@rmartz/pr-policy

Is this pull request's content acceptable under policy? pr-policy answers that on every PR, statically, from the PR's diff, title, description, and changed paths. It doesn't rely on a reviewer remembering to check.

Each policy rule is a small read-only classifier. All of them report into one pr-policy check-run, which the consumer's ruleset requires. A fixable problem (a bad title) turns it red; a PR waiting on a human sign-off shows it as pending, not failing. Either holds the merge. Adding a rule later never adds a new required-status name.

Checks

| Check | Blocks when | | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Blocking labels (docs) | The PR carries do not merge, dnm, blocked, or escalation needed (shows as pending). | | CI-change classification (docs) | A .github/workflows/** change loosens CI (a removed job, continue-on-error, a narrowed trigger, …) and no human has applied CI change approved (shows as pending). Owns CI approval needed. | | Base branch (docs) | The PR targets a branch other than the default and it isn't a non-epic PR on an open epic's branch. A stacked PR waits for its base PR (shows as pending); a base no open PR heads blocks. | | Title-type rules (docs) | The squash title isn't a valid Conventional Commit, puts ! on a non-functional type, disagrees with the breaking change label, or types a linter/formatter bump as a non-release, non-ci type. | | UAT sign-off (docs) | The PR isn't docs, tests, CI, dependency-only, or repo metadata, and no trusted user has applied UAT passed (or tested) or no UAT needed (shows as pending). | | Dependabot claim verification (docs) | A Dependabot PR touches a non-dependency path, changes a dependency its description doesn't claim, pins a version other than the claimed one, or edits anything Dependabot never edits (a package.json script, a workflow step). | | Domain labels (backlog) | Never blocks. Additive path-glob → domain-label map. | | Milestone inheritance (backlog) | Never blocks. Issue → PR milestone. |

The design, and why this is separate from merge-safety and pr-lifecycle, is in docs/decisions.md.

Using it

Add the rmartz/pr-policy-action caller workflow and require the pr-policy status on your default branch. Setup is in its consumer guide.

Library and CLI

Every check is importable. The pr-policy CLI is a thin wrapper around them:

pr-policy evaluate --pr 12 --repo rmartz/pr-policy            # post the check-run, status + labels
pr-policy evaluate --pr 12 --repo rmartz/pr-policy --json     # evaluate only, change nothing
pr-policy evaluate --facts pr.json                            # offline, from a JSON facts file
pr-policy evaluate --pr 12 --repo rmartz/pr-policy --skip-uat # for a repo with no UAT

Documentation

• What pr-policy is
• Policy checks
• The check-run and label contract
• Adding a policy check
• How pr-policy reaches consuming repos
• Design decisions

🤖 Created by Claude Opus 5.5