Repository navigation
Conversation
Lock or unlock release/beta for merges by toggling a dedicated "Release beta lock" ruleset that holds an "update" rule. The ruleset is created on first run. API failures emit an error annotation and fail the step. Ref: ED-25903 Co-authored-by: Cursor <cursoragent@cursor.com>
3 tasks
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Fix lockfile: regenerate package-lock.json with npm install to include @elementor/release-beta-lock - Fix CodeQL code injection: pass github.action_path through env var instead of inline interpolation - Fix SIGPIPE: capture gh output first, then take first line to avoid pipeline failure - Fix org-level rulesets: filter for source_type == 'Repository' to exclude org rulesets - Fix test isolation: run tests in clean subshells, prevent global variable leakage - Add new tests: default branch, missing repo, disabled enforcement, org filtering, duplicates - Fix error propagation: explicitly return gh failure code in find_ruleset_id All tests pass locally. Resolves review items 1-5. Co-authored-by: Davids Seveloff <davseve@users.noreply.github.com>
gitstream-cm
Bot
added
30 min review
🚨 1 Unresolved Thread(s)
and removed
20 min review
🚨 1 Unresolved Thread(s)
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
release-beta-lockcomposite action that core and Pro can use to lock or unlockrelease/betafor merges as part of the release cycle.state: lockedturns on a dedicated repository ruleset named Release beta lock. Its only rule isupdate, so nobody without bypass permission can push or merge into the branch.state: unlockedturns that ruleset off.::errorannotation that names the failed operation and fail the step, so a missing lock is never silent.Planned callers (core PR follows this one):
create-version-change.yml), before any branch work.X.Y.0) incontrolled-release.yml.This lines up with
sync-release-branches: once stable reaches the beta's X.Y, branch sync already treats beta as inactive.Token
Managing rulesets needs repository Administration: write, which
GITHUB_TOKENcan't be granted. Callers passMAINTAIN_TOKENfor now, so its owner must be a repo admin.Follow-up: replace
MAINTAIN_TOKENwith a GitHub App token (actions/create-github-app-token) installed on core and Pro. That way the lock isn't tied to a personal account, and the app can be added as a bypass actor if needed.Test plan
bash actions/release-beta-lock/release-beta-lock.test.sh: 16 tests with a stubbedgh(create, update, invalid state, list/update failures)env.RULESET_NAMEin--jq) checked against the realelementor/elementorrulesets APIprettier --checkJira
ED-25903
Made with Cursor
✨ PR Description
1. Problem & Context
Implements a GitHub Action (ED-25903) to programmatically lock or unlock the beta release branch using repository rulesets to prevent unauthorized merges.
2. What Changed (Where)
actions/release-beta-lock/release-beta-lock.sh: Bash script to manage ruleset enforcement via GH API.actions/release-beta-lock/action.yml: Composite action definition with inputs for token, state, and branch.actions/release-beta-lock/package.json: Metadata and test script definition.actions/release-beta-lock/release-beta-lock.test.sh: Comprehensive test suite mocking GH API calls.3. How It Works
The action takes a target
state(locked/unlocked) andbranch, then checks for an existing repository ruleset by name. If found, it updates the enforcement status viaPUT; otherwise, it creates a new ruleset viaPOSTwith an "update" rule targeting the specified branch.4. Risks
Requires a PAT or GitHub App token with Administrative write permissions, as the default
GITHUB_TOKENcannot modify repository rulesets.Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how