james.maesandCodex
bd5ee3bec5
Add the repository-policy profile, validate actual legacy policy trees, normalize packed resource line endings, and scope maintenance requirements to branch source. Preserve canonical scanner enforcement for qqq-all and policy-only main branches. Validation: 32 audit tests, 7 policy tests, all four target source trees, and Linux packed-generator check pass. Replaces this PR's unrecognized-email signatures using the established verified identity; signature enforcement remains enabled. Co-authored-by: Codex <noreply@openai.com>
1.0 KiB
Application-free branch verification
Use profile: repository-policy only on a branch containing repository policies,
documentation, workflow configuration and optional unused Maven wrappers. It uses
the same canonical setup caller as other profiles and one small Python verification
job. It checks tracked YAML/JSON syntax and rejects application manifests, source
files, unknown file types and symlinks. It never builds or publishes an application.
The manifest accepts only profile, orb_version and default_branch. The latter
remains the repository's actual default branch. A future application promotion must
select its real build profile in the same change; adding source without doing so fails.
Estate policy can set branch_profiles: {main: repository-policy} without changing
the default branch's application profile. Require the CircleCI setup and verify
checks on the policy branch. This profile does not establish application release
readiness or replace the build/release checks on source-bearing branches.