Enforce certain status checks in branch protections

[ossf]

Enforce certain status checks in branch protections

[azeemshaikh38]

FYI, Scorecard Branch-Protection data already has the status checks. Not needed right now, but can consider pulling in this info from Scorecard directly at some point.

[artis3n]

Maybe also, in the object: an optional msg field that overwrites the message given to developers if that status check is found missing. If not present a general "missing X status check" message will be outputted.

[jeffmendoza]

This sounds great. It would be good to propose the additional names and types of the members in the config.

Why would required be needed. Why would you list a name of expected check, but it not be required?

The GitHub data looks straight forward, just a list of strings.

[artis3n]

Why would required be needed. Why would you list a name of expected check, but it not be required?

We have a bunch of status checks we supply through GitHub Apps in our org to give feedback to folks as they work on PRs, but they don't necessarily need to succeed before code is merged. e.g. providing teams early security feedback but the violations only have to be fixed later on, teams can still merge code with the failed status check.

I'm fine with putting this together without the required field but that's my use case.

[artis3n]

Given the GitHub data it seems the status checks submitted must be considered required, which makes sense. So the new data going into the config would look like:

status_checks:
  - mycheck
  - theothercheck
  - other

With no other metadata needed. Just the names

[jeffmendoza]

Sounds great, lgtm

[yorinasub17]

I had a need for this for our org's use case so I went ahead and took a stab at an implementation! #147

[yorinasub17]

FYI #147 was just merged. Note that the final version changed the interface slightly to allow for specifying the GH app that should provide the context:

requireStatusChecks:
  - context: "Analyze (go)"
    appID: 15368
  - context: "lint"
  - context: "build"
    appID: 15368

Refer to #147 (comment) for rationale

[jeffmendoza]

Closed with above