Skip to content

docs: mark main branch-protection debt as resolved#189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BigSimmo merged 4 commits into from
Jul 2, 2026
Merged

docs: mark main branch-protection debt as resolved #189

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
097b107
docs: mark main branch-protection debt as resolved
BigSimmo Jul 2, 2026
1af85cd
docs: clarify branch protection bypass scope
BigSimmo Jul 2, 2026
6266a41
Merge remote-tracking branch 'origin/main' into claude/doc-protection…
BigSimmo Jul 2, 2026
652fcbf
Merge remote-tracking branch 'origin/claude/doc-protection-applied' i…
BigSimmo Jul 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/process-hardening.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -73,7 +73,7 @@ This document turns the current process review into phased, durable repo practic

- CI is now two parallel PR jobs instead of one serial 6-7 minute job: `verify` (runtime alignment, edge typecheck, CI-safe production readiness, lint, typecheck, unit tests with coverage gate, build — ~3 min) and `ui-smoke` (Chromium Playwright smoke against its own dev server — ~4.5 min). Wall-clock PR feedback drops to the slower of the two, and a flaky smoke rerun no longer repeats lint/typecheck/tests/build.
- The deployment boot smoke and full browser matrix remain gated to `main`, `release/*`, manual dispatch, and the weekly schedule — they are deliberately not PR gates.
- **Required-check debt (the reason #131/#133 merged red): `main` has no branch protection.** The intended configuration is a ruleset/branch protection on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches). Until that is applied in repo settings, CI remains advisory. Note: once applied, direct pushes to `main` are blocked for non-bypass users; repository admins retaining the bypass (`enforce_admins` OFF) can still push directly but should prefer PRs to preserve the required-check gate.
- **Required-check debt: RESOLVED 2026-07-02.** Branch protection is now applied on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches), `enforce_admins` OFF (admin bypass retained as an emergency hatch), and no required PR-review count (a solo+agents flow has no second human approver). This closes the gap that let #131/#133 merge red. Consequence now in effect: **direct pushes to `main` are blocked for non-bypass users; normal work must land via PR.** Repository admins can still use the retained bypass only as an emergency hatch. To adjust, edit the rule under repo Settings → Branches or via `gh api -X PUT repos/BigSimmo/Database/branches/main/protection`.
Comment thread
BigSimmo marked this conversation as resolved.
- If `ui-smoke` proves flaky as a required check, demote it to advisory (remove from required contexts) rather than tolerating red merges — the deterministic `verify` gate stays required regardless.

## CSS cascade layering (2026-07-02)
Expand Down
Loading