Repository navigation
Turn on protection for main (the ProtectMain ruleset is disabled and targets no branch) #175
Description
main has no protection in force right now. Anyone with write access can force-push it, delete it, or merge a PR whose CI is red. Merging to main also deploys the live site, so a red merge goes straight to users.
What's there today
Checked 2026-10-21 with gh api:
- Branch protection: none.
GET /repos/FactoryGameFan/FactorioTools/branches/main/protectionreturns 404 "Branch not protected". - Rulesets: one,
ProtectMain(id 18139941), created 2026-06-25 and never changed since.- Its enforcement is
disabled. - It has two rules: block deletion, and block force pushes (
non_fast_forward). - Its target list is empty (
conditions.ref_name.includeis[]). So switching it on as it stands would still protect no branch. It needs~DEFAULT_BRANCHadded. - It has no bypass actors.
- Its enforcement is
Proposed fix
- Now: edit
ProtectMainso it targets~DEFAULT_BRANCH, and set it to active. Keep the deletion and force-push rules. Target~DEFAULT_BRANCHrather than~ALL: a ruleset on~ALLblocks Renovate from force-pushing its own branches. Renovate's PRs then keep a stale commit, and deleting the branch fails with HTTP 422. - After the Rust port's stage 13b merges (Consider porting the oil-field planner to Rust/WASM #138): add a
required_status_checksrule. Stage 13b deletes the .NET and Lua CI jobs, so waiting means the list names only checks that will still exist. The checks that remain afterward are:Build front-endandRust port(ci.yml)Build and deploy(the deploy workflow's PR build, which never deploys)
- Decide whether to require a pull request for every change to
main. Most work already goes through PRs, so this mostly stops accidental direct pushes. If it's on, the repo admin may want a bypass for emergencies.
The repo is public, so rulesets are fully enforced on the free plan.
Activity
wormeyman commentedon Oct 21, 2026
Step 1 is done (2026-10-21).
ProtectMainnow targets~DEFAULT_BRANCHwith enforcementactive, keeping its two rules (no deletion, no force push).GET /repos/FactoryGameFan/FactorioTools/rules/branches/mainnow returns both rules from ruleset 18139941.Steps 2 (required status checks) and 3 (require a PR) are still open. Step 2 waits until the stage 13b PR of #138 has merged.
wormeyman commentedon Oct 21, 2026
Step 2 is done. Stage 13b merged in #177. ProtectMain now also has a
required_status_checksrule forBuild front-endandRust port, both from GitHub Actions (integration 15368). It does not require branches to be up to date, so Renovate's rebases are not blocked.Build and deployis not on the list, even though step 2 named it. The deploy workflow'spull_requesttrigger has a paths filter (rust/**,src/vue/**and the workflow itself), and the devcontainersmokejob has one too. A required check that never starts stays pending, so a docs or config PR could never merge. The twoci.ymlchecks run on every PR.GET /repos/FactoryGameFan/FactorioTools/rules/branches/mainnow returnsdeletion,non_fast_forwardandrequired_status_checks.Step 3, requiring a PR for every change to
main, is still open.wormeyman commentedon Oct 21, 2026
Step 3 is done, so this issue is finished. ProtectMain now has a
pull_requestrule, which means every change tomaingoes through a pull request. It asks for 0 approvals, andrequire_extra_approval_for_unattributed_changesis set to false, so a Renovate PR does not wait for a review. The repository admin role has an "always" bypass for emergencies.The ruleset now holds
deletion,non_fast_forward,required_status_checks(Build front-end,Rust port) andpull_request, on~DEFAULT_BRANCH.