docs(ci): record the single branch protection mechanism - #50
Merged
Conversation
main was protected by both classic branch protection and a ruleset, each listing required checks independently, so updating one deadlocked #48 with every check green and no useful diagnostic. Classic protection is gone; the ruleset survives. Documents the thirteen required checks and the deceptive failure mode a rename produces.
AayushMainali-Github
added
type: documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents the repository protection change made for #49, and records the required checks so the next job rename does not repeat the deadlock that #48 hit.
Configuration change already applied
mainwas protected twice, by classic branch protection and by themain protectionruleset, each listing required status checks independently. Updating only one left #48 unmergeable with every check green and no useful diagnostic.Consolidated onto the ruleset, since that is the mechanism GitHub is investing in and it is discoverable under Settings → Rules:
strict_required_status_checks_policytotrueon the ruleset first, so branches must still be up to date before merging. Classic protection enforced that, and a consolidation should not quietly relax a protection.required_review_thread_resolution, deletion and force-push blocks, and no bypass actors, which is what made it apply to administrators.mainstill reports all five rules.This pull request is itself the test: it can only merge if the surviving ruleset works.
Documentation
docs/development-workflow.mdnow lists all thirteen required checks in a table with what each guards, states that the ruleset is the single mechanism, and warns not to reintroduce classic protection.It also describes the deceptive failure mode in full, since the symptom actively points away from the cause: green checks,
MERGEABLE, aSUCCESSrollup, and merging refused with only "the base branch policy prohibits the merge". The two commands for comparing required names against reported names are included, because finding that mismatch was the slow part.No changeset: documentation and repository configuration only.
Closes #49