Adds a "Branch protection on main" subsection under Branching & Pull
Requests documenting the Gitea
server-side rules currently configured on main: push allowlist
(fishconfig-bot + repo owner only), force-push disabled, signed commits
required, CI / test (pull_request) required status check, block-merge on
rejected reviews, block-merge if the PR is behind main, and the owner's
bypass allowlist.
Prompted by today's CI outage: the docs job's auto-commit step was
rejected by branch protection (enable_push was off with no whitelist)
for three merges in a row before the push allowlist was corrected in the
Gitea UI. Writing these rules down so the next person configuring
protection settings (or debugging a rejected push) doesn't have to
re-derive them from a failed CI run.
Verification
Docs-only change, no code touched — fish tests/run-tests.fish not
required.
Reviewed rendered markdown by eye for broken anchors/links.
## Summary
- Adds a "Branch protection on `main`" subsection under [Branching & Pull
Requests](CONTRIBUTING.md#branching--pull-requests) documenting the Gitea
server-side rules currently configured on `main`: push allowlist
(`fishconfig-bot` + repo owner only), force-push disabled, signed commits
required, `CI / test (pull_request)` required status check, block-merge on
rejected reviews, block-merge if the PR is behind `main`, and the owner's
bypass allowlist.
- Prompted by today's CI outage: the `docs` job's auto-commit step was
rejected by branch protection (`enable_push` was off with no whitelist)
for three merges in a row before the push allowlist was corrected in the
Gitea UI. Writing these rules down so the next person configuring
protection settings (or debugging a rejected push) doesn't have to
re-derive them from a failed CI run.
## Verification
- [x] Docs-only change, no code touched — `fish tests/run-tests.fish` not
required.
- [x] Reviewed rendered markdown by eye for broken anchors/links.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
main" subsection under Branching & PullRequests documenting the Gitea
server-side rules currently configured on
main: push allowlist(
fishconfig-bot+ repo owner only), force-push disabled, signed commitsrequired,
CI / test (pull_request)required status check, block-merge onrejected reviews, block-merge if the PR is behind
main, and the owner'sbypass allowlist.
docsjob's auto-commit step wasrejected by branch protection (
enable_pushwas off with no whitelist)for three merges in a row before the push allowlist was corrected in the
Gitea UI. Writing these rules down so the next person configuring
protection settings (or debugging a rejected push) doesn't have to
re-derive them from a failed CI run.
Verification
fish tests/run-tests.fishnotrequired.