Amy Kamala 00:02 on 2026-09-30
Tags:   

Increased security on Hosting team repositories

For years, HostingHosting A web hosting service is a type of Internet hosting service that allows individuals and organizations to make their website accessible via the World Wide Web. team contributors have followed team protocols without issue, and that speaks very highly of the professionalism of this team. In recent days, however, team repositories have received an increase in spammy Pull Requests, premature merges, and other undesirable activity in the repositories. Because of this, branch protection rules on all Hosting team repositories have been tightened.

Moving forward, the following security protocols are being enforced:

  • Two approvals are required for a PR to be merged. This doesn’t mean one approval, this doesn’t mean two reviews, this doesn’t mean that folks can ignore change requests and/or bypass the 2 review rule and merge PRs anyway. This means that PRs can not be merged without two approvals.
  • Change requests must be marked as resolved for a PR to be merged. If there are unresolved change requests, the PR can not be merged.
  • New pushes must be reviewed and approved prior to merging. If new code is pushed to a PR, two reviews and approvals of that code must be made in order for the PR to be merged.
  • New GitHubGitHub GitHub is a website that offers online implementation of git repositories that can can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. accounts can not interact with the repositories. If you’re a new contributor who just created your Github account, there is a 24 hour grace period before you can interact with the repos.
  • All unit tests must pass for a PR to be merged. There should be only green check marks in test results before hitting merge. If any tests are failing, resolve the issue before merging.

Exceptions:

  • Administrators of the Github WordPress organization can bypass these rulesets on all repositories.
  • Administrators of the Github WordPress Hosting Team can bypass these rulesets on all repositories.
  • Repository Maintainers can bypass these rulesets on the Runner repository.
  • Members of the Github Hosting Team have the ability to bypass these rules on the Hosting Handbook and Advanced Administration Handbook repositories. This is to be used under extenuating circumstances only. If team members abuse this privilege it will be revoked.

These rules are meant to protect the repositories, particularly the test runner, from premature, spammy and malicious merges.

Contributors – Please hop into the #hosting SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/ channel and pingPing The act of sending a very small amount of data to an end point. Ping is used in computer science to illicit a response from a target server to test it’s connection. Ping is also a term used by Slack users to @ someone or send them a direct message (DM). Users might say something along the lines of “Ping me when the meeting starts.” @amykamala if you run into any issues with these new rules. Thank you all for your contributions to the Hosting team and happy contributing!