir=3D"ltr"><<a href=3D"mailto:[email protected]" ta= rget=3D"_blank">[email protected]</a>></span> wrote:<br><blockquote = class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid= ;padding-left:1ex"><div class=3D"HOEnZb"><div class=3D"h5">On 2017-08-24 12= :34, Peter Cock wrote:<br> > On Wed, Nov 11, 2015 at 5:19 PM, Peter Cock <<a href=3D"mailto:p.j.= [email protected]">[email protected]</a>> wrote:<br> >> On Fri, Sep 4, 2015 at 11:20 AM, Peter Cock <<a href=3D"mailto:= [email protected]">[email protected]</a>> wrote:<br> >>> On Fri, Sep 4, 2015 at 10:07 AM, Christian Brueffer<br> >>> <<a href=3D"mailto:[email protected]">christian@brueffe= r.de</a>> wrote:<br> >>>> On 2015-09-04 11:02, Peter Cock wrote:<br> >>>>><br> >>>>> Hi all,<br> >>>>><br> >>>>> GitHub have rolled out some interesting new functional= ity:<br> >>>>> <a href=3D"https://github.com/blog/2051-protected-bran= ches-and-required-status-checks" rel=3D"noreferrer" target=3D"_blank">https= ://github.com/blog/2051-<wbr>protected-branches-and-<wbr>required-status-ch= ecks</a><br> >>>>><br> >>>>> The ability to protect the main branch should prevent = any accidental<br> >>>>> rewriting of the history (from a forced push), which w= ould cause<br> >>>>> widespread inconvenience now we have so many forks. I&= #39;d like to<br> >>>>> enable this if no one objects.<br> ><br> > We turned this on in November 2015.<br> ><br> >>>>> The second new feature would disable the web-GUI merge= button<br> >>>>> until our TravisCI tests have passed. I usually do the= merges at<br> >>>>> the command line anyway (sometimes rebasing, often to = add a<br> >>>>> note to the NEWS and CONTRIB files), but again these s= eems like<br> >>>>> a sensible precaution? What do people think?<br> >><br> >> ...<br> >><br> >> Right now I have not enabled this higher level of protection, the<= br> >> text for which reads:<br> >><br> >> "Require status checks to pass before merging.<br> >> Choose which status checks must pass before branches can be<br> >> merged into master. When enabled, commits must first be pushed<br> >> to another branch, then merged or pushed directly to master after<= br> >> status checks have passed."<br> ><br> > Many times we as a group have broken the builds on the master<br> > branch (TravisCI and/or AppVeyor tests were failing). This can<br> > cause work for each other, but worse it causes false-positives for<br> > testing pull requests which may deter new contributors.<br> ><br> > If anyone can push directly to the master branch this is all too<br> > easy to do, even a "harmless" edit can sometimes surprise us= <br> > (e.g. fails a style check, or impacts a doctest), and I'm guilty o= f<br> > this too.<br> ><br> > How do people feel about changing our policy to say changes<br> > should all happen via pull requests (and take advantage of the<br> > GitHub settings to enforce this)?<br> ><br> <br> </div></div>+1 from me, seems like a good idea.<br> <div class=3D"HOEnZb"><div class=3D"h5"><br> Chris<br> ______________________________<wbr>_________________<br> Biopython-dev mailing list<br> <a href=3D"mailto:[email protected]">Biopython-dev@mailman= .open-<wbr>bio.org</a><br> <a href=3D"http://mailman.open-bio.org/mailman/listinfo/biopython-dev" rel= =3D"noreferrer" target=3D"_blank">http://mailman.open-bio.org/<wbr>mailman/= listinfo/biopython-dev</a><br> </div></div></blockquote></div><br></div> --001a11497e3e8a3ee80559b068d5-- --===============4551232087558619414== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Biopython-dev mailing list [email protected] http://mailman.open-bio.org/mailman/listinfo/biopython-dev --===============4551232087558619414==--