Branch protection: enforce DCO, status checks, signed commits and reviews

[mwaldheim]

Goal

Protect the main branch per OpenSSF Scorecard and CNCF supply chain security requirements.

Required settings on main

• Require pull request before merging (no direct push)
• Require at least 1 (ideally 2) approving reviews
• Dismiss stale reviews on new push
• Require status checks: CI tests, DCO, lint, OpenSSF Scorecard
• Require signed commits (GPG / SSH / Vigilant mode)
• Restrict who can push to main (maintainers only)
• Require linear history (no merge commits)
• Do not allow bypassing required checks

Tasks

• Configure branch protection rules in GitHub settings (or via Terraform/gh CLI)
• Document the branch strategy in CONTRIBUTING.md
• Set up
  uleset (GitHub rulesets API, more granular than classic protection)

[mwaldheim]

Progress update (2026-05-23):\n\n- Branch protection required checks were corrected to match actual check names (DCO Check, Test (Go 1.24/1.25/1.26), Lint) via GitHub API update.\n- CONTRIBUTING.md branch strategy/docs updates are prepared in PR #104.\n\nStatus: keep open until PR #104 is merged and the remaining branch protection/ruleset items in this issue body are fully complete.