Require the CI status check on main in every repo

[gavinbee]

main has no required status checks in any repo. The swimblocks-default ruleset carries deletion, non_fast_forward, required_linear_history and pull_request — but nothing that makes CI a gate. .github/settings.yml's legacy branches: block says required_status_checks: null too, so the gap is deliberate-looking in both places.

Two reasons to close it:

1. On its own: a PR with failing tests is mergeable today. The check is advisory — someone has to notice the red X.
2. As a prerequisite: auto-merge only waits on required checks. Enabling Dependabot auto-merge (Enforce a canonical Dependabot configuration on on every repo (and keep it that way) #16) while nothing is required would merge dependency bumps without waiting for CI — strictly worse than the current manual flow. This issue therefore blocks Enforce a canonical Dependabot configuration on on every repo (and keep it that way) #16.

Current state

Repo	Workflow	Runs on PR?	Check context
deck-eval-gen	ci.yml → reusable	yes	ci / test ✅ observed
.github	ci.yml → reusable (local path)	yes	ci / test inferred
rems-sync	ci.yml, inline job test	yes	test inferred
deck-eval-parser	tests.yml, inline job test	yes	test inferred
swim-club-tech-survey	run_survey.yml only (schedule + dispatch)	no	none
officials-admin	none	no	none
rems-sync-apps-script	none	no	none

Only ci / test is confirmed, from deck-eval-gen PR #19. The rest need verifying against a real PR before being written into config.

The footgun

A required check that never reports blocks every merge, permanently. So this cannot be applied uniformly from settings.yml as things stand:

• Contexts differ (ci / test vs test) because rems-sync and deck-eval-parser define jobs inline instead of calling the reusable workflow — despite AGENTS.md §5 stating that each repo's ci.yml calls reusable-python-ci.yml. That claim is currently false in two repos.
• Three repos produce no PR check at all. swim-club-tech-survey's only workflow is the scheduled crawl; officials-admin has no CI yet (officials-admin#12).

Proposed approach

Standardising on the reusable workflow is the fix — it makes the context uniform, which is what makes a single org-wide rule possible. Order matters:

1. Converge rems-sync and deck-eval-parser onto reusable-python-ci.yml, with the calling job id ci so the context is ci / test everywhere. One PR each; makes AGENTS.md §5 true.

2. Verify the context string on a real PR in each repo before step 3.

3. Add the rule to .github/settings.yml:

       rules:
         - type: required_status_checks
           parameters:
             strict_required_status_checks_policy: true
             required_status_checks:
               - context: "ci / test"

   apply_ruleset() POSTs the ruleset verbatim, so no apply-settings.py change is needed.

4. Decide the repos with no CI. They're private and unprotected today (Free plan), so nothing to do until they go public or gain CI. Worth an explicit note in settings.yml rather than silence.

strict_required_status_checks_policy: true requires branches be up to date before merging. Pairs with allow_update_branch: true, already set — but it does mean a busy main forces more rebases. Reasonable at this repo count; flagging it as a deliberate choice.

Also worth knowing

verify_ruleset() only checks that a ruleset name exists, not that its rules match settings.yml. So a hand-edited rule set won't be reported as drift. Out of scope here, but it limits how much the reconciler actually guarantees.

Scope

• rems-sync calls reusable-python-ci.yml
• deck-eval-parser calls reusable-python-ci.yml
• Context string confirmed on a real PR in every repo with CI
• required_status_checks rule added to .github/settings.yml
• Reconciler run; verified on each public repo
• CONTRIBUTING.md updated — it currently explains the SKIP for private repos but not that CI is a gate
• Position recorded for repos with no CI

Blocks: #16

[gavinbee]

Instead of requiring any particular CI workflow we should require that repos have a workflow like ci or ci_passed that aggregates any of the actual CI workflows. This decouples the "CI must run" requirement from the "which CI workflow(s) are needed for this repo" requirement. In that way it is easy to have a non Python repo or a repo where 5 separate workflows must all pass before CI can be considered passed.