From b06ceca0cdb24ab13b5636d058f77125db1fde8e Mon Sep 17 00:00:00 2001
From: Typas Liao <typascake@gmail.com>
Date: Sun, 26 Apr 2026 10:17:14 +0800
Subject: [PATCH] ci(branch-policy): allow setup actions on their bootstrap
 branches

mac-nix-setup lives under .github/actions/ only because composite
actions must reside there; it is mac bootstrap logic and should be
editable from bootstrap/mac. Similarly, linux-container-setup is
distro bootstrap infrastructure and should be editable from any
bootstrap/<distro> branch.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/branch-policy.yml | 12 ++++++++----
 AGENTS.md                           |  4 ++--
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/branch-policy.yml b/.github/workflows/branch-policy.yml
index b07f145..7373c47 100644
--- a/.github/workflows/branch-policy.yml
+++ b/.github/workflows/branch-policy.yml
@@ -33,7 +33,11 @@ jobs:
           }
           is_mac_bootstrap() {
             [[ "$1" == flake.nix || "$1" == flake.lock \
-               || "$1" == nix/* || "$1" == hosts/* ]]
+               || "$1" == nix/* || "$1" == hosts/* \
+               || "$1" == .github/actions/mac-nix-setup/* ]]
+          }
+          is_linux_container_setup() {
+            [[ "$1" == .github/actions/linux-container-setup/* ]]
           }
 
           case "$branch" in
@@ -64,7 +68,7 @@ jobs:
             bootstrap/mac)
               for f in "${files[@]}"; do
                 if ! is_mac_bootstrap "$f" && ! is_doc "$f"; then
-                  echo "bootstrap/mac must only touch flake.nix, flake.lock, nix/**, hosts/**, or *.md/*.org: $f" >&2
+                  echo "bootstrap/mac must only touch flake.nix, flake.lock, nix/**, hosts/**, .github/actions/mac-nix-setup/**, or *.md/*.org: $f" >&2
                   exit 1
                 fi
               done
@@ -72,8 +76,8 @@ jobs:
             bootstrap/*)
               distro="${branch#bootstrap/}"
               for f in "${files[@]}"; do
-                if [[ "$f" != "os-init/${distro}-init.sh" ]] && ! is_doc "$f"; then
-                  echo "bootstrap/${distro} must only touch os-init/${distro}-init.sh or *.md/*.org: $f" >&2
+                if [[ "$f" != "os-init/${distro}-init.sh" ]] && ! is_linux_container_setup "$f" && ! is_doc "$f"; then
+                  echo "bootstrap/${distro} must only touch os-init/${distro}-init.sh, .github/actions/linux-container-setup/**, or *.md/*.org: $f" >&2
                   exit 1
                 fi
               done
diff --git a/AGENTS.md b/AGENTS.md
index f7a7cce..5812649 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,8 +15,8 @@ Common types: `feat`, `fix`, `chore`, `refactor`, `docs`, `style`, `test`.
 To protect `master`, follow these rules:
 
 - When developing any OS-specific bootstrap, check out to a `bootstrap/<name>` branch (e.g., `bootstrap/ubuntu`). Long-lived. Scope is restricted by `branch-policy`:
-  - `bootstrap/<distro>` (where `<distro>` is `ubuntu`, `debian`, `fedora`, `opensuse-tumbleweed`, or `cachyos`): only `os-init/<distro>-init.sh` (plus `*.md`/`*.org`).
-  - `bootstrap/mac`: only `flake.nix`, `flake.lock`, `nix/**`, `hosts/**` (plus `*.md`/`*.org`).
+  - `bootstrap/<distro>` (where `<distro>` is `ubuntu`, `debian`, `fedora`, `opensuse-tumbleweed`, or `cachyos`): only `os-init/<distro>-init.sh` and `.github/actions/linux-container-setup/**` (plus `*.md`/`*.org`).
+  - `bootstrap/mac`: only `flake.nix`, `flake.lock`, `nix/**`, `hosts/**`, and `.github/actions/mac-nix-setup/**` (plus `*.md`/`*.org`).
   - `bootstrap/shared`: only `init.sh` and `scripts/shell-init.sh` (plus `*.md`/`*.org`). This is the only bootstrap branch whose PR triggers the full `bootstrap.yml` matrix — use it for edits that affect bootstrap across all distros.
 - When developing any recipe, check out to a `dev/<name>` branch (e.g., `dev/zsh`). Long-lived.
 - When writing or updating documentation, check out to a `docs/<name>` branch (e.g., `docs/readme`) to avoid merge conflicts with parallel code work. Short-lived. Only `*.md` and `*.org` files may change.