docs: record branch protection on main; bump h2/quinn-proto for two advisories #2

Merged

jlxq0 merged 2 commits from arm-branch-protection into main

2026-08-27 03:01:02 +00:00

jlxq0 commented

2026-08-27 02:38:58 +00:00

Owner

Arms branch protection on main and records it in AGENTS.md.

enable_push             false
apply_to_admins         true
enable_status_check     true
status_check_contexts   ["CI / cargo*"]
required_approvals      0

docker is excluded on measurement, not preference. It has needs: cargo and if: github.event_name != 'pull_request', so on a pull request Forgejo writes CI / docker (pull_request) as pending at open time and never creates a task for it. Measured on the (now closed) probe PR #1: /actions/tasks held one row for that head sha, 17655 cargo #1 pull_request failure, and no docker row at any point. Requiring CI / docker* would block every pull request here permanently.

AGENTS.md records the cost: a broken image build no longer blocks a merge, and surfaces as a missing image at deploy time instead of a red pull request.

Also bumps h2 and quinn-proto in Cargo.lock. cargo audit had gone red against an unchanged tree since 2026-06-16 on RUSTSEC-2026-0258 (h2) and RUSTSEC-2026-0185 (quinn-proto, 7.5 high); both are transitive and clear with cargo update -p h2 -p quinn-proto. fmt, clippy, test, audit and deny check bans licenses sources all pass locally on the result.

Arms branch protection on `main` and records it in `AGENTS.md`. enable_push false apply_to_admins true enable_status_check true status_check_contexts ["CI / cargo*"] required_approvals 0 `docker` is excluded on measurement, not preference. It has `needs: cargo` and `if: github.event_name != 'pull_request'`, so on a pull request Forgejo writes `CI / docker (pull_request)` as pending at open time and never creates a task for it. Measured on the (now closed) probe PR #1: `/actions/tasks` held one row for that head sha, `17655 cargo #1 pull_request failure`, and no docker row at any point. Requiring `CI / docker*` would block every pull request here permanently. `AGENTS.md` records the cost: a broken image build no longer blocks a merge, and surfaces as a missing image at deploy time instead of a red pull request. Also bumps `h2` and `quinn-proto` in `Cargo.lock`. `cargo audit` had gone red against an unchanged tree since 2026-06-16 on RUSTSEC-2026-0258 (`h2`) and RUSTSEC-2026-0185 (`quinn-proto`, 7.5 high); both are transitive and clear with `cargo update -p h2 -p quinn-proto`. `fmt`, `clippy`, `test`, `audit` and `deny check bans licenses sources` all pass locally on the result.

jlxq0 added 1 commit

2026-08-27 02:38:58 +00:00

docs: record branch protection on main, and bump h2/quinn-proto for two advisories

CI / cargo (pull_request) Failing after 2s

Details

CI / docker (pull_request) Has been cancelled

Details

1a9576a8d4

Arms branch protection on main: push disabled, applied to admins, required
status context "CI / cargo*", zero required approvals.

docker is excluded from the gate on measurement. It has needs: cargo, and
if: github.event_name != 'pull_request' — so on a PR, Forgejo writes
CI / docker (pull_request) as pending at open time and never creates a task,
leaving it pending forever. Requiring it would block every PR permanently.
AGENTS.md records the cost of the exclusion: a broken image build no longer
blocks a merge and surfaces as a missing image at deploy time.

cargo audit had gone red against an unchanged tree since 2026-06-16, on
RUSTSEC-2026-0258 (h2) and RUSTSEC-2026-0185 (quinn-proto, 7.5 high). Both
are transitive and clear with a lockfile bump; fmt, clippy, test, audit and
deny all pass locally on the result.

jlxq0 referenced this pull request from a commit

2026-08-27 02:49:15 +00:00

fix(ci): repin rust-toolchain to an append-only ref; the stable pin 404s

jlxq0 added 1 commit

2026-08-27 02:49:15 +00:00

fix(ci): repin rust-toolchain to an append-only ref; the stable pin 404s

CI / cargo (pull_request) Successful in 3m41s

Details

CI / docker (pull_request) Has been skipped

Details

51b28d5093

The mirror at forge.oddie.app prunes force-pushed tips, so
29eef336d9b2848a0b548edc03f92a220660cdb8 (taken from dtolnay's stable branch,
green 2026-06-16) now 404s. A pin that does not resolve kills the job about two
seconds after it starts, with no steps and no error, and this instance does not
serve job logs. PRs #1 and #2 both failed that way.

Repins to 6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 (master/v1, append-only) with
an explicit toolchain: "1.98.0", matching matrix-mcp. That ref carries no
default toolchain, and an exact version keeps a new clippy release from redding
open pull requests under RUSTFLAGS: -Dwarnings.

Also corrects the AGENTS.md note on docker: the task is created on a pull
request and resolves 'skipped'; what stays pending forever is the commit status
Forgejo writes for it. Task 17683 reached skipped at 02:32:55 and the status
written at 02:32:55 read pending.

jlxq0 merged commit 794a25b685 into main

2026-08-27 03:01:02 +00:00

jlxq0 deleted branch arm-branch-protection

2026-08-27 03:01:02 +00:00

jlxq0 referenced this pull request from a commit

2026-08-27 03:01:04 +00:00

Merge pull request 'docs: record branch protection on main; bump h2/quinn-proto for two advisories' (#2) from arm-branch-protection into main