Silverstripe-framework: RFC-9345 Protect major and minor branches from force pushing

[dnsl48]

The suggestion is to protect all _major_ (\d) and _minor_ (\d.\d) branches on every repository from force-pushing as a best-practice.

I suggest we use the following fnmatch pattern for that: [0-9]*.
That would include every branch starting with a digit.

Here is how it might look like:

Another rule worth having is for master branch.

TODO:

• [ ] master
• [ ] [0-9]*

[dnsl48]

/cc @silverstripe/core-team

[ScopeyNZ]

I don't really think we need an RFC for this tbh. Just do it. All the core team has the ability to get around this if we somehow need it.

[robbieaverill]

Agreed, ship it. We should never be force pushing upstream anyway.

[dnsl48]

I don't really think we need an RFC for this tbh. Just do it.

Well, that's also a way to share some knowledge with the team about such things happening.

[chillu]

Yep, I've asked for a short RFC specifically. We should have a track record of decisions made, and Github allows for easy votes via reactions. Happy to put this into forum.silverstripe.org if core committers see it there, but in terms of "project governance decisions" it fragments the knowledge a bit (best kept on Github IMHO)

[sminnee]

Yeah I think this is a good idea and I agree that posting a ticket capturing the decision is a good one. I'd just say that we can get the RFC to "approved" very quickly if it's relatively uncontroversial.

[sminnee]

Can we please protected master too, though?

[dnsl48]

Can we please protected master too, though?

GitHub uses fnmatch patterns with flags that aren't too flexible, unfortunately. So master would require a separate rule, though definitely worth protecting I reckon.

[sminnee]

Yeah I think that putting this on the numbered branches but not master would lead to us forgetting that it's unprotected.

Also can you check whether that rule matches a branch called, say, implement-9345? I don't see how the . is matched, which leads me to think that you're doing a _partial_ match, bringing any branch containing a number in scope, which is overly broad.

[dnsl48]

Also can you check whether that rule matches a branch called, say, implement-9345? I don't see how the . is matched

That's not a regex, but rather a glob. [0-9] is the first character, * is everything after. That means 9345-implement will be matched, but implement-9345 will not.

Just checked it again on my repo and can confirm that's correct.

[dnsl48]

I think that's Accepted, I added a TODO section to the top message.
Needs to be actioned by a core committer (requires admin access).
Thanks to everyone for the feedback!

[chillu]

@dnsl48 @brynwhyman Since Max is a core committer, I'm assuming the CMS Squad can handle this in sprint?

[brynwhyman]

Since Max is a core committer, I'm assuming the CMS Squad can handle this in sprint?

Yes! Unless someone gets to it first 😉