Make E2E tests blocking PR checks for prod branch

[hanthor]

Problem

The E2E test workflows (bootcrew-vm.yml and bootcrew-fast.yml) run on PRs but are NOT currently blocking merges. PRs can be merged to prod even if E2E tests fail.

Solution

Enable branch protection rules on the prod branch to require E2E test workflows to pass before merges.

How to Do It

Option 1: GitHub UI (Recommended)

1. Go to Settings → Branches

2. Click "Add rule"

3. Branch name pattern: prod

4. Enable:

   • Require a pull request before merging
   • Require status checks to pass before merging
   • Require branches to be up to date before merging
   • Require approvals (1)
   • Enforce admins

5. Add required status checks:

   • bootcrew-fast / debian-bootc
   • bootcrew-fast / centos-bootc
   • bootcrew-vm / debian-bootc
   • bootcrew-vm / centos-bootc

6. Click Create

Option 2: GitHub CLI

Save as branch-protection.json:

{
  "required_status_checks": {
    "strict": true,
    "contexts": [
      "bootcrew-fast / debian-bootc",
      "bootcrew-fast / centos-bootc",
      "bootcrew-vm / debian-bootc",
      "bootcrew-vm / centos-bootc"
    ]
  },
  "required_pull_request_reviews": {
    "required_approving_review_count": 1,
    "dismiss_stale_reviews": false
  },
  "enforce_admins": true,
  "allow_force_pushes": false,
  "allow_deletions": false
}

Then run:

gh api repos/tuna-os/fisherman/branches/prod/protection --input branch-protection.json

Current Status

• E2E tests implemented and working in CI
• PR Merge: Composefs partition retagging + just CI fix #26 just merged partition retagging + just installation fixes
• Tests pass on dev branch
• Missing: Branch protection to enforce on prod merges

Benefits

✅ Prevents broken code from reaching production
✅ Ensures all systems boot correctly (debian-bootc composefs + centos-bootc ostree)
✅ Validates SSH access works for remote management
✅ Catches composefs partition retagging issues early
✅ Guarantees fisherman binary works end-to-end