From c2f8fa1f6868d4cc33fbb41014c4807590246987 Mon Sep 17 00:00:00 2001 From: bitkyc08-arch Date: Mon, 31 Aug 2026 17:49:51 +0900 Subject: [PATCH] docs(maintainers): correct the claim that this repository is unprotected MAINTAINERS.md said no branch protection rule is configured, so code-owner approval and the maintainer-approval requirement were 'a convention here, not a gate'. AGENTS.md repeated it. Both are wrong: dev, main, and preview each carry an active repository ruleset, and Protect dev (id 20763889) requires a pull request with one approving review, code-owner review, and extra approval for unattributed changes, while blocking deletion and non-fast-forward pushes. The claim was believable because rulesets do not appear in the classic /branches/{branch}/protection endpoint, which returns 404 for all three branches. Anyone checking the old way would have confirmed the sentence. Two consequences were being mis-stated. A reader was told a direct push to dev would land, when the ruleset rejects it whether or not --no-verify is used. And the maintain/admin role's pull_request bypass was undocumented, so an owner merge that skips the approval requirement looked like the documented normal case instead of an exercised bypass. The note now says it is a bypass rather than an exemption, and that using it should be recorded on the pull request. The ancestry heuristic really is convention -- it is a CI check, not a branch rule -- so that sentence is narrowed rather than reversed. --- AGENTS.md | 7 +++++-- MAINTAINERS.md | 24 +++++++++++++++++------- 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 60eec55df7..128e091223 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -305,8 +305,11 @@ repository CI; a maintainer has to — so the gate never disproves it; a new push still resets every box. A disproved claim unticks the matching box and keeps the PR a draft. Authors with repository push permission skip the ancestry heuristic only. As with approval requirements in -[`MAINTAINERS.md`](./MAINTAINERS.md), this is enforced by convention until -branch protection is configured. +[`MAINTAINERS.md`](./MAINTAINERS.md), the ancestry heuristic is a CI check +rather than a branch rule. The branches themselves are protected: `dev`, +`main`, and `preview` each carry an active ruleset requiring a reviewed pull +request and blocking force-pushes and deletion, so a direct push to `dev` is +rejected regardless of `--no-verify`. [`MAINTAINERS.md`](./MAINTAINERS.md) is authoritative for review and merge policy (approvals, CI requirements, security review, promotion). This file diff --git a/MAINTAINERS.md b/MAINTAINERS.md index 84ce21d604..f7183db6ef 100644 --- a/MAINTAINERS.md +++ b/MAINTAINERS.md @@ -52,8 +52,8 @@ when a maintainer steps down. a new push still resets every box. A disproved claim unticks the matching box and keeps the PR a draft. Authors with repository push permission skip the ancestry heuristic only. As - with the approval requirement above, this is enforced by convention until - branch protection is configured (see the note under the change log). + with the approval requirement above, this part is enforced by convention; + the ruleset does not check ancestry (see the note under the change log). - A pull request requires approval from at least one maintainer and successful required CI checks before merge. - Authors do not approve their own pull requests. @@ -160,11 +160,21 @@ Adding or removing a maintainer requires: and release automation keep the two owners already listed for those paths, so this addition does not widen the review surface for them. - CODEOWNERS requests reviews rather than enforcing them — no branch protection - rule is configured on this repository, so code-owner approval is a convention - here, not a gate. The same is true of the approval requirement in the review - and merge policy above. Widening the security boundary, or enforcing either - of these through branch protection, is a separate decision. + Code-owner approval and the maintainer-approval requirement above are both + enforced, not conventions. `dev`, `main`, and `preview` each carry an active + repository ruleset — the classic `/branches/{branch}/protection` endpoint + returns 404 for them, which is why this file long described the repository as + unprotected. `Protect dev` (id 20763889) requires a pull request with one + approving review, code-owner review, and extra approval for unattributed + changes, and it blocks deletion and non-fast-forward pushes. Allowed merge + methods are merge and squash; rebase merges are off. + + The one carve-out is that the `maintain`/`admin` repository role holds a + `pull_request` bypass, so an owner can merge without the approval the rules + otherwise require. That is a bypass, not an exemption: "Authors do not approve + their own pull requests" above still governs, and an owner who uses the bypass + should record it on the pull request rather than leave it to be inferred from + a merge timestamp. Widening the security boundary is a separate decision. ## Security reports