feat(20d): branch protection on .profile repos — admin-only formula merge #87

New issue

Closed

opened 2026-04-01 06:32:43 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-01 06:32:43 +00:00

Collaborator

Parent

Part of #20 — agent .profile repo.

What to do

Set up branch protection on main of each .profile repo so that formula changes require human (admin) approval:

Add branch protection setup to disinto hire-an-agent — after creating the .profile repo, configure main branch:
- Require 1 approval before merge
- Restrict merge to admin role
The agent needs to push journal entries directly (no PR for every session log). Two approaches:
- A) Journal writes go to an unprotected journal branch, formula changes go through PR to main
- B) Give the agent push access to main but protect merges of PRs that touch formula.toml
- C) Protect only formula.toml via path-based rules (if Forgejo supports it)
  Pick whichever Forgejo supports. If path-based protection is not available, use approach A.

Verification

Agent cannot directly push changes to formula.toml on main
Agent can push journal entries (directly or via unprotected branch)
Admin can merge formula PRs

Dependencies

Depends on #84 (hire-an-agent — .profile repos must exist).

## Parent Part of #20 — agent .profile repo. ## What to do Set up branch protection on `main` of each `.profile` repo so that formula changes require human (admin) approval: 1. Add branch protection setup to `disinto hire-an-agent` — after creating the .profile repo, configure main branch: - Require 1 approval before merge - Restrict merge to admin role 2. The agent needs to push journal entries directly (no PR for every session log). Two approaches: - A) Journal writes go to an unprotected `journal` branch, formula changes go through PR to `main` - B) Give the agent push access to main but protect merges of PRs that touch formula.toml - C) Protect only `formula.toml` via path-based rules (if Forgejo supports it) Pick whichever Forgejo supports. If path-based protection is not available, use approach A. ## Verification - Agent cannot directly push changes to `formula.toml` on main - Agent can push journal entries (directly or via unprotected branch) - Admin can merge formula PRs ## Dependencies Depends on #84 (hire-an-agent — .profile repos must exist).