pub enum Basis {
OwnerLanded {
owner: String,
},
OwnerApproved {
owner: String,
},
ApprovalWeight {
required: u32,
met: u32,
},
}Expand description
The rule that admitted a landing, as the evaluation that admitted it computed it (D43).
Three variants because there are three ways a protected-ref landing is currently allowed, and an approver list alone distinguishes none of them: under D42 a landing can be authorized with zero approvals, so an empty list would equally mean “an owner landed it” and “the policy required nobody”.
There is deliberately no variant for an ungated ref. A Submit
whose ref is unprotected, or whose node is not running the review
gate, is refused rather than recorded — see OpKind::Submit. The
record therefore means exactly one thing, and cannot be used to dress
an unexamined ref move as an authorized one.
Where a variant names a principal it names it in the namespace the
rule actually read. The ownership rule reads the ACL’s subject
column, which holds usernames and has no actor id to offer, so
owner is a username. Recording the rule’s real input beats
recording a prettier identity the rule never saw.
Variants§
OwnerLanded
owner holds own on the repository and performed the landing
themselves (D42). Performing the landing is assent, which is why
no approval is recorded.
OwnerApproved
owner holds own on the repository and approved a review
naming this exact (ref, commit) pair (D42).
Fields
ApprovalWeight
No owner is granted on the repository, so the weight rule applied and was met.
Fields
required: u32The threshold in force when the landing was admitted.
This is the part of the “the rule itself is not pinned” residual that could be closed cheaply: for this basis an auditor no longer has to reconstruct the threshold from operator-side config history. The ACL grants behind the two owner variants stay unpinned, and still need a tripwire rather than taste.