Require branches to be up to date before merge across the protected fleet #815

New issue

Closed

opened 2026-08-13 09:58:30 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-13 09:58:30 +00:00

Member

DESIRED_RULE in scripts/forgejo-branch-protection.py already owns block_on_outdated_branch and actively drives it to False on every protected repo. Flip it to True so a pull request whose base branch has moved cannot merge until its head is updated.

Why

Today a pull request can go green against a base that no longer exists by the time it merges. CI proves the branch was good, not that the merge result is good. Requiring the branch to be current closes that gap: the tree CI tested is the tree that lands.

Scope

Fleet-wide, every repo the converge covers. The field is already in DESIRED_RULE, so this is a one-value flip rather than a new claim on server state, and no repo needs opting in.

What this does not change

enable_push stays True, so ordinary fast-forward pushes to a protected default branch keep working for any write user. The gate binds pull request merges only.

That matters because the fleet's automated writers push directly rather than through pull requests: the containerized dispatch implementer lands on main, and tap and scoop bumps push straight to their protected default branches. A grep across the CI of agentic-os, deploy, and infrastructure found no automated pull request merges, so nothing merges unattended today that this would start blocking.

required_approvals stays 0. This adds no review gate.

Cost

On a fast-moving repo a pull request will need its branch updated when main advances underneath it. Every affected repo already allows update-by-rebase, so the web UI update button covers it. This is the intended trade: the churn is the price of the merged tree being the tested tree.

Also needs updating

The rule's own documentation describes it as a force-push and deletion boundary only, which stops being the whole truth:

the module docstring in scripts/forgejo-branch-protection.py
.agents/skills/forgejo-admin/references/forgejo-branch-protection.md
.agents/skills/forgejo-admin/SKILL.md, which states the rule does not gate the PR lane

scripts/forgejo_branch_protection_test.py covers the engine rather than the policy values, so it needs no change.

Rollout

The converge is the rollout and needs the attended admin-token shell. Land the change, then run ward exec forgejo-branch-protection -- --dry-run to preview the fleet diff, then apply.

`DESIRED_RULE` in `scripts/forgejo-branch-protection.py` already owns `block_on_outdated_branch` and actively drives it to `False` on every protected repo. Flip it to `True` so a pull request whose base branch has moved cannot merge until its head is updated. ## Why Today a pull request can go green against a base that no longer exists by the time it merges. CI proves the branch was good, not that the merge result is good. Requiring the branch to be current closes that gap: the tree CI tested is the tree that lands. ## Scope Fleet-wide, every repo the converge covers. The field is already in `DESIRED_RULE`, so this is a one-value flip rather than a new claim on server state, and no repo needs opting in. ## What this does not change `enable_push` stays `True`, so ordinary fast-forward pushes to a protected default branch keep working for any write user. The gate binds pull request merges only. That matters because the fleet's automated writers push directly rather than through pull requests: the containerized dispatch implementer lands on `main`, and tap and scoop bumps push straight to their protected default branches. A grep across the CI of agentic-os, deploy, and infrastructure found no automated pull request merges, so nothing merges unattended today that this would start blocking. `required_approvals` stays `0`. This adds no review gate. ## Cost On a fast-moving repo a pull request will need its branch updated when `main` advances underneath it. Every affected repo already allows update-by-rebase, so the web UI update button covers it. This is the intended trade: the churn is the price of the merged tree being the tested tree. ## Also needs updating The rule's own documentation describes it as a force-push and deletion boundary only, which stops being the whole truth: - the module docstring in `scripts/forgejo-branch-protection.py` - `.agents/skills/forgejo-admin/references/forgejo-branch-protection.md` - `.agents/skills/forgejo-admin/SKILL.md`, which states the rule does not gate the PR lane `scripts/forgejo_branch_protection_test.py` covers the engine rather than the policy values, so it needs no change. ## Rollout The converge is the rollout and needs the attended admin-token shell. Land the change, then run `ward exec forgejo-branch-protection -- --dry-run` to preview the fleet diff, then apply. Related: https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os/issues/994

coilyco-ops referenced this issue from a commit

2026-08-13 10:07:30 +00:00

feat(forgejo): require branches to be up to date before merge

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-13 10:07:49 +00:00

feat(forgejo): require branches to be up to date before merge #816