Files
vdm/.github/BRANCH_PROTECTION.md
samiandClaude Sonnet 5 dad88fce3f pkg: run conformance through ctest as the one canonical path
PROTO wired the suite into ctest (label "conformance": the end-to-end
`conformance` test that shells to run.sh, plus the native `conformance_cpp`);
the CI job called run.sh directly. Two entry points, and the required M0 gate
exercised only one of them, so the ctest registration could rot.

The conformance job now configures, builds velox_conformance_cpp, and runs
`ctest --preset dev -L conformance`. The dev test preset's
noTestsAction: error is the rot guard: an empty label match exits non-zero
instead of the old silent pass. build/sanitizers exclude the heavy e2e test
with -E '^conformance$' (the dedicated job owns that run; conformance_cpp
still runs under every sanitizer). ADR 0014 records the decision.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_0143aKiohmDiyefJBwHDJJqw
2026-09-10 14:58:10 +04:00

2.4 KiB

Branch protection for main

CI defines the checks; branch protection is a repo setting (Settings → Branches → Add rule) and has to be configured once by an admin. This file records the intended policy so it can be re-applied or audited.

Rule: main

  • Require a pull request before merging. No direct pushes.

  • Require status checks to pass before merging, and require branches to be up to date first. Required checks:

    Check (job name in ci.yml) Required from
    clang-format now
    testserver now
    bootstrap-script now (validates package names against the 24.04 runner archive)
    bootstrap-script-2604 now — real --with-clang install in a 26.04 container; the release the project ships on
    build (gcc) / build (clang) now — core, daemon and gui have merged
    sanitizers (dev) / sanitizers (tsan) now — core, daemon and gui have merged
    conformance now — tests/conformance/ has landed; this is the M0 exit gate
    extension-lint now — extension/ has merged (MV3 manifest + esbuild build)

    clang-tidy is intentionally not required through M1 (continue-on-error: true, .clang-tidy has WarningsAsErrors: ''). Make it required at M2.

  • Require linear history (matches CLAUDE.md §6: rebase onto main, no merge commits).

  • Require conversation resolution before merging.

  • Do not allow force pushes or deletions.

  • Apply the rule to administrators too, except for the initial scaffolding period.

Note on the "skipped" job steps

extension-lint and clang-tidy short-circuit to a "skipped" echo when their lane hasn't landed. They still report success, so they can be marked required now without blocking — they start doing real work automatically on the commit that adds the lane.

Their guards fail loudly (non-zero) once the lane is half-present — e.g. an extension/manifest.json with no lintable package.json. A guard keyed to a single filename is how a required check ends up green over nothing; the skip branch is only for a lane that is genuinely absent.

conformance has no skip branch. It runs ctest -L conformance (see docs/adr/0014-conformance-runs-through-ctest.md); the dev test preset's noTestsAction: error fails the job if that label ever matches nothing, so a deleted or renamed registration goes red instead of passing vacuously.