Repository navigation
Add automatic protected policy selection for MR reviews - #266
Merged
Merged
Conversation
Record issue #265 as inactive BL-025 with explicit authorization, coverage alternatives, graph shapes, scope limits, and future validation. Align the roadmap without activating runtime behavior or release scope.
xeonvs
marked this pull request as ready for review
October 23, 2026 12:52
This was referenced Oct 23, 2026
Merged
xeonvs
added a commit
that referenced
this pull request
Oct 23, 2026
## Release authorization Stable version: 0.13.0. Tracked release issue: #264. The release workflow owns its issue state after the immutable receipt is read back. Planning issue #265 was completed with the feature PR and is not in this release issue set. This PR advances the stable and next version markers to 0.13.0 and 0.14.0, records source epoch `1792761040` and the exact issue set, renders the Towncrier section, and updates the checksum-pinned GitLab example. It archives the complete repository plan and returns `PLANS.md` to its inactive state. External publication and readback remain pending in the archive's Post-Close Delivery section. ## Reviewed input - Protected feature PR #266 merged as signed `24b0ba096672c711005ead2f9ddd47e3d557e4d9`; its tree equals the reviewed feature head `dc62581675d7cf99e0463b78876d3eddbe00a923`. - TestPyPI development run `39959060145` published and verified `0.13.0.dev122` wheel and sdist. Independent registry readback found both files and their SHA-256 digests. - Local release preparation: 108 focused tests passed; plan lifecycle, instruction contract, documentation navigation, Ruff, local dependency audit, staged/tree/history Gitleaks, and Twine passed. Two source-epoch-controlled builds produced identical wheel and sdist bytes. - The first release PR matrix identified a stale `docs/configuration.md` example version. The same release commit now corrects it and records a release-preparation guard; 114 focused environment, release, documentation and integration tests passed. The amended head awaits the protected matrix. - The release notes are the exact new 0.13.0 Towncrier section followed by the adjacent `v0.12.1...v0.13.0` comparison link. ## After merge The protected Release workflow must authorize the exact reviewed tree, publish and verify stable registry artifacts, provenance, the annotated tag, immutable GitHub Release and receipt, then update the tracked issue. Independent external and site readback follow without another repository PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
autoselects the protected policy authority for a single GitLab MR while keeping the actual code target, diff base, source, and policy commit distinct. Existing explicit modes and local review remain supported.Safety and behavior
The review, receipt v11, publication, and approval paths bind the authenticated MR and CI job identity. They reject synthetic merged-result or merge-train commits, stale code or authority, and contradictory legacy results. An unprotected actual target cannot receive automatic approval. Protected policy movement is accepted only when bounded Git ancestry proves a fast-forward from the captured policy commit. Local private diagnostics retain marked non-postable JSON while reporting only admitted findings.
Verification
opentelemetry-api1.44.0. The resolver floor and lock now require 1.45.1; the new shared local/CI audit passes with no known vulnerabilities. The isolated audit preserves the active environment and uses CI-pinned uv 0.13.4. Fifty-one focused workflow/documentation tests andpip checkpass; PR CI reruns the full matrix on this final head.Delivery
This feature PR precedes the deterministic TestPyPI development artifact and the protected v0.13.0 release PR. The release PR will archive the complete plan and reset
PLANS.md; publication, immutable receipt, tracked issue closure, and site readback follow the protected release workflow. Only #264 belongs to the v0.13.0 release issue set.