feat: branch protection on ops repo — require admin approval for vault PRs #77

New issue

Closed

opened 2026-03-31 19:54:28 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-31 19:54:28 +00:00

Collaborator

Context

The vault PR workflow depends on Forgejo branch protection to enforce that only admin users can merge vault action PRs into main on the ops repo.

What to do

Set up branch protection on main of johba/disinto-ops via Forgejo API:
- Require 1 approval before merge
- Restrict merge to admin role (not regular collaborators or bots)
- Block direct pushes to main (all changes must go through PR)
Verify bot accounts (dev-bot, review-bot, etc.) cannot merge PRs on the ops repo
Document the protection rules in the ops repo README or a VAULT.md

Verification

Bot account cannot merge a PR on disinto-ops
Admin account (johba) can merge
Direct push to main is rejected

Dependencies

No code dependencies — can be done in parallel with other issues. But must be in place before #76 (dispatcher rewrite) is considered complete.

## Context The vault PR workflow depends on Forgejo branch protection to enforce that only admin users can merge vault action PRs into main on the ops repo. ## What to do 1. Set up branch protection on main of johba/disinto-ops via Forgejo API: - Require 1 approval before merge - Restrict merge to admin role (not regular collaborators or bots) - Block direct pushes to main (all changes must go through PR) 2. Verify bot accounts (dev-bot, review-bot, etc.) cannot merge PRs on the ops repo 3. Document the protection rules in the ops repo README or a VAULT.md ## Verification - Bot account cannot merge a PR on disinto-ops - Admin account (johba) can merge - Direct push to main is rejected ## Dependencies No code dependencies — can be done in parallel with other issues. But must be in place before #76 (dispatcher rewrite) is considered complete.