Set release boundaries for the evaluation pull request

Operational risks for the pull request from improve-evaluation into main center on force-pushing rewritten history on a shared branch or leaking tokens in PR body, plus the earlier failure mode (pushing straight to main, or opening a PR with failing checks ignored). Safety lives in executable gates, allowlists, redaction, and a named owner—not in a warning paragraph under an unsafe function.

gh pr view --json body --jq .body | grep -Ei 'token|api[_-]?key|password' && echo 'BLOCK: secret-like text in PR' || echo 'PR body clean of secret-like text'

Expected evidence: PR body clean of secret-like text. A failed assertion means stop, investigate, and do not publish the evaluation pull request.

Name who can disable the feature, what data is retained, and how to roll back to the last known good artifact. Pin the reviewed configuration (versions, thresholds, allowlists) so “what shipped” is reconstructable for github-basics.

Write the release blocker as a predicate, not a feeling: “Do not ship the evaluation pull request if force-pushing rewritten history on a shared branch or leaking tokens in PR body.” Pair it with a passing control that shows the reviewed configuration still works for feature branch improve-evaluation with one commit. Name an owner and a rollback handle (git tag, docs_version, previous image).

Security pages must not paste the happy-path demo. If your gate code looks like the implementation page, replace it with a deny/allow check aimed at force-pushing rewritten history on a shared branch or leaking tokens in PR body.

State the data retention rule in one line (what is stored, for how long, who can read it). Then state the kill switch (env flag, config pin, or feature owner). The evaluation pull request is not shippable without both, even when gh pr view shows base=main, head=improve-evaluation, and check summary looks healthy.

At the safety and operations stage for github-basics, the job is narrower than finishing a product demo. You are creating one progressive evidence piece about feature branch improve-evaluation with one commit that later pages inherit without redefining success. Keep that fixture small enough to inspect by hand, keep outputs copy-pasteable as text, and refuse to narrate this baseline as if it were a production SLA: branch protection / required checks listed before opening the PR.

For this page specifically, success looks like an executable deny gate for the lab-specific threat while still centering the user decision to propose a reviewed evaluation change for merge only after checks pass. If you cannot point to a file, command, or assertion that proves that for the evaluation pull request, stay on this page instead of advancing.

GitHub glossary

Previous · Next