From 0fc4e7b367427bc085e04890094e299dd6b5fcce Mon Sep 17 00:00:00 2001 From: Stoney Jackson Date: Tue, 13 Oct 2026 20:30:03 +0000 Subject: [PATCH] docs(specs): record course-materials-ng's bypass for its maintainer Alain pushes to course-materials-ng's main directly, and that workflow stays, so its main ruleset lets him bypass alongside the release App. Co-Authored-By: Claude Opus 5.5 --- .../specs/2026-10-13-devcontainer-permissions-design.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dev-docs/specs/2026-10-13-devcontainer-permissions-design.md b/dev-docs/specs/2026-10-13-devcontainer-permissions-design.md index 6424d96..548f69d 100644 --- a/dev-docs/specs/2026-10-13-devcontainer-permissions-design.md +++ b/dev-docs/specs/2026-10-13-devcontainer-permissions-design.md @@ -188,7 +188,12 @@ Set by an org owner, before any container gets push access. Per repo: org rulesets need GitHub Team, which ourPLCC does not have. "Apply the rulesets" is therefore a step in creating any ourPLCC repo. The release Apps are the only bypass actors; nobody else bypasses, org owners -included. +included, with one exception: course-materials-ng's `main` also lets its +maintainer Alain Kägi (`alainkaegi`) bypass, because he maintains it by +pushing to `main` directly. Its `main` still needs the ruleset for everyone +else: `deploy.yml` runs on every push to `main` with the release App's token, +which reaches every repo in the App's installation. The remaining risk is +that one contributor's token. - **`main`**, every repo except `change-requests` (`dev` included): require a pull request, block force-pushes, block deletion.