aiolabs/claude-forgejo-sandbox
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(seed): branch protection honours reforge.requiredApprovers

Browse source 
reforge-seed hardcoded approvals_whitelist_username to security-lead,
so seeded stack repos ignored the module option that the working repo
already respected. The package now bakes REFORGE_REQUIRED_APPROVERS in
from the option (space-separated, standalone default unchanged) and the
seed script builds the protection payload from it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Padreug 2026-10-09 18:45:44 +02:00
commit a8b85154b8
3 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
packages/reforge-scripts.nix
View file

@ -37,6 +37,7 @@
configDir,
agentsDir ? null,
refsDir ? null,
requiredApprovers ? [ "security-lead" ],
}:
let
@ -88,6 +89,7 @@ stdenvNoCC.mkDerivation {
--set-default REFORGE_CONFIG_DIR ${lib.escapeShellArg (toString configDir)} \
--set-default REFORGE_SETTINGS_DIR "$SETTINGS" \
--set-default REFORGE_AGENTS_DIR "$AGENTS" \
--set-default REFORGE_REQUIRED_APPROVERS ${lib.escapeShellArg (lib.concatStringsSep " " requiredApprovers)} \
${lib.optionalString (
refsDir != null
) "--set-default REFORGE_REFS_DIR ${lib.escapeShellArg (toString refsDir)}"}
@ -96,7 +98,7 @@ stdenvNoCC.mkDerivation {
'';
meta = with lib; {
description = "reforge lifecycle CLI (seed/reset/compare/smoke/kickoff/role/orchestrator/fetch-targets)";
description = "reforge lifecycle CLI (seed/reset/compare/smoke/kickoff/role/orchestrator/fetch-targets/harvest)";
mainProgram = "reforge-seed";
license = licenses.mit;
};