From 0284fce107fc6de432ad296d012b9df094280d3d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Padilla=20Vega=20=28m=CC=B5=CD=8A=CD=9Cx=CC=B5?= =?UTF-8?q?=CC=8D=CD=9B=CD=86=CC=8C=CD=83=CC=9B=CC=94=CC=9B=CD=92=CD=9D?= =?UTF-8?q?=CD=82=CD=8B=CC=84=CC=9A=CD=96W=CC=B6=CD=91=CC=AF=CD=85=CD=9C?= =?UTF-8?q?=CC=A4=CC=A7=CC=A0=CC=A3=CC=A8=CC=A8=CD=93=CD=96=CC=B1=CD=99?= =?UTF-8?q?=CD=99o=CC=B7=CC=89=CC=9A=CC=8C=CC=8E=CC=86=CC=BF=CC=94=CD=91?= =?UTF-8?q?=CD=8C=CC=94=CC=92=CC=94=CD=9B=CD=80=CD=86=CC=B1=CC=AC=CD=9A?= =?UTF-8?q?=CC=9E=CC=ACl=CC=B5=CC=94=CC=85=CD=86=CD=94=CC=BA=CD=8E=CC=A2?= =?UTF-8?q?=CC=AD=CC=A8=CC=9Df=CC=B5=CC=86=CC=80=CC=BF=CD=8B=CC=86=CC=85?= =?UTF-8?q?=CD=8A=CD=9D=CC=87=CC=BE=CD=8A=CD=81=CD=89=CD=94=CD=8D=CC=AC?= =?UTF-8?q?=CD=95=CD=89=CD=99=CC=B9=CD=88=CC=98=CD=88=29?= Date: Tue, 16 Jun 2026 14:51:49 -0700 Subject: [PATCH 1/2] chore(hooks): drop no-commit-to-branch guard for main/master The no-commit-to-branch hook blocked direct commits to main/master. It runs on every machine where the pre-commit hooks are installed, including CI/CD agents that check out and commit on those branches (e.g. release automation, version bumps, or pipelines that commit back to main). There it can fail the run or block legitimate automated commits. Remove the hook from .pre-commit-config.yaml and all references to it in the README (the Hooks included entry and the direct-commit guard note). --- .pre-commit-config.yaml | 5 ----- README.md | 22 +--------------------- 2 files changed, 1 insertion(+), 26 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 74fc41a..883124d 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -39,11 +39,6 @@ repos: - id: detect-private-key - id: fix-byte-order-marker - id: mixed-line-ending - - id: no-commit-to-branch - # Block direct commits to the mainline; changes must go through a - # branch + PR. Protects `main` and `master` by default; both are - # listed explicitly so the policy is obvious and rename-proof. - args: [--branch, main, --branch, master] - repo: https://github.com/gitleaks/gitleaks rev: v8.30.1 # Specify the desired version of Gitleaks hooks: diff --git a/README.md b/README.md index a2f9566..1ccdd45 100644 --- a/README.md +++ b/README.md @@ -75,9 +75,7 @@ Run `make help` (or just `make`) to list the available targets. large-file guard (blocks files over 500 kB by default), case-conflict detection (catches filename collisions on case-insensitive filesystems like macOS/Windows), illegal Windows names, merge-conflict markers, private-key - detection, byte-order-marker fix, mixed line endings, and a - **direct-commit guard** (`no-commit-to-branch`) that blocks committing - straight to `main`/`master` so changes go through a branch + PR. + detection, byte-order-marker fix, and mixed line endings. - **gitleaks**: scans for hardcoded secrets. - **commitizen** (`commit-msg` stage): validates commit messages follow the Conventional Commits format, e.g.: @@ -88,24 +86,6 @@ Run `make help` (or just `make`) to list the available targets. ``` - **sync-pre-commit-deps**: keeps hook dependency versions in sync. -> **Note — the direct-commit guard is a local convenience, not enforcement.** -> `no-commit-to-branch` only runs on machines where the hooks are installed -> (`make setup`) and can be bypassed with `git commit --no-verify`. It does -> nothing on the server. For real enforcement, pair it with a server-side -> branch policy: -> -> - **GitHub**: a [branch protection rule](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) -> (or ruleset) on `main` — require pull requests, block direct pushes, and -> require the `ci` status check to pass. This can be configured directly in -> the repository's **Settings → Branches**, and codified as a -> [ruleset](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets). -> - **Azure DevOps**: a [branch policy](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops) -> on `main` (require a PR, minimum reviewers, build validation). Azure Repos -> branch policies are **not** stored in the repository — they are -> project/repo settings applied through the Azure DevOps UI or REST API, so -> they can't be committed as a file in this template the way a GitHub ruleset -> can. - ## CI/CD integration This template is designed so that wiring it into **any** CI/CD platform is From cd32b21cfd4dc952a44d66a4fc86851475e03d5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Padilla=20Vega=20=28m=CC=B5=CD=8A=CD=9Cx=CC=B5?= =?UTF-8?q?=CC=8D=CD=9B=CD=86=CC=8C=CD=83=CC=9B=CC=94=CC=9B=CD=92=CD=9D?= =?UTF-8?q?=CD=82=CD=8B=CC=84=CC=9A=CD=96W=CC=B6=CD=91=CC=AF=CD=85=CD=9C?= =?UTF-8?q?=CC=A4=CC=A7=CC=A0=CC=A3=CC=A8=CC=A8=CD=93=CD=96=CC=B1=CD=99?= =?UTF-8?q?=CD=99o=CC=B7=CC=89=CC=9A=CC=8C=CC=8E=CC=86=CC=BF=CC=94=CD=91?= =?UTF-8?q?=CD=8C=CC=94=CC=92=CC=94=CD=9B=CD=80=CD=86=CC=B1=CC=AC=CD=9A?= =?UTF-8?q?=CC=9E=CC=ACl=CC=B5=CC=94=CC=85=CD=86=CD=94=CC=BA=CD=8E=CC=A2?= =?UTF-8?q?=CC=AD=CC=A8=CC=9Df=CC=B5=CC=86=CC=80=CC=BF=CD=8B=CC=86=CC=85?= =?UTF-8?q?=CD=8A=CD=9D=CC=87=CC=BE=CD=8A=CD=81=CD=89=CD=94=CD=8D=CC=AC?= =?UTF-8?q?=CD=95=CD=89=CD=99=CC=B9=CD=88=CC=98=CD=88=29?= Date: Tue, 16 Jun 2026 14:56:17 -0700 Subject: [PATCH 2/2] ci: trigger on main and develop pushes and develop PRs Run CI on pushes to main and develop, and on pull requests targeting develop, across both the GitHub Actions and Azure DevOps stubs. Update the README to document the configured triggers. --- .github/workflows/ci.yml | 3 ++- README.md | 8 +++++++- azure-pipelines.yml | 3 ++- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6f0dc5c..cc99546 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,8 +18,9 @@ name: ci on: push: - branches: [main] + branches: [main, develop] pull_request: + branches: [develop] jobs: ci: diff --git a/README.md b/README.md index 1ccdd45..db10b4f 100644 --- a/README.md +++ b/README.md @@ -142,7 +142,13 @@ portable script: DevOps needs `azure-pipelines.yml`. The template ships both, pre-wired to `make ci`. - **Triggers** (which branches/events run CI) — expressed differently on each - platform. + platform. Both stubs ship pre-configured to run CI on: + - **pushes** to `main` and `develop`, and + - **pull requests** targeting `develop`. + + Adjust the `on`/`trigger`/`pr` sections in + [`.github/workflows/ci.yml`](.github/workflows/ci.yml) and + [`azure-pipelines.yml`](azure-pipelines.yml) to change this. - **Secrets, service connections, OIDC, and permissions** — managed in each platform's settings/YAML, never in the repo. - **Runner/agent image** and **prerequisite installation** (Python, diff --git a/azure-pipelines.yml b/azure-pipelines.yml index a132d3f..e0e1615 100644 --- a/azure-pipelines.yml +++ b/azure-pipelines.yml @@ -20,11 +20,12 @@ trigger: branches: include: - main + - develop pr: branches: include: - - "*" + - develop pool: vmImage: ubuntu-latest