From de84ba2822c051ba22ab38cc482700d8f79d9201 Mon Sep 17 00:00:00 2001 From: Avni Salhotra Date: Sun, 26 Jul 2026 20:13:36 -0700 Subject: [PATCH 1/4] docs: document main merge protections --- .../2026-07-24-parallel-worktree-execution.md | 15 ++++++++++----- .../2026-07-24-ux-portfolio-implementation.md | 10 +++++++--- readme.md | 9 +++++++++ 3 files changed, 26 insertions(+), 8 deletions(-) diff --git a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md index ff83243..cd27003 100644 --- a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md +++ b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md @@ -170,11 +170,16 @@ suites are added, required checks therefore include: - approved visual regression checks - serialized Lighthouse CI -GitHub branch protection should require passing checks, one approval from -someone other than the author, and dismissal of stale approvals. If the -repository/account cannot enforce one of these settings, document the gap and -apply the same rule manually; never claim a protection is enabled when it is -not. +GitHub branch protection requires the `verify` check, verified signatures on +every commit entering `main`, resolution of every pull-request review +conversation before merge, and enforcement for administrators. CodeRabbit +should review every pull request, but its review is not a required status check +until the installed GitHub App emits a stable check name that branch protection +can require. The planned gate additionally calls for one approval from someone +other than the author and dismissal of stale approvals; those approval settings +are not currently enforced. If the repository/account cannot enforce a planned +setting, document the gap and apply the same rule manually; never claim a +protection is enabled when it is not. ## Evidence and Browser Claims diff --git a/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md b/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md index e56940d..be78e76 100644 --- a/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md +++ b/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md @@ -2250,9 +2250,13 @@ Store this exact checklist in `docs/deployment.md`. Also document the GitHub merge gate: author and approver must differ, stale approvals are dismissed after new commits, required CI checks must pass, and -only the integrator merges the approved head SHA. If repository permissions do -not support branch protection, the integrator enforces the same checklist -manually and records that limitation truthfully. +only the integrator merges the approved head SHA. The active `main` protection +also requires verified signatures on every commit, resolution of all +pull-request review conversations, the `verify` check, and administrator +enforcement. CodeRabbit review remains a manual requirement until its GitHub +App emits a stable status check that can be made required. If repository +permissions do not support branch protection, the integrator enforces the same +checklist manually and records that limitation truthfully. - [ ] **Step 2: Verify the repository locally before external setup** diff --git a/readme.md b/readme.md index 21895a7..ad0d674 100644 --- a/readme.md +++ b/readme.md @@ -38,6 +38,15 @@ Node major while allowing Node 22 patch and minor updates. `npm run check:dependabot` validates that guard with the declared Node YAML parser, and the shared `npm run verify` gate runs that check in CI. +GitHub protects `main` by requiring the existing `verify` check to succeed +before a change can be accepted. The requirement applies to repository +administrators. Every commit entering `main` must have a verified signature, +and every pull-request review conversation must be resolved before merge. +Branch freshness and reviewer approval are not required by this gate. +CodeRabbit review is intended for every pull request, but it is not yet an +enforced status check because the CodeRabbit GitHub App has not emitted a +stable check in this repository. + ## Portfolio project The approved design for the code-first UX portfolio is documented in From 763fc1ea602209bbc7dc279104b1df694530f08e Mon Sep 17 00:00:00 2001 From: Avni Salhotra Date: Sun, 26 Jul 2026 20:18:00 -0700 Subject: [PATCH 2/4] docs: record required CodeRabbit review --- .../2026-07-24-parallel-worktree-execution.md | 14 ++++++-------- .../2026-07-24-ux-portfolio-implementation.md | 8 ++++---- readme.md | 4 +--- 3 files changed, 11 insertions(+), 15 deletions(-) diff --git a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md index cd27003..8f0f80b 100644 --- a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md +++ b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md @@ -172,14 +172,12 @@ suites are added, required checks therefore include: GitHub branch protection requires the `verify` check, verified signatures on every commit entering `main`, resolution of every pull-request review -conversation before merge, and enforcement for administrators. CodeRabbit -should review every pull request, but its review is not a required status check -until the installed GitHub App emits a stable check name that branch protection -can require. The planned gate additionally calls for one approval from someone -other than the author and dismissal of stale approvals; those approval settings -are not currently enforced. If the repository/account cannot enforce a planned -setting, document the gap and apply the same rule manually; never claim a -protection is enabled when it is not. +conversation before merge, the `CodeRabbit` review status, and enforcement for +administrators. The planned gate additionally calls for one approval from +someone other than the author and dismissal of stale approvals; those approval +settings are not currently enforced. If the repository/account cannot enforce a +planned setting, document the gap and apply the same rule manually; never claim +a protection is enabled when it is not. ## Evidence and Browser Claims diff --git a/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md b/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md index be78e76..382898e 100644 --- a/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md +++ b/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md @@ -2253,10 +2253,10 @@ approvals are dismissed after new commits, required CI checks must pass, and only the integrator merges the approved head SHA. The active `main` protection also requires verified signatures on every commit, resolution of all pull-request review conversations, the `verify` check, and administrator -enforcement. CodeRabbit review remains a manual requirement until its GitHub -App emits a stable status check that can be made required. If repository -permissions do not support branch protection, the integrator enforces the same -checklist manually and records that limitation truthfully. +enforcement. Every pull request must also pass the required `CodeRabbit` review +status. If repository permissions do not support branch protection, the +integrator enforces the same checklist manually and records that limitation +truthfully. - [ ] **Step 2: Verify the repository locally before external setup** diff --git a/readme.md b/readme.md index ad0d674..a9eb811 100644 --- a/readme.md +++ b/readme.md @@ -43,9 +43,7 @@ before a change can be accepted. The requirement applies to repository administrators. Every commit entering `main` must have a verified signature, and every pull-request review conversation must be resolved before merge. Branch freshness and reviewer approval are not required by this gate. -CodeRabbit review is intended for every pull request, but it is not yet an -enforced status check because the CodeRabbit GitHub App has not emitted a -stable check in this repository. +Every pull request must also pass the required `CodeRabbit` review status. ## Portfolio project From 8bbde544239e7930a6897e172fc4801345321f76 Mon Sep 17 00:00:00 2001 From: Avni Salhotra Date: Sun, 26 Jul 2026 20:33:37 -0700 Subject: [PATCH 3/4] ci: enforce CodeRabbit review workflow --- .coderabbit.yaml | 3 +++ .../2026-07-24-parallel-worktree-execution.md | 9 +++++---- .../2026-07-24-ux-portfolio-implementation.md | 15 ++++++++------- readme.md | 6 ++++-- 4 files changed, 20 insertions(+), 13 deletions(-) create mode 100644 .coderabbit.yaml diff --git a/.coderabbit.yaml b/.coderabbit.yaml new file mode 100644 index 0000000..d7c91c4 --- /dev/null +++ b/.coderabbit.yaml @@ -0,0 +1,3 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +reviews: + request_changes_workflow: true diff --git a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md index 8f0f80b..3c793bb 100644 --- a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md +++ b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md @@ -172,10 +172,11 @@ suites are added, required checks therefore include: GitHub branch protection requires the `verify` check, verified signatures on every commit entering `main`, resolution of every pull-request review -conversation before merge, the `CodeRabbit` review status, and enforcement for -administrators. The planned gate additionally calls for one approval from -someone other than the author and dismissal of stale approvals; those approval -settings are not currently enforced. If the repository/account cannot enforce a +conversation before merge, one approval from someone other than the author, +dismissal of stale approvals after new commits, and enforcement for +administrators. CodeRabbit's request-changes workflow is enabled in +`.coderabbit.yaml`: its findings request changes, and it approves after its +review conversations are resolved. If the repository/account cannot enforce a planned setting, document the gap and apply the same rule manually; never claim a protection is enabled when it is not. diff --git a/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md b/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md index 382898e..ee54544 100644 --- a/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md +++ b/docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md @@ -2248,13 +2248,14 @@ git commit -m "test: enforce portfolio performance budgets" Store this exact checklist in `docs/deployment.md`. -Also document the GitHub merge gate: author and approver must differ, stale -approvals are dismissed after new commits, required CI checks must pass, and -only the integrator merges the approved head SHA. The active `main` protection -also requires verified signatures on every commit, resolution of all -pull-request review conversations, the `verify` check, and administrator -enforcement. Every pull request must also pass the required `CodeRabbit` review -status. If repository permissions do not support branch protection, the +Also document the GitHub merge gate: required CI checks must pass, and only +the integrator merges the approved head SHA. The active `main` protection +requires the author and approver to differ, dismisses stale approvals after new +commits, and also requires verified signatures on every commit, resolution of +all pull-request review conversations, the `verify` check, and administrator +enforcement. CodeRabbit's request-changes workflow is enabled in +`.coderabbit.yaml`, so its findings block approval until their conversations +are resolved. If repository permissions do not support branch protection, the integrator enforces the same checklist manually and records that limitation truthfully. diff --git a/readme.md b/readme.md index a9eb811..8261b63 100644 --- a/readme.md +++ b/readme.md @@ -42,8 +42,10 @@ GitHub protects `main` by requiring the existing `verify` check to succeed before a change can be accepted. The requirement applies to repository administrators. Every commit entering `main` must have a verified signature, and every pull-request review conversation must be resolved before merge. -Branch freshness and reviewer approval are not required by this gate. -Every pull request must also pass the required `CodeRabbit` review status. +Branch freshness is not required by this gate. Every pull request must receive +one fresh approval; new commits dismiss stale approvals. CodeRabbit's +request-changes workflow is enabled in `.coderabbit.yaml`, so its findings block +approval until their review conversations are resolved. ## Portfolio project From 0fa3771021be369129c9530fb849b1e3c19b5234 Mon Sep 17 00:00:00 2001 From: Avni Salhotra Date: Sun, 26 Jul 2026 20:37:00 -0700 Subject: [PATCH 4/4] docs: clarify CodeRabbit approval conditions --- .../plans/2026-07-24-parallel-worktree-execution.md | 7 ++++--- readme.md | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md index 3c793bb..177b32c 100644 --- a/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md +++ b/docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md @@ -176,9 +176,10 @@ conversation before merge, one approval from someone other than the author, dismissal of stale approvals after new commits, and enforcement for administrators. CodeRabbit's request-changes workflow is enabled in `.coderabbit.yaml`: its findings request changes, and it approves after its -review conversations are resolved. If the repository/account cannot enforce a -planned setting, document the gap and apply the same rule manually; never claim -a protection is enabled when it is not. +review conversations are resolved and its configured pre-merge checks pass. If +the repository/account cannot enforce a planned setting, document the gap and +apply the same rule manually; never claim a protection is enabled when it is +not. ## Evidence and Browser Claims diff --git a/readme.md b/readme.md index 8261b63..b282d20 100644 --- a/readme.md +++ b/readme.md @@ -43,9 +43,10 @@ before a change can be accepted. The requirement applies to repository administrators. Every commit entering `main` must have a verified signature, and every pull-request review conversation must be resolved before merge. Branch freshness is not required by this gate. Every pull request must receive -one fresh approval; new commits dismiss stale approvals. CodeRabbit's -request-changes workflow is enabled in `.coderabbit.yaml`, so its findings block -approval until their review conversations are resolved. +one fresh approval from someone other than the author; new commits dismiss +stale approvals. CodeRabbit's request-changes workflow is enabled in +`.coderabbit.yaml`, so its findings block approval until their review +conversations are resolved. ## Portfolio project