ci: main does not require the CI checks, but ci.yml says it does #499

New issue

Closed

opened 2026-09-15 21:07:50 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-15 21:07:50 +00:00

Owner

What happens

Branch protection on main has enable_status_check: false and no status_check_contexts. .forgejo/workflows/ci.yml says "Required branch-protection checks are the (pull_request) contexts". That is not true today.

So a PR with a red gate can merge. On 2026-09-14, three PRs merged while ci / gate (pull_request) was failing: bba01b38, b924051f, and 5a89e5fc. main stayed red until #491.

Open question

Require the ci / gate (pull_request) and ci / mcp-conformance (pull_request) contexts on main. finish already waits for required checks and schedules auto-merge-on-green.
Keep the checks advisory, and correct the ci.yml comment.

Acceptance

Branch protection and the ci.yml comment agree.

## What happens Branch protection on `main` has `enable_status_check: false` and no `status_check_contexts`. `.forgejo/workflows/ci.yml` says "Required branch-protection checks are the `(pull_request)` contexts". That is not true today. So a PR with a red gate can merge. On 2026-09-14, three PRs merged while `ci / gate (pull_request)` was failing: bba01b38, b924051f, and 5a89e5fc. `main` stayed red until #491. ## Open question 1. Require the `ci / gate (pull_request)` and `ci / mcp-conformance (pull_request)` contexts on `main`. `finish` already waits for required checks and schedules auto-merge-on-green. 2. Keep the checks advisory, and correct the `ci.yml` comment. ## Acceptance - Branch protection and the `ci.yml` comment agree.

hexajon added the

security

status/needs-decision

labels

2026-09-15 21:07:50 +00:00

hexajon referenced this issue

2026-09-15 23:54:14 +00:00

decision: should release.sh check CI before it tags a commit? #519

hexajon referenced this issue

2026-09-16 00:19:00 +00:00

decision: should release.sh check CI before it tags a commit? #519

hexajon referenced this issue from a commit