Skip to content

fix(ci): required check branch-protection / check-branch never reported — job id was protect - #256

Merged
rubenvdlinde merged 1 commit into
developmentfrom
fix/branch-protection-job-id
Aug 4, 2026
Merged

fix(ci): required check branch-protection / check-branch never reported — job id was protect#256
rubenvdlinde merged 1 commit into
developmentfrom
fix/branch-protection-job-id

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

Problem

The org rulesets Main Branch Protection and Beta Branch Protection both require the status context branch-protection / check-branch.

GitHub composes a reusable-workflow status context as <caller-job-id> / <called-job-name>. This caller's job id was protect, so the context it actually emitted was protect / check-branch.

The required context therefore never reported at all. Every PR to main or beta sat permanently pending on a check that could not arrive, and only --admin could ship it. A dead gate whose absence looks exactly like its success.

Same defect as ConductionNL/petstore#20.

Fix

Job id protectbranch-protection, plus a comment recording why the name is load-bearing.

Why this does not newly block anything

Making a never-reporting check report is only safe if it will pass. The shared check-branch job requires:

  • PRs to main come from beta or hotfix/*
  • PRs to beta come from development, main, or hotfix/*

larpingapp has both beta and development, so the required topology is satisfied. (petstore had neither, which was a second, independent fault there.)

Still outstanding after this PR

  • beta additionally calls Conduction/.github/... — the retired Codeberg org name, which GitHub Actions cannot resolve at all.
  • main has no branch-protection.yml at all.

Both are handled by follow-up PRs to those protected branches.

…quired context never reported

The org rulesets "Main Branch Protection" and "Beta Branch Protection"
require the status context `branch-protection / check-branch`. GitHub
composes a reusable-workflow context as `<caller-job-id> / <called-job-name>`,
and this caller job was named `protect` — so the check that actually got
emitted was `protect / check-branch` and the required one never appeared.

Every PR to main or beta therefore sat permanently pending on a check that
could not arrive, and only `--admin` could merge. Same defect petstore had
(petstore#20).

larpingapp has both `beta` and `development`, so the branch topology the
shared check-branch job requires (development -> beta, beta|hotfix/* -> main)
is satisfied and making the gate report does not newly block anything.
@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Quality Report — ConductionNL/larpingapp @ f3c311b

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
composer ✅ 101/101
npm ✅ 537/537
PHPUnit
Newman ⏭️
Playwright

Quality workflow — 2026-08-04 11:57 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
rubenvdlinde merged commit a795529 into development Aug 4, 2026
35 checks passed
@rubenvdlinde
rubenvdlinde deleted the fix/branch-protection-job-id branch August 4, 2026 12:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant