security(high/easy): protect main with reviewed PRs and blocked force-pushes #484

Activity

1. karagozemin

   added

   priority: highUrgent work with high project or security impactUrgent work with high project or security impact

   securitySecurity, supply-chain, and repository-hardening workSecurity, supply-chain, and repository-hardening work

   on Oct 21, 2026
2. drips-wave

   added

   Stellar WaveIssue proposed for the Drips Stellar Wave programIssue proposed for the Drips Stellar Wave program

   on Oct 21, 2026
3. MoscowDev commented on Oct 21, 2026

   

   MoscowDev

   on Oct 21, 2026 – with Drips Wave

   More actions

   @MoscowDev has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   Dear Hiring Manager,

   I am writing to express my interest in any suitable opportunity available at Drips Issues. I am a dedicated and adaptable professional with experience in software development, problem-solving, and technology. I am eager to contribute my skills, learn from your team, and support the company's goals.

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @MoscowDev to this issue.
4. iorchirmyom-afk commented on Oct 21, 2026

   

   iorchirmyom-afk

   on Oct 21, 2026 – with Drips Wave

   More actions

   @iorchirmyom-afk has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   I would like to work on this issue. Please assign 🙏

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @iorchirmyom-afk to this issue.
5. Adediwura-dev commented on Oct 21, 2026

   

   Adediwura-dev

   on Oct 21, 2026 – with Drips Wave

   Contributor

   More actions

   @Adediwura-dev has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   can handle efficiently if assigned to me

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @Adediwura-dev to this issue.
6. toyosi-14 commented on Oct 21, 2026

   

   toyosi-14

   on Oct 21, 2026 – with Drips Wave

   More actions

   @toyosi-14 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   Hi maintainer, I can fix this very fast kindly assign it to me

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @toyosi-14 to this issue.
7. timo126 commented on Oct 21, 2026

   

   timo126

   on Oct 21, 2026 – with Drips Wave

   More actions

   @timo126 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

   please assign

   ℹ️ Repo Maintainers: To accept this application, review their application or assign @timo126 to this issue.
8. karagozemin

   assigned

   timo126

   on Oct 21, 2026
9. drips-wave commented on Oct 21, 2026

   

   drips-waveBot

   on Oct 21, 2026 – with Drips Wave

   More actions

   Congratulations, @timo126! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

   🧑‍💻 @timo126: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

   Warning

   When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

   🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

   🌊 Happy Wave 🌊
10. timo126 commented on Oct 27, 2026

    

    timo126

    on Oct 27, 2026

    More actions

    main branch protection — final settings

    Applied as an active repository ruleset (verified via
    GET /repos/timo126/sub-rosa-issue/rules/branches/main, which only returns rules
    from rulesets with active/evaluate enforcement).

    Field	Value
    Name	Protect main (ID 25968240)
    Target / enforcement	branch / active
    Conditions	ref_name.include = ["~DEFAULT_BRANCH"] → main

    Acceptance criterion	Setting
    Require changes through pull requests	pull_request
    At least one approving review	required_approving_review_count: 1
    Dismiss stale approvals after new pushes	dismiss_stale_reviews_on_push: true
    Require the existing CI checks before merge	required_status_checks: check, coverage, round-contract, web
    Block force pushes	non_fast_forward
    Block branch deletion	deletion
    Bypass limited to minimum administrators	[{ actor_type: "RepositoryRole", actor_id: 5, bypass_mode: "always" }] — repo admin only

    Required-check contexts are the GitHub Actions job names. Bindings check and
    Line lengths check both name their job check, and GitHub requires all runs
    sharing a context to pass, so check covers both. Docs link check and
    Environment template check are deliberately not required: they are scoped
    by paths: and a path-filtered required check stays Pending, which would block
    unrelated PRs.

    Bypass is a single actor — the repository admin role — so no user, team, app,
    deploy key, or the write/maintain roles can bypass it.

    Location: the ruleset is applied on timo126/sub-rosa-issue, the only repository
    where the automation account holds admin (upstream reports
    permissions.admin = false for the same token). The full recorded JSON and the
    gh api command to reproduce it upstream are in
    docs/BRANCH_PROTECTION.md.

    PR: #614
    Ruleset page: https://github.com/timo126/sub-rosa-issue/rules/25968240