branch-protection: allow admin bypass on main - #94
Merged
Conversation
Flip enforce_admins from true to false. Repo admins can now merge their own PRs without waiting for code-owner review, by clicking "Merge without waiting for requirements to be met" once CI is green. The action is recorded in the audit log. Non-admins still see full enforcement: code-owner review required, 1 approving review, required status checks must pass. Rationale: as the solo owner of most CODEOWNERS scopes, the author cannot satisfy GitHub's "non-self approver" rule on their own PRs, which made every PR block on a second human. Admin bypass restores the practical workflow while keeping the protection rules as the default for everyone else.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| ] | ||
| }, | ||
| "enforce_admins": true, | ||
| "enforce_admins": false, |
Contributor
There was a problem hiding this comment.
🔴 Documentation not updated to reflect enforce_admins: false, violating AGENTS.md rule #1 and #6
The PR changes enforce_admins from true to false in .github/branch-protection.json but does not update docs/branch-protection.md, which still documents the value as true and states "Even repo admins go through the gates. The point is no bypasses" (docs/branch-protection.md:19 and docs/branch-protection.md:72). This violates two mandatory AGENTS.md rules:
- Rule Add OpenAPI documentation endpoint and schema #1 (Update in the same PR): "New endpoint, query function, CLI flag, env var, constant, schema construct, or invariant: update both the source code and the doc in the same change. Never split documentation drift into a follow-up."
- Rule Implement aggregate functions with GROUP BY support #6 (Don't lie): "If a section becomes wrong but you can't rewrite it fully right now, replace the wrong line with
*(stale — needs update after <change>)*rather than leaving silently incorrect text."
After this PR merges, the documentation will actively mislead readers about the security posture of the repository.
Prompt for agents
The change to enforce_admins: false in .github/branch-protection.json must be accompanied by updates to docs/branch-protection.md. Specifically:
1. In the policy table at docs/branch-protection.md:19, change the row for 'Enforce on admins' from value 'true' with rationale 'Even repo admins go through the gates. The point is no bypasses.' to value 'false' with an updated rationale explaining why admin bypass is now permitted.
2. At docs/branch-protection.md:72, update or remove the sentence 'Even repo admins are subject to these rules.' since it will no longer be accurate.
This is required by AGENTS.md rules #1 (update docs in the same PR) and #6 (don't lie in docs).
Was this helpful? React with 👍 or 👎 to provide feedback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Flip
enforce_adminsfromtruetofalsein.github/branch-protection.json. Repo admins can now self-merge PRs by clicking Merge without waiting for requirements to be met once CI is green. The bypass action is recorded in the audit log.Non-admins still see full enforcement: code-owner review required, 1 approving review, required status checks must pass.
Why
As the solo owner of most CODEOWNERS scopes, the PR author cannot satisfy GitHub's "non-self approver" rule on their own PRs — every PR was blocking on a second human. Admin bypass restores the practical workflow while keeping the protection rules as the default for everyone else (Devin, future contributors).
Test plan
gh api -X DELETE .../enforce_adminsso unblocking takes effect immediately../scripts/apply-branch-protection.shshould be a no-op (declarative source now matches API state).🤖 Generated with Claude Code