ops(ci): dependabot auto-merge lands PRs with red/pending CI — main has no branch protection or ruleset, so --auto merges immediately

[Xore]

Found during #3194 (OmniRoute docs/ops/BRANCH_PROTECTION_MAIN.md comparison).

Observed

• gh api repos/Xore/APIARY/branches/main/protection → 404 Branch not protected; gh api repos/Xore/APIARY/rulesets → empty. main has no required status checks at all.
• .github/workflows/dependabot-auto-merge.yml approves patch/minor updates and runs gh pr merge --auto --squash. With zero required checks, GitHub reports the PR mergeable immediately and the call merges on the spot instead of arming a wait.
• Dependabot PRs merged by github-actions[bot] 25–40 s after their CI started, with failures on their own head commits:

PR	Merged	Failed checks on its head
#3285 backend-compatible group	2026-09-25 06:15	backend-service, dicompot
#3288 base64 0.22→0.23	06:17	backend-service, dicompot
#3287 rand 0.9→0.10	06:20	Dashboard backend-service (Rust)
#3289 sha2 0.10→0.11	06:22	Dashboard backend-service (Rust)
#3291 actions-compatible group	06:18	backend-service, dicompot, dns-honeypot, rdp-honeypot, endlessh-honeypot, agent-intrusion-worker

Timeline for #3289: CI runs created 06:22:28, merged 06:22:56.

• main was left with a broken Rust backend until fix(backend): migrate rand call sites to 0.10 #3300 (fix(backend): migrate rand call sites to 0.10, 13:44). rand/sha2/base64 0.x minor bumps are semver-breaking in Cargo, yet fetch-metadata classifies them semver-minor — so they qualify for auto-merge.
• docs/CI-CD.md (Dependabot section) states these PRs "still wait for branch protection and all required checks" — untrue on this repo.
• The workflow's Protected branch rules not configured fallback does fire sometimes (chore(deps): bump sha2 from 0.10.9 to 0.11.0 in /arcane/home/honeypot-dashboard/backend-service #3289 carries that comment) but does not stop the merge path above.

Proposal

1. Add a ruleset on main with required status checks. Required contexts must be checks that always report (aggregate jobs), not path-filtered ones that skip, or every non-matching PR blocks forever — needs a check inventory first.
2. Until then: make the workflow refuse to merge when gh pr view --json mergeStateStatus is CLEAN with no required checks, i.e. never call gh pr merge without protection; comment instead.
3. Treat Cargo 0.x minor bumps as major for auto-merge (dependency-type/update-type + previous-version starts with 0.), or exclude Cargo from auto-merge.
4. Correct the docs/CI-CD.md Dependabot paragraph.

Refs #3194.

[Xore]

Picking this up. Plan: (1) PR adding always-reporting aggregate jobs Quality gate (quality.yml) and Containers gate (containers.yml), plus the Cargo 0.x rule in dependabot-auto-merge and the CI-CD.md correction; (2) after it merges green, a main ruleset requiring PRs + those gates (plus the existing Go formatting and tests / Scripts and Compose aggregates), no force-push, no deletion. Order matters: requiring a check before it exists on main would block every PR.

[Xore]

Status: #3336 open. It adds Quality gate and Containers gate (always-reporting aggregates), holds 0.x minor bumps in dependabot-auto-merge, and documents the ruleset contract in docs/CI-CD.md. Its own CI is the first real run of both gates. Once it's green and merged, the ruleset goes on main: PR required (0 approvals), no force-push or deletion, required contexts Quality gate, Containers gate, Go formatting and tests, Scripts and Compose (pinned to the GitHub Actions app), strict=false, no bypass actors.

[Xore]

Done

• Ruleset main protection (id 24040843) active on the default branch: PR required (0 approvals), no force-push, no deletion, no bypass actors, strict=false. Required checks, pinned to the GitHub Actions app (15368): Quality gate, Containers gate, Go formatting and tests, Scripts and Compose. gh api repos/Xore/APIARY/rules/branches/main → deletion, non_fast_forward, pull_request, required_status_checks.
• ci: always-reporting Quality/Containers gates for the main ruleset; hold 0.x minor bumps #3336 merged (478bca9e). Both new gates ran for real on it and passed, and on its first push the Quality gate correctly went red on a real failure (a docs-path check).
• Enforcement verified: fix(unsloth): cap_drop ALL + DAC_OVERRIDE, no-new-privileges, required JUPYTER_PASSWORD #3339 (open, CI pending) shows mergeStateStatus: BLOCKED. With required checks in place, gh pr merge --auto arms and waits instead of merging on the spot.
• 0.x hold verified in production: chore(deps): bump tower-http from 0.6.11 to 0.7.1 in /arcane/home/honeypot-dashboard/backend-service #3286 (tower-http 0.6.11 → 0.7.1) got the "Not auto-merging … 0.x dependency" comment after its rebase.
• docs/CI-CD.md documents the ruleset, the required contexts, the rule for adding job pairs to quality-gate, and the emergency procedure.

Heads-up for open work: any branch cut before 478bca9e lacks the gate jobs and stays BLOCKED until it's updated (gh pr update-branch, or @dependabot rebase, requested on #3290/#3286/#3100). #2641 is the one non-Dependabot PR still on an old base.

[Xore]

Correction (found while building #3324's watch, PR #3355): the description above says main was left red for about 7 hours. In fact no CI ran on main at all after those five merges. Merges made by github-actions (auto-merge armed with GITHUB_TOKEN) start no push workflows. The first push run after 06:13 was #3300's at 11:44. The ruleset fix stands (the PRs themselves were red). The untested-main gap is handled by #3355, which dispatches CI on any main head that never got a run.