Branch protection
Apothem branch protection on main: the live protection rule, its required status checks, and the checks pending addition.
Apothem's main branch is protected by a classic GitHub branch protection rule. The repository has no rulesets. The protection enforces the change-set discipline declared at rules/production-ready-prs.md and feeds the OpenSSF Scorecard Branch-Protection and Code-Review checks.
This page records the live settings exactly, as last read from the GitHub API on 2026-10-07. A setting the maintainer intends but has not applied yet appears only under Pending maintainer changes.
Protection settings
| Setting | API field | Live value | Effect |
|---|---|---|---|
| Require a pull request before merging | required_pull_request_reviews (present) | ✅ | Changes reach main through a pull request. |
| Required approving reviews | required_approving_review_count | 0 | A pull request merges without an approving review. See Solo-maintainer model. |
| Dismiss stale approvals on new commits | dismiss_stale_reviews | ✅ | An approval given before a new push no longer counts. |
| Require review from Code Owners | require_code_owner_reviews | ❌ | Enabling this before a second maintainer joins deadlocks solo-maintainer pull requests. |
| Require approval of the most recent reviewable push | require_last_push_approval | ❌ | GitHub requires that approval to come from someone other than the pusher, which a solo maintainer cannot supply. |
| Require status checks to pass | required_status_checks | ✅ | The 12 contexts listed under Required status checks must pass. |
| Require branches to be up to date before merging | required_status_checks.strict | ❌ | A pull request can merge when its required checks passed against an older main. The workflows that run on a push to main then test the merged result. |
| Require conversation resolution before merging | required_conversation_resolution | ✅ | Open review threads block merge. |
| Require signed commits | required_signatures | ❌ | Release commits are signed locally. Enforcement waits until contributor onboarding documents SSH or GPG signing setup. |
| Require linear history | required_linear_history | ✅ | Keeps the public history of main a single line. |
| Lock branch | lock_branch | ❌ | main accepts merges. |
| Do not allow bypassing the above settings | enforce_admins | ❌ | The settings above do not bind a repository admin. An admin can merge without the required checks or push to main directly. |
| Allow force pushes | allow_force_pushes | ❌ | Force pushes to main are blocked for everyone, admins included. |
| Allow deletions | allow_deletions | ❌ | No one can delete main, admins included. |
Solo-maintainer model
The repository has one maintainer. GitHub states: "Pull request authors cannot approve their own pull requests." A required approval count above 0 would therefore block every maintainer pull request. The live rule requires a pull request with 0 approvals and leaves enforce_admins off.
For anyone without admin permission, a merge still needs the required status checks green, review conversations resolved, and a linear history. Force pushes and deletion of main stay blocked for every account.
When a second maintainer joins, the stronger settings are at least one required approval, latest-push approval, CODEOWNERS review, and enforce_admins on. The solo-maintainer merge ceremony applies only to a protection that requires an approval and enforces it for admins.
Required status checks
Each of these 12 contexts is required, with GitHub Actions (app ID 15368) as its source:
quality / ubuntu-latest / py3.10
quality / ubuntu-latest / py3.11
quality / ubuntu-latest / py3.12
quality / ubuntu-latest / py3.13
quality / ubuntu-latest / py3.14
quality / windows-latest / py3.10
quality / windows-latest / py3.11
quality / windows-latest / py3.12
quality / windows-latest / py3.13
quality / windows-latest / py3.14
coverage
Require Signed-off-by| Context | Workflow and job | How it reports on every pull request |
|---|---|---|
quality / <os> / py<ver> (10) | ci.yml, job quality | ci.yml runs when a pull request touches a code or config path. ci-docs-stub.yml reports the same contexts on a documentation-only pull request. |
coverage | ci.yml, job coverage | Same as quality. |
Require Signed-off-by | dco.yml, job dco | Its pull-request trigger has no paths filter, so it runs on every pull request to main. |
The quality / ubuntu-latest / py3.15 prerelease cell runs in ci.yml with continue-on-error and is not required. Any other workflow, including CodeQL, Scorecard, and pip-audit, may report status, but its outcome does not gate merge unless its context is added to this list.
Pending maintainer changes
The maintainer intends to add these 25 contexts to the required list. Each workflow's header declares the job a required check, and its pull-request trigger has no paths filter, so it runs on every pull request to main. Until a context is added, a failure in it does not block merge.
clean-install-gate.yml, 7 contexts:
installer-shell-compat / ubuntu-latest
installer-shell-compat / macos-latest
installer-shell-compat / windows-latest
clean-install-gate / ubuntu-latest
clean-install-gate / windows-latest
wheel-smoke / ubuntu-latest
wheel-smoke / windows-latestharness-matrix.yml, 17 contexts, one matrix (<adapter>) per adapter in the job's matrix:
matrix (antigravity)
matrix (claude-code)
matrix (codebuddy)
matrix (codex)
matrix (cursor)
matrix (gemini-cli)
matrix (github-copilot)
matrix (glm)
matrix (hermes)
matrix (kimi-code)
matrix (kiro)
matrix (open-claw)
matrix (opencode)
matrix (qwen-code)
matrix (trae)
matrix (windsurf)
matrix (zed)installer-lint.yml, 1 context:
installer-lintOnce the harness-matrix.yml contexts are required, registering a new adapter adds a matrix (<adapter>) context, and the required list gains it in the same change. "Require branches to be up to date before merging" stays off. When a pending change is applied, move it into the live sections above in the same change.
Audit cadence
This file is reviewed on every security audit and at every release-engineering checkpoint. Drift between this file and the actual branch protection configuration is a high-severity finding. Read the live configuration with:
gh api repos/ahmed-g-gad/apothem/branches/main/protection
gh api repos/ahmed-g-gad/apothem/rulesetsReferences
- OpenSSF Scorecard — Branch-Protection check
- GitHub — About protected branches
- GitHub — Managing a branch protection rule
- GitHub — Approving a pull request with required reviews
- Apothem CODEOWNERS — path-scoped review ownership
- Apothem CI workflows — the workflows each required context comes from
rules/production-ready-prs.md§1 — same-change-set discipline this protection enforces