james.maesandCodex
bd5ee3bec5
Add the repository-policy profile, validate actual legacy policy trees, normalize packed resource line endings, and scope maintenance requirements to branch source. Preserve canonical scanner enforcement for qqq-all and policy-only main branches. Validation: 32 audit tests, 7 policy tests, all four target source trees, and Linux packed-generator check pass. Replaces this PR's unrecognized-email signatures using the established verified identity; signature enforcement remains enabled. Co-authored-by: Codex <noreply@openai.com>
17 lines
1.0 KiB
Markdown
17 lines
1.0 KiB
Markdown
# Application-free branch verification
|
|
|
|
Use `profile: repository-policy` only on a branch containing repository policies,
|
|
documentation, workflow configuration and optional unused Maven wrappers. It uses
|
|
the same canonical setup caller as other profiles and one small Python verification
|
|
job. It checks tracked YAML/JSON syntax and rejects application manifests, source
|
|
files, unknown file types and symlinks. It never builds or publishes an application.
|
|
|
|
The manifest accepts only `profile`, `orb_version` and `default_branch`. The latter
|
|
remains the repository's actual default branch. A future application promotion must
|
|
select its real build profile in the same change; adding source without doing so fails.
|
|
|
|
Estate policy can set `branch_profiles: {main: repository-policy}` without changing
|
|
the default branch's application profile. Require the CircleCI `setup` and `verify`
|
|
checks on the policy branch. This profile does not establish application release
|
|
readiness or replace the build/release checks on source-bearing branches.
|