docs(agents): record why branch protection requires cargo and not docker #13

Merged

jlxq0 merged 1 commit from docs/branch-protection-note into main

2026-08-27 02:03:19 +00:00

jlxq0 commented

2026-08-27 02:00:40 +00:00

Owner

Branch protection is now armed on main (enable_push=false, apply_to_admins=true, enable_status_check=true, status_check_contexts=["CI / cargo*"], required_approvals=0). This records why CI / docker is excluded, since the rule can show what is required but not why something is absent.

The measurement

docker carries needs: cargo (.forgejo/workflows/ci.yml:74). A Forgejo job skipped because the job it needs failed still posts success to the commit status. Six commits in this repo, both event types, 2026-08-16 to 2026-08-25:

commit	branch	cargo	docker	tasks created
`83396b91`	main	failure	success	cargo only
`c0a9353d`	main	failure	success	cargo only
`cf08af4d`	v0.2.8	failure	success	cargo only
`53bd20a5`	#10	failure	success	cargo only
`d394adfd`	#10	failure	success	cargo only
`01f77e76`	#11	failure	success	cargo only

Requiring CI / docker would build a gate satisfied by a commit where nothing was built.

The glob is needed because the event suffix differs: CI / cargo (push) on a branch push, CI / cargo (pull_request) on a PR head. Those four are the only contexts this repo has ever posted.

Acceptance

The rule was not trusted from a read-back. On a throwaway branch probe/bp-20260827: push one with no rule succeeded at exit 0; the rule was armed with these exact flags; push two, the same command, was refused.

remote: Forgejo: Not allowed to push to protected branch probe/bp-20260827
 ! [remote rejected] (pre-receive hook declined)
exit=1

Remote head stayed at push ones sha while local advanced. Probe rule and probe branch then deleted, git ls-remote back to the four pre-existing heads.

Repeated against the real rule on main: this commit was made on main and git push origin main was refused with Not allowed to push to protected branch main, exit 1, remote main unmoved at e48b733d. The token holds admin, so apply_to_admins=true is proven rather than assumed. The commit was then moved here.

Docs only.

Branch protection is now armed on `main` (`enable_push=false`, `apply_to_admins=true`, `enable_status_check=true`, `status_check_contexts=["CI / cargo*"]`, `required_approvals=0`). This records why `CI / docker` is excluded, since the rule can show what is required but not why something is absent. ## The measurement `docker` carries `needs: cargo` (`.forgejo/workflows/ci.yml:74`). A Forgejo job skipped because the job it needs failed still posts `success` to the commit status. Six commits in this repo, both event types, 2026-08-16 to 2026-08-25: | commit | branch | cargo | docker | tasks created | |---|---|---|---|---| | `83396b91` | main | failure | **success** | cargo only | | `c0a9353d` | main | failure | **success** | cargo only | | `cf08af4d` | v0.2.8 | failure | **success** | cargo only | | `53bd20a5` | #10 | failure | **success** | cargo only | | `d394adfd` | #10 | failure | **success** | cargo only | | `01f77e76` | #11 | failure | **success** | cargo only | Requiring `CI / docker` would build a gate satisfied by a commit where nothing was built. The glob is needed because the event suffix differs: `CI / cargo (push)` on a branch push, `CI / cargo (pull_request)` on a PR head. Those four are the only contexts this repo has ever posted. ## Acceptance The rule was not trusted from a read-back. On a throwaway branch `probe/bp-20260827`: push one with no rule succeeded at exit 0; the rule was armed with these exact flags; push two, the same command, was refused. ``` remote: Forgejo: Not allowed to push to protected branch probe/bp-20260827 ! [remote rejected] (pre-receive hook declined) exit=1 ``` Remote head stayed at push ones sha while local advanced. Probe rule and probe branch then deleted, `git ls-remote` back to the four pre-existing heads. Repeated against the real rule on `main`: this commit was made on `main` and `git push origin main` was refused with `Not allowed to push to protected branch main`, exit 1, remote `main` unmoved at `e48b733d`. The token holds admin, so `apply_to_admins=true` is proven rather than assumed. The commit was then moved here. Docs only.

jlxq0 added 1 commit

2026-08-27 02:00:40 +00:00

docs(agents): record why branch protection requires cargo and not docker

CI / cargo (pull_request) Successful in 2m26s

Details

CI / docker (pull_request) Successful in 27s

Details

37b0cdb987

A Forgejo job skipped because the job it needs failed still posts success to
the commit status. Measured on six commits here: cargo=failure beside
docker=success, with no docker task created for the sha. Requiring CI / docker
would build a gate satisfied by a commit where nothing was built.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

jlxq0 merged commit 8842f92ef3 into main

2026-08-27 02:03:19 +00:00

jlxq0 deleted branch docs/branch-protection-note

2026-08-27 02:03:20 +00:00

jlxq0 referenced this pull request from a commit

2026-08-27 02:03:20 +00:00

Merge pull request 'docs(agents): record why branch protection requires cargo and not docker' (#13) from docs/branch-protection-note into main

jlxq0 referenced this pull request

2026-08-27 02:09:38 +00:00

docs(agents): mergeable=true is not the merge gate #15

jlxq0 referenced this pull request from a commit

2026-08-27 02:09:39 +00:00