Skip to content

Record branch protection as enabled on main #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
June74 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Record branch protection as enabled on main #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 21 additions & 11 deletions .github/branch-protection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,34 @@
# Branch protection

> **Status:** The required checks below are now real and verified green.
> Enablement to GitHub is pending explicit approval from the repository owner.
> **Status:** ENABLED on `main` as of 2026-08-17. The ruleset below is in
> force, and the required checks named further down are the six that gate
> every pull request into `main`.

## Enablement is pending repository owner approval
## How this came to be enabled

Originally, protection was deferred because a protection rule cannot require
status checks that do not exist, and the CI workflow did not exist yet. That
prerequisite has been satisfied: the required checks are now defined, verified
green, and documented in the section below.

The remaining gate is explicit approval from the repository owner to enable
GitHub branch protection. Until that approval is given, `main` remains
protected by process: `CONTRIBUTING.md` states that direct implementation
commits to `main` are not allowed. That rule is currently enforced by policy
and code review, not by GitHub. Independent review is performed locally with
`codex exec` after implementation and before integration, and this remains
the operative control.
The repository owner approved enablement on 2026-08-17, and the ruleset below
was applied to `main`. The rule that `CONTRIBUTING.md` publishes — that direct
implementation commits to `main` are not allowed — is therefore now enforced by
GitHub rather than by policy alone.

## Ruleset to enable in Wave C
Independent review with `codex exec` before integration remains the operative
review control. GitHub enforces that checks pass and that changes arrive by
pull request; it does not assess whether a change is correct. Required
approving reviews are set to zero because a sole maintainer cannot approve
their own pull request, so `codex exec` output recorded in the pull-request
evidence is what stands in for a human reviewer.

One limitation worth recording rather than discovering later: Wave C's own
pull request (#4) merged before protection was enabled, so the ruleset was
never exercised against the change that created it. The first pull request it
actually gates is the next one.

## The enforced ruleset

Applied to `main`:

Expand Down