Decide: require Quality Gate checks before merging to main #51

Activity

1. amar-python

   added

   ciContinuous integration and the Quality GateContinuous integration and the Quality Gate

   decisionNeeds a product-owner decision before work startsNeeds a product-owner decision before work starts

   on Oct 25, 2026
2. amar-python commented on Oct 25, 2026

   

   amar-python

   on Oct 25, 2026 – with Claude

   OwnerAuthor

   More actions

   Automated verification: FAIL (verify_issues.py, 2026-10-25)

   main has no branch protection (API returns 404), and no decision recorded: no comment from the owner and the issue is open.

   ---

   Generated by Claude Code
3. amar-python

   added this to the Verification, tests and CI milestone on Oct 25, 2026
4. amar-python commented on Nov 2, 2026

   

   amar-python

   on Nov 2, 2026

   OwnerAuthor

   More actions

   Closed — decided and applied (2026-11-02)

   Decision: Option (a). Branch protection on main, require all three Quality Gate checks and a PR, with enforce_admins: true.

   Why (a) over (b) or (c)

   • (b) was a hedge against CI: integration job has never passed - T&E tables not found in te_dev #45, which was closed 7 days ago. The hedge is unnecessary.
   • (c) was rejected by the two-month-red-integration precedent cited in this issue — unprotected main lets red CI merge, which already happened.
   • (a) formalises what has been working for 8 consecutive merges: PRs chore: untrack coverage artifact and harden dockerignore #144, fix(preflight): PowerShell 5.1 compatible defaults #145, docs: record D3 decision (ReportLab for PDF generation) #149, docs: record D4 decision (BYTEA for file storage) #150, docs: record decision to end Lovable platform dependency #153, docs: record frontend-direction spike-then-decide approach #155, docs: record D7 decision (tracker long-term home) #157 all merged with all three checks SUCCESS.

   Applied

   Protection set via gh api --method PUT /repos/amar-python/PostgreDataMigrationAppWithCSVLoader/branches/main/protection on 2026-11-02:

   • required_status_checks.contexts: python-validator-tests, free-tier (unit, lint, health, evals-p), integration (postgres service)
   • required_status_checks.strict: true (branches must be up to date)
   • required_pull_request_reviews.required_approving_review_count: 0 (solo project)
   • enforce_admins.enabled: true (gate applies to admins)
   • allow_force_pushes: false
   • allow_deletions: false

   On enforce_admins: true

   The decision is deliberate. The two-month red integration was exactly the kind of thing admin bypass permissions enable. Solo project means "admin bypass" is just "I can skip my own gate." Seven recent green merges prove the gate isn't blocking real work.

   Emergency escape hatch (recorded for future reference)

   To remove protection in a genuine emergency:

   To restore afterwards: re-run the apply command (see decision record).

   Related

   • CI: integration job has never passed - T&E tables not found in te_dev #45 (closed 7 days ago): fix that made option (a) viable
   • Decision record: DECISIONS/2026-11-02-main-branch-protection.md (to be added)
5. amar-python

   closed this as completedon Nov 2, 2026
6. amar-python

   added a commit that references this issue on Nov 2, 2026

   docs: record D8 decision (main branch protection, Quality Gate required)

   ...

   This issue will close once commit e7833b2 is merged into the 'main' branch.

   e7833b2
7. amar-python commented on Nov 2, 2026

   

   amar-python

   on Nov 2, 2026

   OwnerAuthor

   More actions

   Closed — decided and applied (2026-11-02)

   Decision: Option (a). Branch protection on main, require all three Quality Gate checks and a PR, with enforce_admins true.

   Why (a) over (b) or (c)

   • (b) was a hedge against CI: integration job has never passed - T&E tables not found in te_dev #45, which was closed 7 days ago. The hedge is unnecessary.
   • (c) was rejected by the two-month-red-integration precedent cited in this issue — unprotected main lets red CI merge, which already happened.
   • (a) formalises what has been working for 8 consecutive merges: PRs chore: untrack coverage artifact and harden dockerignore #144, fix(preflight): PowerShell 5.1 compatible defaults #145, docs: record D3 decision (ReportLab for PDF generation) #149, docs: record D4 decision (BYTEA for file storage) #150, docs: record decision to end Lovable platform dependency #153, docs: record frontend-direction spike-then-decide approach #155, docs: record D7 decision (tracker long-term home) #157 all merged with all three checks SUCCESS.

   Applied

   Protection set via gh api PUT on 2026-11-02:

   • required_status_checks.contexts: python-validator-tests, free-tier (unit, lint, health, evals-p), integration (postgres service)
   • required_status_checks.strict: true (branches must be up to date)
   • required_pull_request_reviews.required_approving_review_count: 0 (solo project)
   • enforce_admins.enabled: true (gate applies to admins)
   • allow_force_pushes: false
   • allow_deletions: false

   On enforce_admins true

   The decision is deliberate. The two-month red integration was exactly the kind of thing admin bypass permissions enable. Solo project means admin bypass is just "I can skip my own gate." Seven recent green merges prove the gate is not blocking real work.

   Related

   • CI: integration job has never passed - T&E tables not found in te_dev #45 (closed 7 days ago): fix that made option (a) viable
   • Decision record: DECISIONS/2026-11-02-main-branch-protection.md