openregs review

The review workflow: protect a branch, approve, report checks, merge.

Drive the human review workflow that stands between a machine proposal and the canon. There is no forge here and none is needed: a pull request is a branch on a remote, an approval is a ref the approver pushes, a check result is a ref the ci identity pushes. Nothing this command does grants anything — the remote’s pre-receive hook re-derives every one of those facts from the refs and refuses what does not add up. The workflow is docs/runbooks/atom-review.md.

openregs review [-h] <command> ...

openregs review protect

Install branch protection on a bare repository.

Render .github/branch-protection.yaml into a pre-receive hook and store the policy beside the object store, where a forge would keep it: outside every branch, so no pull request can weaken the rules being applied to it.

openregs review protect [-h] --repo <path> [--policy <path>]

Option
--repo <path>	the bare repository (required)
--policy <path>	policy to install (default: .github/branch-protection.yaml in this checkout)

openregs review status

What stands behind a branch: approvals, checks, and who owns what it changes.

openregs review status [-h] --repo <path-or-url> --branch <name>

Option
--repo <path-or-url>	(required)
--branch <name>	(required)

openregs review approve

Approve exactly one commit, in your own name.

openregs review approve [-h] --repo <path-or-url> [--branch <name>] [--sha <sha>] --as
                               <handle> [--withdraw]

Option
--repo <path-or-url>	(required)
--branch <name>	—
--sha <sha>	—
--as <handle>	who is approving (required)
--withdraw	take the approval back instead

openregs review check

Publish a check result for one commit, as the ci identity.

openregs review check [-h] --repo <path-or-url> [--branch <name>] [--sha <sha>] --context
                             <name> --result {success,failure} --as <handle>

Option
--repo <path-or-url>	(required)
--branch <name>	—
--sha <sha>	—
--context <name>	(required)
--result <value>	(required, one of success, failure)
--as <handle>	(required)

openregs review merge

Merge a reviewed branch, recording who reviewed it.

Build the merge commit and push it. The Reviewed-by trailers are written from the approval refs on the remote, never from the caller, and the remote checks them against those same refs — a merge cannot claim a reviewer who did not approve the commit being merged.

openregs review merge [-h] --repo <path-or-url> --branch <name> --as <handle>
                             [--at <rfc3339>]

Option
--repo <path-or-url>	(required)
--branch <name>	(required)
--as <handle>	(required)
--at <rfc3339>	fix the merge commit’s timestamps

openregs review github-settings

Render the policy as the GitHub branch-protection payload a human applies.

Print (or write) the body of PUT /branches//protection. Applying it is a human step: no test in this repository may talk to GitHub, so nothing here proves the hosted branch is configured. The rules GitHub has no setting for are listed too, rather than silently dropped.

openregs review github-settings [-h] [--policy <path>] [--out <path>] [--check]

Option
--policy <path>	—
--out <path>	write the payload here
--check	write nothing; fail when —out has drifted from the policy