Repository navigation
Require status checks in the main ruleset #166
Description
Context and request
Protect main so a pull request cannot merge until the repository's CI checks succeed. At the recorded baseline, the inherited ruleset required a pull request and approval but declared no required status checks, allowing auto-merge to land on approval alone. The approved repository-only supplemental rule now enforces the existing PR checks; the operational audit below records its scope and verification. #147 documents this gap; it does not change repository governance.
Acceptance criteria
- The
mainruleset requires the CI status checks that verify this repository's pull requests. - An auto-merge waits for those checks and the existing approval requirements.
- A pull request with a failing, pending, or absent required check cannot merge.
- The configured checks match the jobs currently expected by the repository's pull-request workflow.
- The change and its verification have durable audit evidence on this issue.
Constraints and non-goals
- Configure governance for
MSXOrg/docsonly; do not change workflow triggers or rulesets in other repositories. - Do not modify the documentation delivered by 📖 [Docs]: Ready-for-review guidance now rejects missing CI checks #147.
- Release branches have no CI and no branch protection, and no checks are required anywhere PSModule/Yaml#54 tracks the separate workflow-trigger and ruleset work in
PSModule/Yaml.
Technical decisions
This is an operational Task: the deliverable is a GitHub ruleset configuration, not a repository file. The user approved adding a repository-only supplemental rule for refs/heads/main, because the existing GitHub Flow rule is organization-wide and must remain unchanged. Require Lint, Links, Test, Build, and Cross-repository links from GitHub Actions integration 15368, with no bypass actors. Preserve the existing deletion, non-fast-forward, linear-history, code-owner, last-push approval, stale-review dismissal, thread-resolution, and squash-only rules. Verify scope and enforcement through live rules/check-context reads and GitHub documented status-check semantics; do not attempt a merge or inject CI failures solely to test governance.
Implementation plan
- Record the existing
mainruleset and CI check names as the baseline verification evidence. - Configure the
mainruleset to require the selected CI status checks. - Verify against a pull request that auto-merge and manual merge remain blocked while a required check is pending, failing, or absent.
- Verify that merge is permitted only after every required check succeeds and the existing approval requirements are met.
- Add an audit comment with the ruleset evidence and independent verification result.
Activity
📖 [Docs]: Release notes carry complete consumer adoption evidence (#204)
MariusStorhaug commentedon Oct 31, 2026
Applied the user-approved repository-only CI rule at 2026-10-31T11:48:48.0617336Z, through the linked Marius Storhaug (@MariusStorhaug) account.
Baseline:
MSXOrg/docs/maininherited active organization rulesetGitHub Flow(19735160), with deletion, non-fast-forward, linear-history, and pull-request rules but no required status checks. No repository ruleset existed.Change: Added main CI checks as an active repository ruleset scoped only to
refs/heads/main. It requiresLint,Links,Test,Build, andCross-repository links, each bound to the verified GitHub Actions integration 15368. The skippedPublishjob and dynamic per-linter status names are not required. No bypass actors were added; the API reportscurrent_user_can_bypass: never. No additional up-to-date-branch policy was enabled.Read-back evidence:
GET /repos/MSXOrg/docs/rulesets/26269003returns the exact source, target, five contexts and empty bypass list.GET /repos/MSXOrg/docs/rules/branches/mainincludes those required checks plus the original inherited rules. The non-targetrelease-check-scope-controlbranch evaluation contains no required-status-check rule. Ruleset listing still shows the original organization rule unchanged alongside the new repository-only rule.The existing contexts and source integration were confirmed against PR #209's published check runs. Independent gate verification is still pending; this comment records the operational change, not completion of every acceptance criterion. No pull request was merged, no CI result was altered, and no organization-wide rule was edited.
MariusStorhaug commentedon Oct 31, 2026
Independent read-only verification completed at 2026-10-31T11:56:05.3698669Z by the canonical-contract delivery session, separate from the configuration actor.
This verifies the applied configuration, real context/source binding, scope, and enforcement contract. No live rejected merge attempt, injected failed/missing CI case, approval bypass, or merge was performed or claimed. Closing this operational configuration Task does not mark PR #209, #196, or #208 ready; their actual CI/review gates remain separate.
Pull request guidance describes complete source-bound records (#209)