gsadmin/PSProxmoxVE
1
0
Fork 0
mirror of https://github.com/GoodOlClint/PSProxmoxVE.git synced 2026-09-04 03:05:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: record the branch protection that is actually configured (#133)

Browse Source 
* docs: record the branch protection that is actually configured

CLAUDE.md has claimed since March that main had 'required build checks,
required review, admin enforced'. Two of those three were wrong: direct pushes
to main were still permitted until 2026-09-02, and admin bypass is now
deliberately available rather than enforced.

Records what is actually set: required checks, required PR with an approving
review, stale reviews dismissed on push, and review from Code Owners required.
Explains the narrow CODEOWNERS, so a future session knows why a workflow or ADR
change needs the operator while ordinary work does not.

Admin bypass is available on purpose. GitHub does not let an author approve
their own PR, so without it an operator-authored governance change would
deadlock. It is not a hole here: App installations do not get admin bypass, so
it does nothing for a compromised or injected bot.

ADR 0025 previously said enabling code-owner review was the operator's action
and not done by that decision. It has been done, so the dismissal gate is now
defence-in-depth rather than the load-bearing control - GitHub enforces the
property directly, including against approvals from claude.yml, the ungated
path the gate cannot see.

* docs: trim a clause ADR 0025 stated twice in four lines

Review nit on #133. The 'claude.yml is an ungated second path the dismissal
step cannot see' clause appeared in consecutive paragraphs. The first states
it; the second now refers back rather than restating.

---------

Co-authored-by: goodolclint-claude[bot] <323206664+goodolclint-claude[bot]@users.noreply.github.com>
This commit is contained in:
goodolclint-claude[bot]
2026-09-02 10:45:26 -05:00
committed by GitHub
parent c38ca95987
commit 09a2384cd6
2 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+22 -2
View File
@@ -11,8 +11,28 @@ Tests: xUnit (`tests/PSProxmoxVE.Core.Tests/`) and Pester (`tests/PSProxmoxVE.Te
## Development Workflow
**All changes go through pull requests.** The `main` branch has branch protection enabled
(required build checks, required review, admin enforced). Never push directly to main.
**All changes go through pull requests.** Never push directly to `main`.
Protection on `main`, as configured 2026-09-02:
- required status checks
- required pull request, with an approving review
- stale reviews dismissed on push — a new commit invalidates the existing approval, and the
automated review re-runs on `synchronize`
- **review from Code Owners required**
`CODEOWNERS` is deliberately narrow. It names only the paths that govern review or publishing —
workflows, `.claude/`, `.mcp.json`, any `CLAUDE.md`/`AGENTS.md`, `DECISIONS.md`,
`docs/decisions/`, the test fixtures, the module manifest and `CHANGELOG.md`. A PR touching any
of those needs the operator's approval and cannot be merged on an automated one. Everything else
has no code owner, so the automated review still merges it.
Admin bypass is **available** to the operator, deliberately. GitHub does not let an author
approve their own pull request, so without it an operator-authored change to a governance path
would deadlock. It is not a hole in the threat model this protects against: App installations
do not get admin bypass, so it does nothing for a compromised or prompt-injected bot.
See [ADR 0025](docs/decisions/0025-review-instructions-come-from-the-default-branch-and-review-governing-prs-cannot-self-approve.md).
```bash
# Create a feature branch