2025-09-10 Express Working Session #431

Activity

1. github-actions

   added

   meeting

   on Sep 4, 2025
2. wesleytodd commented on Sep 9, 2025

   

   wesleytodd

   on Sep 9, 2025

   Member

   More actions

   I was hoping we could use some time (privately) to have some discussions and maybe fix up a few of the github and npm settings we have while additionally discussing the recent supply chain attacks and what we need to be doing in relation to them. Specifically with debug impacting us. I know this may clear some of the agenda, but I think it might be the most pressing topic at the moment.
3. bjohansebas commented on Sep 10, 2025

   

   bjohansebas

   on Sep 10, 2025

   Member

   More actions

   Basically, #422 would be part of the priority for tomorrow, and some policies like #378, regarding inactivity.

   It would be great to attend, hopefully, I can find some time tomorrow to join.
4. bjohansebas

   closed this as completedon Sep 13, 2025
5. jonchurch commented on Sep 15, 2025

   

   jonchurch

   on Sep 15, 2025

   Member

   More actions

   Minutes:

   • We are checking all of the packages on npm to ensure that they have 2fa enforced for publishing (we already have 2fa enforced for all users, but this is a seperate setting)
     • @UlisesGascon can you check the ones you are added to? checking under Package page => Settings => "Publishing access"
   • We are enabling branch protection rulesets at the Org level vs at the repo level (need to get the Open JSF to ask Github to give pillarjs and jshttp orgs Gitub team plan so we can use rulesets)

   Basic branch protection ruleset for importing:

   Protects the default branch with:

   • What it does ("Rule Name in UI")
   • No deletion ("Restrict deletions")
   • No force push ("Block force pushes")
   • No pushing directly to default branch, force landing commits via PR ("Require a pull request before merging")
   • Require 1 PR reviewer ("Required Approvals")
   • PR's can only be landed via squash/rebase no merge commit, this is an opinion/preferance of the TC ("Allowed merge methods")
   • No merge commits pushed to branch, idk honestly if this is relevant when combined with "require PR" setting ("Require linear history")

   {
     "id": 8040275,
     "name": "Default branch protection",
     "target": "branch",
     "source_type": "Organization",
     "source": "expressjs",
     "enforcement": "active",
     "conditions": {
       "ref_name": {
         "exclude": [],
         "include": [
           "~DEFAULT_BRANCH"
         ]
       },
       "repository_property": {
         "exclude": [],
         "include": []
       }
     },
     "rules": [
       {
         "type": "deletion"
       },
       {
         "type": "non_fast_forward"
       },
       {
         "type": "required_linear_history"
       },
       {
         "type": "pull_request",
         "parameters": {
           "required_approving_review_count": 1,
           "dismiss_stale_reviews_on_push": false,
           "require_code_owner_review": false,
           "require_last_push_approval": false,
           "required_review_thread_resolution": false,
           "automatic_copilot_code_review_enabled": false,
           "allowed_merge_methods": [
             "squash",
             "rebase"
           ]
         }
       }
     ],
     "bypass_actors": []
   }