pkg: add CI workflow and branch-protection policy

.github/workflows/ci.yml: fast lint jobs (clang-format, testserver selftest, bootstrap.sh --check) that need no compiler; a gcc/clcang build matrix and an ASan/UBSan + TSan sanitizer matrix that bootstrap via tools/bootstrap.sh and run `ctest --preset {ci,dev,tsan}`; advisory clang-tidy on changed files; and extension-lint + conformance jobs that short-circuit to a passing "skipped" step until their lane lands, so they can be marked required now. CMakePresets.json gains matching `tsan` and `ci` test presets. .github/BRANCH_PROTECTION.md records the intended required-checks policy (conformance required = the M0 exit gate). Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01HPPSGhiArbvQgwC2DNiURS
2026-09-09 19:22:36 +04:00
parent 3325efc1c8
commit 8f45815059
4 changed files with 214 additions and 0 deletions
@@ -0,0 +1,36 @@
+# Branch protection for `main`
+
+CI defines the checks; **branch protection is a repo setting** (Settings → Branches →
+Add rule) and has to be configured once by an admin. This file records the intended
+policy so it can be re-applied or audited.
+
+## Rule: `main`
+
+- **Require a pull request before merging.** No direct pushes.
+- **Require status checks to pass before merging**, and require branches to be up to date
+  first. Required checks:
+
+  | Check (job name in `ci.yml`) | Required from |
+  |---|---|
+  | `clang-format` | now |
+  | `testserver` | now |
+  | `bootstrap-script` | now |
+  | `build (gcc)` / `build (clang)` | when the first C++ lane merges |
+  | `sanitizers (dev)` / `sanitizers (tsan)` | when the first C++ lane merges |
+  | `conformance` | **when `tests/conformance/` lands — this is the M0 exit gate** |
+  | `extension-lint` | when `extension/` lands |
+
+  `clang-tidy` is intentionally **not** required through M1 (`continue-on-error: true`,
+  `.clang-tidy` has `WarningsAsErrors: ''`). Make it required at M2.
+
+- **Require linear history** (matches CLAUDE.md §6: rebase onto `main`, no merge commits).
+- **Require conversation resolution before merging.**
+- Do **not** allow force pushes or deletions.
+- Apply the rule to administrators too, except for the initial scaffolding period.
+
+## Note on the "skipped" job steps
+
+Several jobs (`conformance`, `extension-lint`, `clang-tidy`) short-circuit to a "skipped"
+echo when their lane hasn't landed. They still report **success**, so they can be marked
+required now without blocking — they start doing real work automatically on the commit
+that adds the lane.