docs(agents): main is protected, and correct the pending-status claim #30

Merged

jlxq0 merged 1 commit from docs-branch-protection into main

2026-08-27 02:05:57 +00:00

jlxq0 commented

2026-08-27 02:00:41 +00:00

Owner

Documentation only, and this PR is the acceptance test for the branch protection armed on main a few minutes ago: one real pull request merging under the new flags.

The rule: enable_push=false, apply_to_admins=true, enable_status_check=true, status_check_contexts=["CI / cargo*"], required_approvals=0.

Verified by pushing at it rather than by reading it back. A rule read from the server says it was stored, not that it bites. Probe branch, no rule, first push accepted; rule armed; second push:

remote: Forgejo: Not allowed to push to protected branch probe-protection
 ! [remote rejected] probe-protection -> probe-protection (pre-receive hook declined)
PUSH EXIT=1

Probe rule and probe branch deleted, git ls-remote shows only main, beta and #19's branch. Then the same against the armed main: pre-receive hook declined, exit 1.

CI / docker is excluded on purpose and the reason is in the file, because the rule shows what is required and nothing shows why something is not, and the next person tidying up adds it back.

And it corrects my own entry from earlier tonight. I wrote that a dependency-blocked status stays pending indefinitely. It does not. Measured on 287a005c: cargo failed at 15:26:25Z, docker stayed pending for 34 minutes and resolved to failure at 16:00:54Z, having never been scheduled. Long enough to be indistinguishable from a queued job, which is what cost the fifty minutes, and not permanent.

Documentation only, and **this PR is the acceptance test** for the branch protection armed on `main` a few minutes ago: one real pull request merging under the new flags. **The rule:** `enable_push=false`, `apply_to_admins=true`, `enable_status_check=true`, `status_check_contexts=["CI / cargo*"]`, `required_approvals=0`. **Verified by pushing at it rather than by reading it back.** A rule read from the server says it was stored, not that it bites. Probe branch, no rule, first push accepted; rule armed; second push: ```text remote: Forgejo: Not allowed to push to protected branch probe-protection ! [remote rejected] probe-protection -> probe-protection (pre-receive hook declined) PUSH EXIT=1 ``` Probe rule and probe branch deleted, `git ls-remote` shows only `main`, `beta` and `#19`'s branch. Then the same against the armed `main`: `pre-receive hook declined`, exit 1. **`CI / docker` is excluded on purpose and the reason is in the file**, because the rule shows what is required and nothing shows why something is not, and the next person tidying up adds it back. **And it corrects my own entry from earlier tonight.** I wrote that a dependency-blocked status stays `pending` indefinitely. It does not. Measured on `287a005c`: `cargo` failed at `15:26:25Z`, `docker` stayed `pending` for 34 minutes and resolved to `failure` at `16:00:54Z`, having never been scheduled. Long enough to be indistinguishable from a queued job, which is what cost the fifty minutes, and not permanent.

jlxq0 added 1 commit

2026-08-27 02:00:41 +00:00

docs(agents): main is protected, and correct the pending-status claim

CI / cargo (pull_request) Successful in 1m9s

Details

CI / docker (pull_request) Successful in 1m54s

Details

859b74b5ef

main now refuses direct pushes and requires CI / cargo*, with zero approvals so
merging your own work still costs nothing. The glob covers both event suffixes:
a branch push posts (push) and a pull-request head posts (pull_request), which
are different contexts for one job.

CI / docker is deliberately excluded and the reason is recorded, because the
rule shows what is required and nothing shows why something is not. Its status
is derived from cargo through needs:, so it carries no information cargo does
not, and it resolves late enough to gate merges on a lagging value. cargo is
the job that runs fmt, clippy, test, audit and deny.

And the earlier entry claiming a dependency-blocked status stays pending
indefinitely is wrong. Measured on 287a005c: cargo failed at 15:26:25Z, docker
stayed pending for 34 minutes and resolved to failure at 16:00:54Z, having
never been scheduled. Long enough to be indistinguishable from a queued job,
which is what cost the time, but not permanent.

jlxq0 merged commit 157abdf292 into main

2026-08-27 02:05:57 +00:00

jlxq0 deleted branch docs-branch-protection

2026-08-27 02:05:57 +00:00

jlxq0 referenced this pull request from a commit

2026-08-27 02:05:58 +00:00

Merge pull request 'docs(agents): main is protected, and correct the pending-status claim' (#30) from docs-branch-protection into main