From 3488fe6cbb1e4cfc4425587d8d8a577bcae88009 Mon Sep 17 00:00:00 2001 From: Syed Awsaf Date: Fri, 6 Nov 2026 11:51:18 +0000 Subject: [PATCH 1/3] docs(OSPO): link central governance badges --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index a0f5c8e..e6cbc23 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +![OSPO compliance](https://raw.githubusercontent.com/National-Node-Net/ndt-overwatch/sync/governance-badges/repositories/node-lib/ospo-compliance.svg) ![Develop activity](https://raw.githubusercontent.com/National-Node-Net/ndt-overwatch/sync/governance-badges/repositories/node-lib/develop-activity.svg) ![Last checked](https://raw.githubusercontent.com/National-Node-Net/ndt-overwatch/sync/governance-badges/repositories/node-lib/last-checked.svg) + # README **Repository:** `node-lib` From 306dc8424059cefeeb00a15a0bba875e4e8d1df7 Mon Sep 17 00:00:00 2001 From: syed-awsaf-informed <197770623+syed-awsaf-informed@users.noreply.github.com> Date: Fri, 6 Nov 2026 12:13:01 +0000 Subject: [PATCH 2/3] feat(OSPO): synchronise OSPO workflows --- .../auto-merge-dependabot-pull-requests.yml | 8 ++++---- .github/workflows/oss-checker.yml | 13 +++++++++++-- .github/workflows/stale-pr-alerts.yml | 6 +++--- 3 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.github/workflows/auto-merge-dependabot-pull-requests.yml b/.github/workflows/auto-merge-dependabot-pull-requests.yml index 47b159f..5828593 100644 --- a/.github/workflows/auto-merge-dependabot-pull-requests.yml +++ b/.github/workflows/auto-merge-dependabot-pull-requests.yml @@ -4,7 +4,7 @@ # Prerequisites: # - Configure Dependabot for the github-actions ecosystem in .github/dependabot.yml. -# - Enable "Allow auto-merge" and "Allow squash merging" in repository settings. +# - Enable "Allow auto-merge" and "Allow merge commits" in repository settings. # - Grant access to the OSPO GitHub App for this repository with Contents and Pull requests # permissions set to Read and write, and approve any installation permission updates. # - Provide OSPO_WORKFLOW_APP_ID and OSPO_WORKFLOW_PRIVATE_KEY as Dependabot secrets @@ -35,7 +35,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ github.token }} @@ -85,9 +85,9 @@ jobs: run: gh pr review "$PR_NUMBER" --approve # GitHub waits for required checks and any remaining review requirements. - # No ruleset bypass is needed for a standard one-approval requirement. + # GitFlow main rules require merge commits rather than squash merges. - name: Enable auto-merge for the pull request if: steps.metadata.outputs.package-ecosystem == 'github_actions' && steps.repository.outputs.enabled == 'true' env: GH_TOKEN: ${{ steps.target_token.outputs.token }} - run: gh pr merge "$PR_NUMBER" --auto --squash --match-head-commit "$HEAD_SHA" + run: gh pr merge "$PR_NUMBER" --auto --merge --match-head-commit "$HEAD_SHA" diff --git a/.github/workflows/oss-checker.yml b/.github/workflows/oss-checker.yml index bd3bcae..e52aa6c 100644 --- a/.github/workflows/oss-checker.yml +++ b/.github/workflows/oss-checker.yml @@ -91,7 +91,8 @@ jobs: const metadata = { repository: { defaultBranch: process.env.DEFAULT_BRANCH, - hasDevelopBranch: hasDevelopBranch + hasDevelopBranch: hasDevelopBranch, + repositoryName: repo, } }; @@ -133,7 +134,15 @@ jobs: -p ospo-resources/tools/policy-as-code/policy \ --data repository-metadata.json \ --namespace github.dependabot \ - --output json > policy-report.json || true + --output json > dependabot-policy-report.json || true + # Enforce GitFlow branch requirements independently of Dependabot configuration. + conftest test repository-metadata.json \ + -p ospo-resources/tools/policy-as-code/policy \ + --data repository-metadata.json \ + --namespace github.repository \ + --output json > repository-policy-report.json || true + # Preserve failures from both policy namespaces in the existing summary. + jq -s 'add' dependabot-policy-report.json repository-policy-report.json > policy-report.json - name: Process Policy Results uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 diff --git a/.github/workflows/stale-pr-alerts.yml b/.github/workflows/stale-pr-alerts.yml index cd58d9c..987e276 100644 --- a/.github/workflows/stale-pr-alerts.yml +++ b/.github/workflows/stale-pr-alerts.yml @@ -5,7 +5,7 @@ name: Stale Dependabot PR alerts on: schedule: - - cron: '35 14 * * *' # Temporary pilot schedule; restore 08:23 UTC after testing. + - cron: '23 8 * * *' workflow_dispatch: inputs: days_before_stale: @@ -22,7 +22,7 @@ concurrency: jobs: stale-pr-alerts: - runs-on: ubuntu-latest + runs-on: ubuntu-26.04 timeout-minutes: 15 steps: - name: Check open Dependabot pull requests @@ -132,4 +132,4 @@ jobs: output.write(summary) print(summary) sys.exit(1 if failed else 0) - PY + PY \ No newline at end of file From 338ea413e416019d5e358c4da3010dd27736c096 Mon Sep 17 00:00:00 2001 From: Syed Awsaf Date: Mon, 9 Nov 2026 09:54:26 +0000 Subject: [PATCH 3/3] chore(OSPO): refresh governance checks