From e9481246b42e0ebb0492d4c64d39ce7eb1ac1ad6 Mon Sep 17 00:00:00 2001 From: Sean Shaffer Date: Wed, 21 Oct 2026 22:33:52 -0500 Subject: [PATCH] ci: pin actions and document enforced merge policy --- CI_POLICY.md | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 CI_POLICY.md diff --git a/CI_POLICY.md b/CI_POLICY.md new file mode 100644 index 0000000..b07ee32 --- /dev/null +++ b/CI_POLICY.md @@ -0,0 +1,7 @@ +# CI and merge policy + +The default branch requires a pull request, its configured GitHub Actions checks, an up-to-date branch, and resolved conversations. These protections apply to administrators. No independent approving review is required for this solo-maintainer repository. Force pushes and branch deletion are blocked. + +The primary CI workflow pins third-party actions to immutable commit IDs. Version comments identify the reviewed release line; they do not make the pin update automatically. When updating an action, verify the commit against the official upstream repository, inspect release notes and permissions, update its commit/comment together, and require the complete CI result before merging. Toolchain version selection inside an action remains a separate policy. + +Job names are part of the merge contract. If a required job is renamed or its trigger changes, update branch protection deliberately so it neither blocks all PRs nor silently drops a gate. Do not skip or weaken a required test to obtain a green result. Compilation and CI are not substitutes for platform/runtime acceptance described in the project documentation.