ai/pi-kit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(permission-gate): guard release-* branch and v* tag pushes (deploy convention)

Browse Source 
Deploy convention at M.Video: a release-* branch push deploys to stage and a
v* tag push deploys to PROD. The old guard only matched release/* (slash) and
never caught tag pushes, so a prod deploy could run unconfirmed.

- permission-gate: match main/master, release-[-/], --tags/--follow-tags, and
  whitespace-preceded v<digit> tags; false-positive-safe (space discriminator)
- create-mr.sh: refuse source branch release-* (not just release/*)
- jira-workflow doc updated to release-*

Verified with a behavioral test suite (10 cases incl. v2, false-positive checks).
This commit is contained in:
dev
2026-07-16 13:13:35 +03:00
parent e98e4ca9ae
commit 6521d9c431
3 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/jira-workflow/scripts/create-mr.sh
+2 -2
View File
@@ -26,8 +26,8 @@ JIRA_KEY="${4:-}"
# --- Refuse to open an MR *from* a protected branch (safety). ----------------
case "$SOURCE" in
main | master | release/*)
echo "Refusing: source branch '$SOURCE' looks protected. Create a feature branch first." >&2
main | master | release-* | release/*)
echo "Refusing: source branch '$SOURCE' looks protected/release. Create a feature branch first." >&2
exit 1
;;
esac