Skip to content

fix(branch-protection): stop requiring a conditionally-posted status context #2872

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stranske merged 1 commit into from
Aug 1, 2026
Merged

fix(branch-protection): stop requiring a conditionally-posted status context #2872

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/config/required-contexts.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"required_contexts": [
"Gate / gate",
"Health 45 Agents Guard / guard"
]
"Gate / gate"
],
"_note": "Only universally-posted contexts belong here: health-44 can pass this file to enforce_gate_branch_protection.py --apply, so any context listed becomes a REQUIRED status check. 'Health 45 Agents Guard / guard' is deliberately absent: agents-guard.yml posts that status only when the PR carries an agent label (agent:codex, agents:auto-pilot, ...), so requiring it would leave every other PR permanently un-mergeable. See issue #2858."

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the universally posted guard check required

For an agent-labelled PR that violates the guard policy, this removal allows the PR to merge once Gate passes even though the guard job fails. In .github/workflows/agents-guard.yml, the workflow is triggered for every pull request and the guard job itself has no job-level condition; only the legacy commit-status reporting step is conditional. Consequently, Health 45 Agents Guard / guard is also emitted as a workflow check run on every PR, so its absence from the commit statuses API does not show that the required check is missing. Retain this required context so the failure at the workflow's final guard step continues to block protected changes.

Useful? React with 👍 / 👎.

}
10 changes: 8 additions & 2 deletions .github/workflows/health-40-repo-selfcheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,6 @@ jobs:
--apply \
--branch "${DEFAULT_BRANCH}" \
--context "Gate / gate" \
--context "Health 45 Agents Guard / guard" \
--no-clean

- name: Snapshot branch protection state
Expand All @@ -134,7 +133,6 @@ jobs:
--require-strict \
--branch "${DEFAULT_BRANCH}" \
--context "Gate / gate" \
--context "Health 45 Agents Guard / guard" \
--no-clean \
--snapshot repo-health-branch-protection.json

Expand Down Expand Up @@ -403,6 +401,14 @@ jobs:
core.setOutput('branch_fetch_error', branchFetchError || '');

- name: Root allowlist guard
# `always()` so an earlier failure (e.g. the branch-protection snapshot)
# cannot silently skip this guard. That is how six unlisted root files
# accumulated undetected for a month — see #2858. NOTE: this only rescues
# THIS step; "Collect repository signals" and "Aggregate & Summarize"
# still skip when an earlier step fails, because the aggregate depends on
# the collect step's outputs. Making the whole job resilient needs a
# different shape than a per-step always().
if: always()
# Fail when a tracked file appears at the repo root (depth 0) that is
# not on the reviewed allowlist (config/root-allowlist.txt). Keeps
# one-off debris (stray fixer scripts, per-run CI snapshots, *.patch)
Expand Down
8 changes: 5 additions & 3 deletions tools/enforce_gate_branch_protection.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,10 @@ def resolve_api_root(explicit: str | None = None) -> str:


DEFAULT_CONTEXTS = (
# Only universally-posted contexts may be required. "Health 45 Agents Guard /
# guard" is posted by agents-guard.yml ONLY for agent-labelled PRs, so requiring
# it would block every other PR forever (issue #2858).
"Gate / gate",
"Health 45 Agents Guard / guard",
)

DEFAULT_CONFIG_PATH = Path(".github/config/required-contexts.json")
Expand Down Expand Up @@ -248,7 +250,7 @@ def _fetch_ruleset_status_checks(

Example return values:
- None: No rulesets found, or no rulesets apply to the branch, or no status checks required.
- StatusCheckState(strict=False, contexts=['Gate / gate', 'Health 45 Agents Guard / guard']):
- StatusCheckState(strict=False, contexts=['Gate / gate', 'summary']):
Required status checks found for the branch, with strict mode disabled.
- StatusCheckState(strict=True, contexts=['ci/test', 'lint']):
Required status checks found for the branch, with strict mode enabled.
Expand Down Expand Up @@ -643,7 +645,7 @@ def main(argv: Sequence[str] | None = None) -> int:
action="append",
help=(
"Status check context to require. May be passed multiple times. Defaults to"
" 'Gate / gate' and 'Health 45 Agents Guard / guard'."
" 'Gate / gate'."
),
)
parser.add_argument(
Expand Down
Loading