#796: CI is advisory, not a gate: no required status checks on develop (unprotected) or main - #798
Merged
JDonaghy merged 2 commits intoSep 4, 2026
Conversation
CI ran on every PR and push to main/develop but nothing enforced it: `develop` (the default branch, where every agent branch lands) had no protection object at all, and `main` had one with no `required_status_checks` key. A PR with red checks was mergeable by clicking the button. Adds the settings as reviewable, testable repo config rather than web-UI-only state: - `.github/branch-protection.json` — single source of truth: the two required contexts plus per-branch policy. `strict: true` on main (it only receives the release PR), `strict: false` on develop (strict there would force a rebase + full re-run on every open branch each time another landed). `enforce_admins: false` is #796 decision (c) — the gate binds PRs and non-admin pushes, the owner keeps a deliberate escape hatch. - `scripts/apply-branch-protection.sh` — `--dry-run` (offline preview), `--check` (audit live settings, report drift, non-zero on drift), and apply, which reads the settings back and verifies rather than trusting a 200. Idempotent. Needs an admin `gh` to apply, so the owner runs it. - `tests/branch_protection.rs` — 6 tests. The load-bearing one asserts the required contexts equal the job `name:`s in ci.yml: GitHub matches required checks by name, so a rename leaves a context that never reports and blocks EVERY PR. Confirmed non-vacuous: renaming the GUI job to "Test (Linux, headless, GTK)" turns it red. The others drive the real script and assert on the exact JSON body it PUTs, including that --dry-run never invokes gh (booby-trapped gh on PATH). - CLAUDE.md — new "Branch protection" section, and Path A is now flagged as an admin-only escape hatch that bypasses the gate. Applying the settings to GitHub is a repo-settings action outside this branch; nothing here changes the live protection state on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4 tasks
Reviewer flagged (blocking): this repo's convention is workers never edit CLAUDE.md — it's the coordinator's rulebook, and parallel worker edits collide. This repo already reverted the identical mistake once (f93fb3d, #657). Revert CLAUDE.md to its pre-#796 content; the coordinator can fold equivalent guidance in separately. Also drops the two dangling references to the now-removed CLAUDE.md "Branch protection" section (in branch-protection.json's develop comment and a test doc-comment), and softens the enforce_admins:false comment to read as #796's recommended option pending owner sign-off rather than a settled decision, per the review's non-blocking note. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #796
Automated PR opened by coordinator for review of issue #796.