groombook/org
13
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(skills): loosen uat→main merge gate; CTO Approve only for novel auth, infra/prod, and risk-flagged

Browse Source 
The 2026-06-11 merge-whitelist fix (GRO-2348) added a required_approvals
gate on uat→main merges. That gate is only satisfied by a Gitea Approve
click — the issue-thread QA/UAT-deploy/UAT-regression/security
approvals do not clear it. As a result the CTO is the human-in-the-loop
on every routine release-train PR (GRO-2358, GRO-2359 both hit it).

This change introduces an explicit "uat→main merge-gate policy" in
coding-standards: once the four pre-gates (QA, UAT deploy, UAT
regression, security) are green, the engineer self-merges. A CTO
Gitea Approve click is required only for three categories:

  1. Novel auth / session paths (login, OIDC, OOBE, session
     middleware, token issuance, MFA, new auth provider integrations).
  2. Infra / prod-affecting merges (deploys, manifests, secrets,
     GitOps overlays, CI/CD, main branch protection, prod-affecting
     routing/ingress). All Phase 5 infra overlay PRs in
     groombook/infra still require CTO Gitea Approve without
     exception.
  3. Risk-flagged merges (risk:cto-approve label, or explicit
     CTO/CEO sign-off request in the PR or issue thread).

Phase 4 in sdlc is updated to reflect the new flow: engineer
classifies the PR; CTO Approve happens only for the three categories
above; otherwise the engineer merges once the four pre-gates are
green. The pre-gates themselves do not change.

Refs: GRO-2377
Triggers: GRO-2358, GRO-2359
Source rule: GRO-2348 (merge-whitelist fix)
This commit is contained in:
Flea Flicker
2026-06-12 01:30:45 +00:00
parent 36310c48db
commit 152c52f47c
2 changed files with 29 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/coding-standards/SKILL.md
+20 -2
View File
@@ -3,8 +3,9 @@ name: coding-standards
description: >
Engineering quality bar for GroomBook code: priority ordering of correctness
vs. clarity vs. maintainability vs. performance vs. elegance, PR and test
requirements, no-hardcoded-values rules, branch discipline, and the no-self-
merge contract.
requirements, no-hardcoded-values rules, branch discipline, the no-self-
merge contract, and the uat→main merge-gate policy (CTO Gitea Approve
reserved for novel auth, infra/prod-affecting, and risk-flagged merges).
---
# Coding Standards
@@ -57,6 +58,23 @@ All releases use CalVer (`YYYY.MMDD.PATCH`, e.g. `2026.0504.0`). No SemVer, no c
Push to `git.farh.net` only. Never Docker Hub for first-party images.
## uat→main merge-gate policy
The **CTO Gitea Approve click is not the default gate** on `uat → main` PRs. Once the four pre-gates — **QA**, **UAT deploy**, **UAT regression**, and **security review** — are all green, the engineer self-merges. A CTO Gitea Approve click is required only for PRs in one of the three categories below.
### Categories that require CTO Gitea Approve
1. **Novel auth / session paths** — login, OIDC, OOBE, session middleware, token issuance, password reset, MFA, or any new auth provider integration. Routine changes to auth-gated UI (button styling, error messages, form layout, copy edits) are **not** in this category.
2. **Infra / prod-affecting merges** — deploys, infra manifests, secrets, GitOps overlays, CI/CD pipelines, `main` branch protection, production routing/ingress, or any change that mutates prod state. **All Phase 5 infra overlay PRs (`groombook/infra`) require CTO Gitea Approve** without exception.
3. **Risk-flagged merges** — any PR that carries the `risk:cto-approve` label, or where the CTO or CEO has explicitly requested CTO sign-off in the PR or issue thread.
The engineer who opened the PR classifies it against the three categories above (escalating to the CTO via comment if the call is unclear), then:
* **In a category** → request a CTO Gitea Approve click. The engineer merges once the CTO has approved.
* **Outside all three categories** → no CTO click needed. The engineer merges once the four pre-gates are green.
The pre-gates (QA, UAT deploy, UAT regression, security) do **not** change. This rule only removes the CTO Gitea Approve click from the default `uat → main` path for routine PRs that already pass every pre-gate.
## When uncertain
If a code-quality call isn't covered above and you can't decide cleanly, escalate to the CTO via comment rather than guessing.