pdurlej/platform

Fork 0

ops(forgejo): enable branch protection on `main` with `base-is-main / guard` required (QUEUED — post-RS2000 cutover only) #243

New issue

Closed

opened 2026-05-12 08:17:04 +02:00 by claude · 2 comments

claude commented

2026-05-12 08:17:04 +02:00

Collaborator

Owner action required (NOT NOW — read below)

This issue tracks the operator-action follow-up auto-opened by ADR-0017 (PR #220) when the stack-guard layers ship.

Timing constraint (per operator decision 2026-05-12 ~02:15 CEST):

"Nie chcę tego teraz zmienić, ponieważ kodeks zbliża się do przepinki RS2000 i nie chcę wprowadzać żadnych zmian w tym momencie, bo jak możesz się domyślić to jest cholernie delikatna operacja."

DO NOT execute this issue until ALL of these are true:

Codex's PR #215 (Phase 3 apply stack rescue) merged to main
First platformctl apply cutover on RS2000 completes successfully (the rescue ships the apply pipeline; cutover is its first real use)
Post-cutover smoke pass: at least 24h of stable RS2000 state after cutover
Recovery batches (#216-#218 + any follow-ups) all merged
No active in-flight stacked PR work (operator confirms)

Reason: enabling required status checks right now could block Codex's in-flight PRs (the new base-is-main workflow may not yet have run on PRs opened before ADR-0017 merge, producing missing-required-status-check failures). Operator's intent: zero changes during the cutover window.

When you're ready to execute (~30 seconds)

Open: https://git.pdurlej.com/pdurlej/platform/settings/branches
Edit (or create) the protection rule for branch main
Enable: ☑ "Require status checks to pass before merging"
Add to required contexts list:
- base-is-main / guard
Optional but recommended: also require these contexts (already running on all PRs):
- canary-required / collect-diff
- canary-required / canary
Click "Save"
Comment on this issue with done — branch protection active YYYY-MM-DD HH:MM and close.

Verification (post-enable)

Open a deliberately-stacked test PR (e.g., a no-op branch from main rebased onto a feature branch with base: <feature-branch>). Expected:

base-is-main / guard status check returns red
Forgejo UI Merge button is disabled for that PR
After applying label tier/stacked to the test PR, status check turns green (escape hatch verified)

Then close the test PR without merging.

What this issue is NOT

NOT a code change. Pure Forgejo settings UI action.
NOT urgent. ADR-0017's Layer 2 (post-merge audit) runs regardless of branch protection and provides the detection backup until enablement.
NOT blocking any current Codex work.

References

PR #220 (ADR-0017 — no stacked PRs to main + 4-layer guard) — once merged, ship this issue
PR #215 (Codex's Phase 3 apply stack rescue) — must merge + cutover before enabling protection
decisions/0017-no-stacked-prs-to-main.md § Consequences > Negative > "Forgejo branch protection toggle is operator-action"
state/pan-herbatka-day1-checklist.md § 13 (operator pre-merge mental check; works even before protection enabled)

🍵 — auto-opened by Pan Herbatka 2026-05-12 ~02:20 CEST, per ADR-0017 acceptance criterion.

## Owner action required (NOT NOW — read below) This issue tracks the operator-action follow-up auto-opened by ADR-0017 (PR #220) when the stack-guard layers ship. **Timing constraint** (per operator decision 2026-05-12 ~02:15 CEST): > *"Nie chcę tego teraz zmienić, ponieważ kodeks zbliża się do przepinki RS2000 i nie chcę wprowadzać żadnych zmian w tym momencie, bo jak możesz się domyślić to jest cholernie delikatna operacja."* **DO NOT execute this issue until ALL of these are true:** - [ ] Codex's PR #215 (Phase 3 apply stack rescue) merged to main - [ ] First `platformctl apply` cutover on RS2000 completes successfully (the rescue ships the apply pipeline; cutover is its first real use) - [ ] Post-cutover smoke pass: at least 24h of stable RS2000 state after cutover - [ ] Recovery batches (#216-#218 + any follow-ups) all merged - [ ] No active in-flight stacked PR work (operator confirms) Reason: enabling required status checks **right now** could block Codex's in-flight PRs (the new `base-is-main` workflow may not yet have run on PRs opened before ADR-0017 merge, producing missing-required-status-check failures). Operator's intent: zero changes during the cutover window. --- ## When you're ready to execute (~30 seconds) 1. Open: https://git.pdurlej.com/pdurlej/platform/settings/branches 2. Edit (or create) the protection rule for branch `main` 3. Enable: ☑ "Require status checks to pass before merging" 4. Add to required contexts list: - `base-is-main / guard` 5. Optional but recommended: also require these contexts (already running on all PRs): - `canary-required / collect-diff` - `canary-required / canary` 6. Click "Save" 7. Comment on this issue with `done — branch protection active YYYY-MM-DD HH:MM` and close. ## Verification (post-enable) Open a deliberately-stacked test PR (e.g., a no-op branch from `main` rebased onto a feature branch with `base: <feature-branch>`). Expected: - `base-is-main / guard` status check returns **red** - Forgejo UI Merge button is **disabled** for that PR - After applying label `tier/stacked` to the test PR, status check turns green (escape hatch verified) Then close the test PR without merging. ## What this issue is NOT - NOT a code change. Pure Forgejo settings UI action. - NOT urgent. ADR-0017's Layer 2 (post-merge audit) runs regardless of branch protection and provides the detection backup until enablement. - NOT blocking any current Codex work. ## References - PR #220 (ADR-0017 — no stacked PRs to main + 4-layer guard) — once merged, ship this issue - PR #215 (Codex's Phase 3 apply stack rescue) — must merge + cutover before enabling protection - `decisions/0017-no-stacked-prs-to-main.md` § Consequences > Negative > "Forgejo branch protection toggle is operator-action" - `state/pan-herbatka-day1-checklist.md` § 13 (operator pre-merge mental check; works even before protection enabled) 🍵 — auto-opened by Pan Herbatka 2026-05-12 ~02:20 CEST, per ADR-0017 acceptance criterion.

claude added the

owner-attention

label

2026-05-12 08:17:27 +02:00

claude referenced this issue

2026-05-12 08:17:27 +02:00

governance: ADR-0017 — no stacked PRs to main + 4-layer guard (operator-protection) #220

claude referenced this issue

2026-05-12 08:17:27 +02:00

fix(platformctl): land Phase 3 apply stack on main #215

claude referenced this issue

2026-05-17 17:23:10 +02:00

docs(specs): prebuild for #243 branch protection main with base-is-main guard #327

claude referenced this issue from a commit

2026-05-17 17:27:07 +02:00

docs(specs): prebuild for #243 branch protection main base-is-main guard

claude referenced this issue

2026-05-17 17:27:24 +02:00

docs(specs): prebuild for #243 branch protection main with base-is-main guard #330

claude referenced this issue

2026-05-17 21:29:20 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237) #349

claude referenced this issue

2026-05-17 22:30:03 +02:00

docs(specs): ops prebuild for #49 ADR-0002 CI enforcement rollout #353

claude referenced this issue

2026-05-17 22:30:24 +02:00

docs(specs): bug-shaped prebuild for ADR-0018 mechanical enforcement guard (DeepSeek #11) #354

claude referenced this issue

2026-05-17 22:30:50 +02:00

docs(state): cross-ref agent-souls + practices in ANY-COUSIN-WAKEUP.md #355

claude referenced this issue

2026-05-17 22:43:36 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237) #335

claude referenced this issue

2026-05-17 22:43:42 +02:00

docs(specs): prebuild for #243 branch protection main with base-is-main guard #330

claude referenced this issue from a commit

2026-05-18 08:16:41 +02:00

docs(specs): bug prebuild for #86 security-sensitive label routing enforcement

claude referenced this issue

2026-05-18 08:17:06 +02:00

docs(specs): bug prebuild for #86 security-sensitive label routing enforcement #364

pdurlej commented

2026-05-18 16:58:51 +02:00

Owner

Codex live audit: branch protection is now live — 2026-05-18 16:56 CEST

Verified through Forgejo API:

main.protected = true
required_approvals = 1
enable_status_check = true
required context includes base-is-main / guard

This part appears complete. If no other branch-protection requirements are intended here, this issue can be updated/closed after an operator confirms the UI matches the API.

Caveat: this does not mean full canary enforcement is complete. canary-required.yml is still scaffold/readiness-only and the Infisical canary env file is missing.

## Codex live audit: branch protection is now live — 2026-05-18 16:56 CEST Verified through Forgejo API: - `main.protected = true` - `required_approvals = 1` - `enable_status_check = true` - required context includes `base-is-main / guard` This part appears complete. If no other branch-protection requirements are intended here, this issue can be updated/closed after an operator confirms the UI matches the API. Caveat: this does not mean full canary enforcement is complete. `canary-required.yml` is still scaffold/readiness-only and the Infisical canary env file is missing.

codex added this to the 06 - Agent execution and CI governance milestone

2026-05-19 08:36:30 +02:00

pdurlej referenced this issue from a commit

2026-05-23 09:19:03 +02:00

Merge pull request 'docs(specs): prebuild for #243 branch protection main with base-is-main guard' (#330) from claude/c-batch/canary-pr-body-context-bug-prebuild into main

codex referenced this issue

2026-05-24 21:34:32 +02:00

docs(w6): record CI required-check guardrails #451

codex commented

2026-05-27 09:17:03 +02:00

Collaborator

W9 issue cleanup: closing as done/superseded.

Reason: Branch protection on main is already active with required status checks.

Evidence: Forgejo branches/main API: protected=true, required_approvals=1, enable_status_check=true, required contexts include 'base-is-main / guard (pull_request)' and 'patchwarden-pr-sanity / sanity (pull_request)'.

If this becomes relevant again, reopen with current acceptance criteria or create a smaller fresh issue from current main.

W9 issue cleanup: closing as done/superseded. Reason: Branch protection on main is already active with required status checks. Evidence: Forgejo branches/main API: protected=true, required_approvals=1, enable_status_check=true, required contexts include 'base-is-main / guard (pull_request)' and 'patchwarden-pr-sanity / sanity (pull_request)'. If this becomes relevant again, reopen with current acceptance criteria or create a smaller fresh issue from current main.

codex closed this issue

2026-05-27 09:17:03 +02:00