Skip to content

BRANCH_PROTECTION.md

Latest commit

 

History

History
76 lines (63 loc) · 2.87 KB

BRANCH_PROTECTION.md

File metadata and controls

76 lines (63 loc) · 2.87 KB
Raw

Recommended Branch Protection Settings

These are the recommended GitHub settings for the master branch once the repository is public. They are recommendations — apply them in Settings → Branches → Branch protection rules (or Rulesets). Nothing here is enforced automatically by the repo; the maintainer must enable it in GitHub.

Status-check names below match the workflow jobs actually defined in .github/workflows/. Only require checks that exist and have run at least once (GitHub only lists checks it has seen).

Rule target

  • Branch name pattern: master

Recommended settings

Pull requests

  • ✅ Require a pull request before merging
  • ✅ Require approvals: 1 (raise as the team grows)
  • ✅ Require review from Code Owners (a CODEOWNERS file exists)
  • ✅ Dismiss stale approvals when new commits are pushed
  • ✅ Require conversation resolution before merging

Status checks

  • ✅ Require status checks to pass before merging
  • ✅ Require branches to be up to date before merging
  • Required checks (select the ones that have run at least once):
    • CI / Rust
    • CI / Wallet
    • CI / Site
    • CI / Extension
    • CI / Market API
    • Android / Debug Build Sanity
    • Security / Gitleaks
    • Security / Cargo Deny
    • Security / Cargo Audit
    • Security / NPM Audit (optional — currently non-blocking inside the job)
    • CodeQL / Analyze (javascript-typescript)
    • License Audit / Rust Licenses
    • License Audit / Frontend Licenses
    • Coverage / Wallet (JS/TS) (optional — informational)
    • Coverage / Rust (optional — informational)

History / pushes

  • ✅ Block force pushes
  • ✅ Block deletions
  • ✅ Restrict who can push to matching branches (maintainers only)
  • ⚙️ Require linear history — optional (enable if you prefer squash/rebase only)
  • ⚙️ Require signed commits — optional but recommended for a wallet project

Signed commits (optional)

If you enable "Require signed commits", document it in CONTRIBUTING.md and make sure contributors set up commit signing (GPG, SSH, or gitsign). This is separate from the DCO Signed-off-by trailer.

DCO enforcement (optional)

The project uses a DCO Signed-off-by trailer (see CONTRIBUTING.md). To enforce it on PRs, either:

If you enforce DCO, add its check (e.g. DCO) to the required status checks list.

Merge strategy (Settings → General → Pull Requests)

Recommended:

  • ✅ Allow squash merging (default)
  • ⬜ Allow merge commits (optional)
  • ✅ Allow rebase merging (optional)
  • ✅ Automatically delete head branches after merge

Notes

  • Branch protection cannot be created by the build agent; it requires repo-admin access in GitHub.
  • Do not require checks that do not yet exist; merges would be blocked indefinitely.