Admin: enable required checks on main, then review and merge #361

[coneilen]

Objective

Configure enforceable required checks for main, then review and merge the Windows baseline in #361 through the normal protected-PR process.

This needs repository-admin/rules-management permission. It is not a request to approve a stalled Actions run: the CI has already run successfully. The missing piece is enforcement. There is also a workflow-trigger prerequisite below; simply turning on the checks as they stand would block some future PRs indefinitely.

Related implementation tracking: #89.

Verified current state — 16 September 2026

Item	State
Repository/default branch	scgopi/GraphCode / main
Pull request	#361 — Integrate reproducible Windows baseline
PR branch	win/tray-daemon-integration
Validated PR head	2bb815f7726b0149df466e3d9fc213bab87da4f6
Main incorporated	36462ec96d27544d4339b1437bd1f2a93b0e7d1a
Merge state when checked	Draft, MERGEABLE, CLEAN; no missing main commits
PR history	38 DCO-signed-off commits; no history rewrite
Existing ruleset	MainProtector, ID 20328158
Ruleset enforcement/targeting	Disabled; both ref include/exclude lists are empty
Existing rules/bypasses	Deletion and non-fast-forward restrictions; no bypass actors
Effective rules on main	The branch-rules API currently returns an empty list
Current contributor access	Push access, but admin: false and maintain: false

The earlier ruleset-update attempt returned 404; the permissions response confirms that the current contributor cannot activate these settings.

1. Make required workflow contexts reliable before enabling enforcement

Owner: PR author or maintainer with workflow-editing rights, coordinated with the admin.

Four workflows on the PR branch currently use workflow-level pull_request.paths filters:

• .github/workflows/macos-shared-regression.yml
• .github/workflows/windows-shell.yml
• .github/workflows/windows-port-validation.yml
• .github/workflows/windows-hardening.yml

GitHub leaves a required check pending when its entire workflow is skipped by a path filter. For example, requiring windows-spikes as currently defined would block a README-only PR to main, because that workflow would never start.

Recommended initial implementation: remove those workflow-level path filters so their required PR jobs always report. This is the straightforward option, with the trade-off of more macOS/Windows CI usage.

If CI cost requires conditional execution, use always-triggered workflows with explicit conditional work and always-emitted required gate results instead. A gate must propagate relevant failures/cancellations and must not silently pass because a dependency was skipped. Verify that both matrix-specific hardening contexts in the table below are actually emitted. Do not create a second workflow with the same check names just to report success.

Keep this prerequisite in #361 if practical, and commit changes with DCO sign-off (git commit -s). DCO, TDD evidence, and macOS shared-regression workflow definitions are introduced by this PR; do not assume all of these definitions already exist on main. Review/edit the integration branch, not an old workflow definition on the default branch.

Any workflow edit changes the validated head. Rerun the PR matrix and exact-tip full-pinned hardening after the edit; the 2bb815f links below then become historical evidence.

Do not enable a merge queue as part of this item. Most of these workflows do not handle merge_group; queue support requires a separate CI change.

2. Configure MainProtector

Owner: repository admin, or a custom role with permission to edit repository rules.

In Settings → Rules → Rulesets → MainProtector:

1. Target the default branch (main). Set an actual include target; the current empty target list is not sufficient.
2. Retain Restrict deletions and Block force pushes.
3. Enable Require status checks to pass before merging and add the eight exact contexts below.
4. Enable Require branches to be up to date before merging (strict checks), matching the intended up-to-date integration requirement.
5. Select GitHub Actions as the expected source where offered. The existing checks come from app slug github-actions, app ID 15368. Do not accept manually posted substitute success statuses.
6. Leave broad bypasses disabled. Do not bypass a red/missing check to merge Integrate reproducible Windows baseline #361.
7. Set enforcement to Active, not Disabled or Evaluate, and save after the workflow prerequisite is verified.

Recommended review policy for admin confirmation: require a pull request and at least one approving review, plus resolution of review conversations. Use the repository's intended review policy if more restrictive; approval of #361 itself remains required for this work item.

Exact required contexts and existing passing evidence

These are job/check names, not necessarily the workflow's display name. Preserve spelling, punctuation, and matrix suffixes.

Required context	Workflow / definition on the integration branch	Passing run at 2bb815f
DCO sign-off	DCO — .github/workflows/dco.yml	DCO
Linux build	Linux — .github/workflows/linux.yml	Linux
macos	macOS shared Swift regression — .github/workflows/macos-shared-regression.yml	macOS tests and lint
validate	TDD evidence — .github/workflows/tdd-evidence.yml	TDD evidence
windows-spikes	Windows port validation — .github/workflows/windows-port-validation.yml	Windows port
windows-shell	Windows shell validation — .github/workflows/windows-shell.yml	Shell, UIA and packaging
Deterministic hardening (windows-2022, pwsh)	Windows release hardening — .github/workflows/windows-hardening.yml	Hardening matrix
Deterministic hardening (windows-2025, pwsh)	Windows release hardening — .github/workflows/windows-hardening.yml	Hardening matrix

Do not require Full pinned Windows validation or Gated environment hardening as PR status contexts. They are intentionally skipped on the PR event. The real full-pinned job runs on explicit dispatch/schedule; a dispatched job is not a substitute for a PR-required check, and requiring a skipped PR job would provide false assurance.

DCO sign-off is not cryptographic commit signing. This item requires the Signed-off-by check, not a new Require signed commits rule. It also does not introduce linear-history, deployment, or other unrelated restrictions. Those policies can conflict with the existing reviewed merge history and need a separate decision.

3. Validate enforcement and refresh evidence if the head changes

Useful read-only checks after configuration:

gh api repos/scgopi/GraphCode/rulesets/20328158
gh api repos/scgopi/GraphCode/rules/branches/main
gh pr checks 361 --repo scgopi/GraphCode --required
gh pr view 361 --repo scgopi/GraphCode --json headRefOid,isDraft,mergeable,mergeStateStatus

The effective branch-rules response must show the active protection. --required must show the intended eight contexts, not an empty required-check set.

Verify workflow coverage with a documentation-only PR as well as a code-changing PR: required contexts must report instead of remaining missing/pending. Confirm that a deliberately failing required job in a controlled test PR prevents merging; do not test this by pushing broken code to main.

If the head or base changes, refresh #361 with a DCO-signed merge and rerun the applicable PR checks. Avoid an unsigned web-generated update commit that would fail the DCO check. Do not force-push or rewrite the validated histories.

After the PR matrix is green, dispatch the full-pinned workflow on the integration branch:

gh workflow run windows-hardening.yml --repo scgopi/GraphCode --ref win/tray-daemon-integration

Confirm the resulting run's headSha equals the actual PR head. It must pass pinned bootstrap, the complete release gate, all three real-product hardening runs, and the seven required resource-trend tuples.

Current exact-tip full-pinned proof

Run 35156897307 passed attempt 1 at 2bb815f7726b0149df466e3d9fc213bab87da4f6, including the complete release gate and real products 3/3. This supplements the PR checks; it is not itself a required PR context.

The prior fully validated baseline at bacb8ab also remains recorded in #361. Earlier launcher/checkout-cleanup failures are documented there, with native exit diagnostics added; a later green run is not presented as proof that logging repaired an unexplained runner failure.

4. Review #361, then merge normally

Once protection is active and the actual latest head is up to date and green:

• Mark Integrate reproducible Windows baseline #361 Ready for review.
• Review the Windows baseline and the shared Swift/macOS reconciliation. High-value areas are daemon/session lifecycle, current-user Named Pipe security, request correlation/replay, graph command ordering, terminal persistence, pinned provider bootstrap, and package install/upgrade/rollback behavior.
• Resolve review findings. Any subsequent code/workflow commit requires fresh checks and a new exact-tip full-pinned proof.
• Submit an approving review, then merge through the normal protected-PR flow. Do not use an admin bypass. A merge commit retains the reviewed integration history; preserve DCO provenance if selecting another allowed merge method.

This PR is a Windows baseline, not a claim of complete macOS UX parity or a production signed Windows release. The tracked parity ledger has 30 Validated, 56 Partial, and 2 Blocked rows. The ZIP package is self-contained and checked; a published signed installer, trustworthy update metadata, and updater install/relaunch are separate release work. Hosted runners explicitly skip physical tray interaction and configured WSL end-to-end tests, but still run native UIA and protocol-independent remote checks.

Preserve both refs below unchanged at 976796261844135818abc3562e7787eb8273386d:

• win/tray-daemon-rebase
• win/tray-daemon-validated-9767962

Acceptance criteria

• Workflow-level path filtering can no longer strand required checks for a PR to main; documentation-only and code-changing PR coverage is verified.
• MainProtector targets the default branch and is Active, retaining deletion/force-push protection with no broad bypass.
• All eight required contexts above are enforced with the correct source; strict up-to-date checks are enabled.
• Current PR head is up to date; PR checks and a matching exact-tip full-pinned run are green after the final change.
• Integrate reproducible Windows baseline #361 is marked ready, reviewed, approved, and merged without bypassing required checks.
• Preserved baseline refs remain unchanged, and the final reviewed SHA/run links are recorded in this item or Integrate reproducible Windows baseline #361.

GitHub documentation

• Available rules, required-check sources, and strict/loose checks
• Required checks: path-filter skips, conditional jobs, event eligibility, and merge queues

[scgopi]

Update — 16 September 2026

MainProtector (ID 20328158) is now Active on the default branch and enforces all eight required contexts.

Applied

Setting	State
Target	~DEFAULT_BRANCH (main)
Enforcement	✅ Active
Restrict deletions / Block force pushes	✅ Kept
Require status checks	✅ All eight contexts below, source GitHub Actions (integration 15368)
Strict up-to-date	✅ On
Bypass	Repository admin role, always — needed because release version-bump commits are pushed straight to main
Required PR / approving review	Not enabled; maintainer PRs are self-authored, so an approval rule would need its own decision
Merge queue / signed commits / linear history	Not enabled

Required contexts: DCO sign-off, Linux build, macos, validate, windows-spikes, windows-shell, Deterministic hardening (windows-2022, pwsh), Deterministic hardening (windows-2025, pwsh).

Verification

Check	Result
gh api repos/scgopi/GraphCode/rules/branches/main	deletion, non_fast_forward, required_status_checks
gh pr checks 361 --required	All 8 contexts pass at 2bb815f7726b0149df466e3d9fc213bab87da4f6
gh pr view 361 merge state	CLEAN
Other open PRs (e.g. #274)	Report only Linux build. The other seven contexts do not exist on main yet, so non-bypass merges are blocked. The maintainer accepted this for now.

Still open

• Integrate reproducible Windows baseline #361 not touched at the maintainer's request: no workflow edits, not marked ready, not reviewed or merged.
• The workflow-level pull_request.paths filters remain on macos-shared-regression.yml, windows-shell.yml, windows-port-validation.yml and windows-hardening.yml on the integration branch. Until they are removed, a docs-only PR will leave those contexts pending. That fix belongs in Integrate reproducible Windows baseline #361, and it changes the validated head.
• Docs-only / deliberately-failing PR enforcement tests have not been run.
• Preserved refs win/tray-daemon-rebase and win/tray-daemon-validated-9767962 were not modified.

[coneilen]

PR-author follow-up — required-workflow prerequisite completed

Commit 416f1ca614f0732e73c00625442d044e6babf2d8 removes the workflow-level PR path filters from all four required macOS/Windows workflows. Check names, job behavior, and dispatch/schedule-only hardening conditions are unchanged.

The validation-runner contract failed before the change and passes afterward. It guards unfiltered PR triggers and checks the actual shell-task-to-UIA invocation rather than a script name in a filter list.

Verified

• All eight enforced checks pass at 416f1ca.
• Full-pinned run 35164701722 passed attempt 1 at that exact SHA, including the complete release gate, real products 3/3, and all seven resource-trend tuples.
• Freshly fetched main 36462ec is an ancestor; the branch has no missing main commits.
• The effective branch-rules API confirms active default-branch protection, strict up-to-date checks, and the eight contexts sourced from GitHub Actions (15368).
• Both preserved 9767962 refs remain unchanged.
• Integrate reproducible Windows baseline #361 is now Ready for review, and review has been requested from scgopi. It has not been approved or merged.

The admin's reported release-bump bypass and review-policy decisions were left unchanged. The current reader's API omits bypass actors, so that omission is not treated as proof that bypass is disabled. No admin bypass has been used for this PR.

Still open

The separate documentation-only and deliberately-failing probe PRs have not been created/run. These are additional end-to-end tests of GitHub's protection configuration, not failing checks on #361 or a blocker to reviewing it. The workflow declarations, local regression, actual code-changing PR matrix, and full-pinned validation above are verified; the probe acceptance items are left unchecked rather than claimed complete.

Maintainer review, disposition of the remaining probe acceptance items, and a normal green-check merge are still pending. This work item remains open.