Protect the main branch #10

Activity

1. kinlane

   added

   taskConcrete unit of workConcrete unit of work

   on Jul 30, 2026
2. kinlane commented on Aug 3, 2026

   

   kinlane

   on Aug 3, 2026

   ContributorAuthor

   More actions

   Partly done, and one acceptance criterion had to be deferred because it rested on a false premise.

   Applied to main today:

   Setting	State
   Force pushes	disabled
   Deletions	disabled
   Linear history	required
   Conversation resolution before merge	required
   Required status checks	not set — see below
   Required reviews	not set — Stage 1, per GOVERNANCE.md

   On required status checks. This issue says to require them because "commit.yml already runs tests and lint." It does not. commit.yml was filtered to pull requests targeting develop, a branch that does not exist on this fork, so no test, lint or build has ever run here — the full evidence is in #16.

   Requiring status checks today would mean requiring contexts that have never reported once, which makes every pull request permanently unmergeable. So the protection that could be applied safely was applied, and this one waits on two things in order: #16 landing so CI runs at all, then a pull request under packages/ actually going green so the context names exist and are known good. #20 is the natural candidate.

   On required reviews. Deliberately not enabled, and now written down rather than left as an unstated intention. GOVERNANCE.md makes it the Stage 1 trigger: the moment a second maintainer is added to MAINTAINERS.yaml, the review requirement goes on, enforced by the platform rather than by discipline, binding the original author identically to everyone else. That is in #19.

   On enforce_admins. Left off. With a single maintainer, enforcing protection against admins would mean every change — including the ones fixing this repository's inherited problems — needs a pull request that only that same person can approve. It buys no real safety at Stage 0 and it should be revisited at Stage 1 alongside the review requirement.

   Remaining on this issue:

   • Required status checks, once No CI has ever run on this fork — every workflow targets branches that do not exist #16 has merged and a code pull request has gone green
   • Required reviews, at Stage 1
   • enforce_admins reconsidered, at Stage 1
3. kinlane

   added 3 commits that reference this issue on Aug 3, 2026

   chore(repo): retire inherited Stoplight CI and org references (#17)

   ...

   b5dbf78

   fix(repo): let CI check its own configuration (#37)

   ...

   b5cff9f

   fix(test-harness): run the built CLI, not a packaged binary (#48)

   ...

   2a10c58
4. kinlane commented on Aug 27, 2026

   

   kinlane

   on Aug 27, 2026

   ContributorAuthor

   More actions

   Checked 2026-08-27. Four of the five acceptance criteria are already in place on this repository, and nothing recorded it here.

   Protection	State
   Force-push	disabled
   Deletion	disabled
   Linear history	required
   Conversation resolution	required
   Enforce for admins	not enforced — correct with one maintainer
   Review requirement	none — correct, per this issue's own reasoning
   Required status checks	none — this is the open item

   Why required status checks could not just be switched on today

   Two reasons, one of which has now gone away.

   1. main was red. lint has been failing on README.md since 18 August — PR #67 appended the shared API Commons footer with a list directly under a bold paragraph, which Prettier rejects. Every run since has exited 1, on post-main-merge and on every pull request opened since. Required checks cannot be turned on over a red branch. #73 fixes it in one line.

   2. The tree had never been verified. Now it has: #3 records a full run — build clean, 200/200 jest suites, 1,966 tests, 1,859/1,859 in the browser, 65/66 harness scenarios with the one failure being macOS script(1) rather than a defect. So there is now a known-good baseline to require.

   The contexts to require, once #73 lands

   From commit.yml, all currently passing:

   test-node (18.20.8)
   test-node (20.20.0)
   test-windows
   test-browser
   lint
   markdown-link-check
   

   Note test-windows does run and pass here — worth saying because it could not fire upstream.

   One thing to check before turning it on

   release.yml calls commit.yml and then pushes version-bump commits and tags to main using secrets.GH_TOKEN. With enforce_admins off, a PAT belonging to an admin bypasses required checks — so this is probably fine. Probably is doing work in that sentence, and nobody has run a release yet. If GH_TOKEN is not an admin's, the first release will fail at the push.

   spotlight-spec has a harder version of the same problem — its roadmap job pushes to main four times a day as github-actions[bot], which cannot bypass anything. The analysis and the three ways out are on spotlight-spec#6; the ruleset-with-a-bypass-list option applies here too if the GH_TOKEN answer turns out to be no.

   Where things stand

   • Required status checks before merge — unblocked once fix(repo): unbreak the lint job on main #73 merges; contexts listed above
   • Linear history required
   • Force-push disabled
   • Deletion disabled
   • Review requirement enabled as soon as there are two maintainers — still one maintainer
5. kinlane

   added 2 commits that reference this issue on Aug 27, 2026

   fix(repo): stop skipping CI on README-only pull requests

   ...

   f47596c

   fix(repo): unbreak the lint job on main (#73)

   ...

   636cf5d