From 5dd809a11987172c177c08af9a300d79a5957875 Mon Sep 17 00:00:00 2001 From: TGPSKI Date: Tue, 4 Aug 2026 19:31:19 -0700 Subject: [PATCH] tag rulesets: restore non_fast_forward Copying conceit's release-tags-immutable dropped non_fast_forward, which directed-contexts and security-context-spec both had before. That is a straight downgrade to tag protection: without it a tag can be moved by force-push, which is exactly what an immutable release tag exists to prevent. Added to every tag ruleset here so no repo is weaker than it was, and so the rule is uniform rather than depending on which repo the definition was copied from. Note: conceit's own tag ruleset still lacks it. --- .github/rulesets/ruleset-prereg-tags-immutable.json | 3 +++ .github/rulesets/ruleset-release-tags-immutable.json | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/rulesets/ruleset-prereg-tags-immutable.json b/.github/rulesets/ruleset-prereg-tags-immutable.json index 7ef8cdf..a72ac32 100644 --- a/.github/rulesets/ruleset-prereg-tags-immutable.json +++ b/.github/rulesets/ruleset-prereg-tags-immutable.json @@ -19,6 +19,9 @@ }, { "type": "required_signatures" + }, + { + "type": "non_fast_forward" } ], "bypass_actors": [ diff --git a/.github/rulesets/ruleset-release-tags-immutable.json b/.github/rulesets/ruleset-release-tags-immutable.json index 86f0145..ad68e91 100644 --- a/.github/rulesets/ruleset-release-tags-immutable.json +++ b/.github/rulesets/ruleset-release-tags-immutable.json @@ -26,6 +26,9 @@ }, { "type": "required_signatures" + }, + { + "type": "non_fast_forward" } ] }