GitHub branches, commits, and pull requests for approved snapshots
Use automation/rackspace-schemas/<operationId> for the refresh branch. The
application lease is the concurrency lock. GitHub is not the lock.
The workflow creates no branch before human approval of the review artifact. The operation record owns its branch, commit, and pull request by the operation ID and exact object hashes.
Before the review artifact is created, the workflow gets the current default-branch head and stores it as the reviewed base commit. It builds the artifact from the exact proposed Git files and generated registry.
After approval:
base_tree.Request a Connect token restricted to conveyal/concourse with contents:write and
pull_requests:write, as the security document defines.
The pull-request description includes:
If no canonical file changed, create no branch. Mark the operation succeeded with no pull request.
The main ruleset requires one approval and CI / verify. It includes administrators and blocks
force pushes and branch deletion. The workflow never merges or writes to main.
Disable GitHub's automatic head-branch deletion setting. Every operation branch remains until the manual cleanup path removes it.
The workflow never removes a branch automatically. It records an owned orphan branch as eligible for manual cleanup only when the operation is terminal and owns the exact head.
The administrator page can authorize cleanup for that branch. The local cleanup command removes it through an explicit Git force-with-lease value. An unknown or changed head stops cleanup.
GitHub branches, commits, and pull requests for approved snapshots
Use automation/rackspace-schemas/<operationId> for the refresh branch. The
application lease is the concurrency lock. GitHub is not the lock.
The workflow creates no branch before human approval of the review artifact. The operation record owns its branch, commit, and pull request by the operation ID and exact object hashes.
Before the review artifact is created, the workflow gets the current default-branch head and stores it as the reviewed base commit. It builds the artifact from the exact proposed Git files and generated registry.
After approval:
base_tree.Request a Connect token restricted to conveyal/concourse with contents:write and
pull_requests:write, as the security document defines.
The pull-request description includes:
If no canonical file changed, create no branch. Mark the operation succeeded with no pull request.
The main ruleset requires one approval and CI / verify. It includes administrators and blocks
force pushes and branch deletion. The workflow never merges or writes to main.
Disable GitHub's automatic head-branch deletion setting. Every operation branch remains until the manual cleanup path removes it.
The workflow never removes a branch automatically. It records an owned orphan branch as eligible for manual cleanup only when the operation is terminal and owns the exact head.
The administrator page can authorize cleanup for that branch. The local cleanup command removes it through an explicit Git force-with-lease value. An unknown or changed head stops cleanup.