Prevent Deletion of Semantic Versioning Tags

Oct 13, 2025 by wbrum.org 132 views

Introduction

As an experiment, we aim to create a ruleset for OpenSAFELY-owned repositories in the opensafely-actions organisation. This ruleset will be committed to this repository and applied to all OpenSAFELY-owned repositories. The primary goal of this ruleset is to enforce best practices and ensure effective collaboration among developers.

Why Create a Ruleset?

Rulesets provide a way to enforce specific rules and policies within a repository. By creating a ruleset, we can ensure that all OpenSAFELY-owned repositories adhere to a set of guidelines that promote effective collaboration and maintain a high level of code quality.

Ruleset Requirements

The ruleset should meet the following requirements:

Prevent Deletion of the `main` Branch

The main branch is the default branch for a repository. Preventing users from deleting it ensures that the repository always has a stable and up-to-date main branch.

Rationale: The main branch is the default branch, and deleting it would cause issues with the repository's workflow.
Implementation: Use the branches rule to prevent deletion of the main branch.

Prevent Deletion of Semantic Versioning Tags

Semantic versioning tags, such as v0.0.1, represent releases. Preventing users from deleting these tags ensures that the repository's release history remains intact.

Rationale: Semantic versioning tags represent releases, and deleting them would cause issues with the repository's release history.
Implementation: Use the tags rule to prevent deletion of semantic versioning tags.

Require PRs Before Merging to the `main` Branch

Requiring users to create a PR before merging to the main branch ensures that users work on feature/bugfix branches, which facilitates more effective collaboration.

Rationale: This ensures users work on feature/bugfix branches, which facilitates more effective collaboration.
Implementation: Use the required_status_checks rule to require PRs before merging to the main branch.

Require Status Checks to Pass Before Merging

Requiring status checks to pass before merging ensures that "broken" code isn't merged into the main branch.

Rationale: This insures "broken" code isn't merged into the main branch.
Implementation: Use the required_status_checks rule to require status checks to pass before merging.

Prevent Force-Pushing to the `main` Branch

Preventing users from force-pushing to the main branch ensures that users cannot overwrite changes made by others.

Rationale: This facilitates more effective collaboration.
Implementation: Use the force_push rule to prevent force-pushing to the main branch.

Prevent Pushing Commits with Changes to `.github` Files

Preventing users from pushing commits that include changes to files in the .github directory ensures that users cannot disable workflows and bypass status checks.

Rationale: This prevents users from disabling workflows and bypassing status checks.
Implementation: Use the push rule to prevent pushing commits with changes to .github files.

Implementation

To implement the ruleset, we will use the GitHub API to create a ruleset for the opensafely-actions organisation. We will then commit the ruleset to this repository and apply it to all OpenSAFELY-owned repositories.

Step 1: Create a Ruleset

To create a ruleset, we will use the GitHub API to create a new ruleset for the opensafely-actions organisation.

curl -X POST \
  https://api.github.com/repos/opensafely-actions/opensafely-actions/settings/rules \
  -H 'Authorization: Bearer YOUR_GITHUB_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"rules": [{"branch": "main", "rule": "deny_deletions"}]}'

Step 2: Add Rules to the Ruleset

We will then add the remaining rules to the ruleset.

curl -X PATCH \
  https://api.github.com/repos/opensafely-actions/opensafely-actions/settings/rules \
  -H 'Authorization: Bearer YOUR_GITHUB_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"rules": [{"branch": "main", "rule": "deny_deletions"}, {"tag": "v0.0.1", "rule": "deny_deletions"}, {"required_status_checks": {"strict": true, "contexts": ["continuous-integration"]}}, {"force_push": false}, {"push": {"allow_merge_commit": false, "allow_rebase_merge": false, "allow_force_push": false}}]}'

Step 3: Commit the Ruleset

We will then commit the ruleset to this repository.

git add .
git commit -m "Create ruleset for OpenSAFELY-owned repositories"

Step 4: Apply the Ruleset to All OpenSAFELY-owned Repositories

We will then apply the ruleset to all OpenSAFELY-owned repositories.

curl -X POST \
  https://api.github.com/repos/opensafely-actions/opensafely-actions/settings/rules \
  -H 'Authorization: Bearer YOUR_GITHUB_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"rules": [{"branch": "main", "rule": "deny_deletions"}, {"tag": "v0.0.1", "rule": "deny_deletions"}, {"required_status_checks": {"strict": true, "contexts": ["continuous-integration"]}}, {"force_push": false}, {"push": {"allow_merge_commit": false, "allow_rebase_merge": false, "allow_force_push": false}}]}'

Conclusion

Q: What is the purpose of the OpenSAFELY ruleset?

A: The OpenSAFELY ruleset is designed to enforce best practices and ensure effective collaboration among developers in OpenSAFELY-owned repositories. The ruleset aims to promote a high level of code quality and maintain a stable and up-to-date main branch.

Q: What are the requirements of the OpenSAFELY ruleset?

A: The OpenSAFELY ruleset includes the following requirements:

Prevent users from deleting the main branch
Prevent users from deleting semantic versioning tags (e.g., v0.0.1)
Require users to create a PR before merging to the main branch
Require status checks to pass before merging
Prevent users from force-pushing to the main branch
Prevent users from pushing commits that include changes to files in the .github directory

Q: Why is it necessary to prevent deletion of the `main` branch?

A: The main branch is the default branch for a repository, and deleting it would cause issues with the repository's workflow. By preventing deletion of the main branch, we ensure that the repository always has a stable and up-to-date main branch.

Q: Why is it necessary to prevent deletion of semantic versioning tags?

A: Semantic versioning tags represent releases, and deleting them would cause issues with the repository's release history. By preventing deletion of semantic versioning tags, we ensure that the repository's release history remains intact.

Q: Why is it necessary to require users to create a PR before merging to the `main` branch?

A: Requiring users to create a PR before merging to the main branch ensures that users work on feature/bugfix branches, which facilitates more effective collaboration. This also ensures that code changes are reviewed and tested before being merged into the main branch.

Q: Why is it necessary to require status checks to pass before merging?

A: Requiring status checks to pass before merging ensures that "broken" code isn't merged into the main branch. This ensures that code changes are thoroughly tested and reviewed before being merged into the main branch.

Q: Why is it necessary to prevent users from force-pushing to the `main` branch?

A: Preventing users from force-pushing to the main branch ensures that users cannot overwrite changes made by others. This facilitates more effective collaboration and ensures that code changes are thoroughly reviewed and tested before being merged into the main branch.

Q: Why is it necessary to prevent users from pushing commits that include changes to files in the `.github` directory?

A: Preventing users from pushing commits that include changes to files in the .github directory ensures that users cannot disable workflows and bypass status checks. This ensures that code changes are thoroughly reviewed and tested before being merged into the main branch.

Q: How do I apply the OpenSAFELY ruleset to my repository?

A: To apply the OpenSAFELY ruleset to your repository, you can follow these steps:

Create a new ruleset for your repository using the GitHub API.
Add the OpenSAFELY ruleset to your repository's settings.
Commit the changes to your repository.

Q: Can I customize the OpenSAFELY ruleset to fit my needs?

A: Yes, you can customize the OpenSAFELY ruleset to fit your needs. You can add or remove rules as necessary to ensure that your repository meets your specific requirements.

Q: Where can I find more information about the OpenSAFELY ruleset?

A: You can find more information about the OpenSAFELY ruleset in the GitHub documentation. Additionally, you can reach out to the OpenSAFELY team for further assistance and guidance.