@catladder/cli 0.0.0-main-a6b45abe → 0.0.0-main-fd9c5f51

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "0.0.0-main-a6b45abe",
+  "version": "0.0.0-main-fd9c5f51",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/apps/cli/commands/project/__tests__/githubMergeGating.test.ts

@@ -0,0 +1,123 @@
+import { AGGREGATE_CHECK_JOB_NAME } from "@catladder/pipeline";
+import { describe, expect, it } from "vitest";
+import {
+  desiredMergeGatingRuleset,
+  GITHUB_ACTIONS_APP_ID,
+  rulesetProvidesMergeGating,
+} from "../githubMergeGating";
+
+const asRuleset = (overrides: object = {}) => ({
+  id: 1,
+  ...desiredMergeGatingRuleset(),
+  ...overrides,
+});
+
+describe("desiredMergeGatingRuleset", () => {
+  it("requires the aggregate check on the default branch", () => {
+    const ruleset = desiredMergeGatingRuleset();
+    expect(ruleset.enforcement).toBe("active");
+    expect(ruleset.conditions.ref_name.include).toEqual(["~DEFAULT_BRANCH"]);
+    expect(ruleset.rules).toEqual([
+      expect.objectContaining({
+        type: "required_status_checks",
+        parameters: expect.objectContaining({
+          required_status_checks: [
+            {
+              context: AGGREGATE_CHECK_JOB_NAME,
+              integration_id: GITHUB_ACTIONS_APP_ID,
+            },
+          ],
+        }),
+      }),
+    ]);
+  });
+
+  it("lets deploy keys (the release push) bypass the gating — never the workflow token", () => {
+    expect(desiredMergeGatingRuleset().bypass_actors).toEqual([
+      { actor_id: null, actor_type: "DeployKey", bypass_mode: "always" },
+    ]);
+  });
+
+  it("satisfies its own predicate", () => {
+    expect(rulesetProvidesMergeGating(asRuleset())).toBe(true);
+  });
+});
+
+describe("rulesetProvidesMergeGating", () => {
+  it("rejects a disabled ruleset", () => {
+    expect(
+      rulesetProvidesMergeGating(asRuleset({ enforcement: "disabled" })),
+    ).toBe(false);
+  });
+
+  it("rejects a ruleset without the aggregate check", () => {
+    expect(rulesetProvidesMergeGating(asRuleset({ rules: [] }))).toBe(false);
+    expect(
+      rulesetProvidesMergeGating(
+        asRuleset({
+          rules: [
+            {
+              type: "required_status_checks",
+              parameters: {
+                required_status_checks: [{ context: "some other check" }],
+              },
+            },
+          ],
+        }),
+      ),
+    ).toBe(false);
+  });
+
+  it("rejects a ruleset whose deploy-key bypass is missing or weakened", () => {
+    expect(rulesetProvidesMergeGating(asRuleset({ bypass_actors: [] }))).toBe(
+      false,
+    );
+    expect(
+      rulesetProvidesMergeGating(
+        asRuleset({
+          bypass_actors: [
+            {
+              actor_id: null,
+              actor_type: "DeployKey",
+              bypass_mode: "pull_request",
+            },
+          ],
+        }),
+      ),
+    ).toBe(false);
+    // the broken pre-deploy-key encoding: github refuses the built-in
+    // actions app as a bypass actor, so it must not count as gating
+    expect(
+      rulesetProvidesMergeGating(
+        asRuleset({
+          bypass_actors: [
+            {
+              actor_id: GITHUB_ACTIONS_APP_ID,
+              actor_type: "Integration",
+              bypass_mode: "always",
+            },
+          ],
+        }),
+      ),
+    ).toBe(false);
+  });
+
+  it("accepts extra rules and bypass actors alongside ours", () => {
+    const desired = desiredMergeGatingRuleset();
+    expect(
+      rulesetProvidesMergeGating(
+        asRuleset({
+          rules: [{ type: "deletion" }, ...desired.rules],
+          bypass_actors: [
+            {
+              actor_id: 5,
+              actor_type: "RepositoryRole",
+              bypass_mode: "always",
+            },
+            ...desired.bypass_actors,
+          ],
+        }),
+      ),
+    ).toBe(true);
+  });
+});

package/src/apps/cli/commands/project/doctor/checkGithub.ts

@@ -16,6 +16,13 @@ import {
   listGithubSecretNames,
   listGithubVariableNames,
 } from "../../../../../utils/github";
+import type { GithubRuleset } from "../githubMergeGating";
+import {
+  MERGE_GATING_RULESET_NAME,
+  RELEASE_DEPLOY_KEY_SECRET,
+  RELEASE_DEPLOY_KEY_TITLE,
+  rulesetProvidesMergeGating,
+} from "../githubMergeGating";
 import type { DoctorReport } from "./DoctorReport";
 
 /** marker for repo-level (environment-less) targets, see collectSecretTargets */
@@ -161,10 +168,13 @@ export const checkGithub = async (report: DoctorReport, config: Config) => {
 
 /**
  * verifies the merge gating `project setup` configures: auto-merge
- * enabled and the generated `catladder ✅` aggregate check required on
- * the default branch. Without it a PR is mergeable while its checks
- * are still running — gitlab ships this behavior built-in, github
- * silently does not.
+ * enabled and the `catladder merge gating` ruleset requiring the
+ * generated `catladder ✅` aggregate check on the default branch (with
+ * the bypass that lets the release job push). Without the check a PR
+ * is mergeable while its checks are still running — gitlab ships this
+ * behavior built-in, github silently does not. The check required via
+ * classic branch protection instead is flagged: that setup rejects the
+ * release job's own push (GH006).
  */
 const checkGithubMergeGating = async (report: DoctorReport, repo: string) => {
   let repoInfo: { default_branch: string; allow_auto_merge: boolean };
@@ -184,6 +194,64 @@ const checkGithubMergeGating = async (report: DoctorReport, repo: string) => {
   }
 
   const branch = repoInfo.default_branch;
+  let rulesets: Array<{ id: number; name: string }>;
+  try {
+    rulesets = await ghApiJson("GET", `repos/${repo}/rulesets?per_page=100`);
+  } catch (e) {
+    report.warn(`could not list rulesets of ${repo} (${e.message})`);
+    return;
+  }
+  const named = rulesets.find((r) => r.name === MERGE_GATING_RULESET_NAME);
+  const ruleset = named
+    ? await ghApiJson<GithubRuleset>(
+        "GET",
+        `repos/${repo}/rulesets/${named.id}`,
+      ).catch(() => null)
+    : null;
+  if (ruleset && rulesetProvidesMergeGating(ruleset)) {
+    report.ok(
+      `ruleset '${MERGE_GATING_RULESET_NAME}': '${AGGREGATE_CHECK_JOB_NAME}' required on ${branch}, deploy-key bypass for the release push`,
+    );
+  } else if (ruleset) {
+    report.fail(
+      `ruleset '${MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or deploy-key bypass missing)`,
+      "run: catladder project setup",
+    );
+  } else {
+    report.fail(
+      `no '${MERGE_GATING_RULESET_NAME}' ruleset on ${repo} — PRs can merge while the pipeline is red or still running`,
+      "run: catladder project setup",
+    );
+  }
+
+  try {
+    const [keys, secretNames] = await Promise.all([
+      ghApiJson<Array<{ title: string; read_only: boolean }>>(
+        "GET",
+        `repos/${repo}/keys?per_page=100`,
+      ),
+      listGithubSecretNames(repo),
+    ]);
+    const key = keys.find((k) => k.title === RELEASE_DEPLOY_KEY_TITLE);
+    const hasSecret = secretNames.some(
+      (name) => name.toUpperCase() === RELEASE_DEPLOY_KEY_SECRET,
+    );
+    if (key && !key.read_only && hasSecret) {
+      report.ok(
+        `release deploy key '${RELEASE_DEPLOY_KEY_TITLE}' + secret ${RELEASE_DEPLOY_KEY_SECRET} in place`,
+      );
+    } else {
+      report.fail(
+        `release deploy key incomplete (key: ${
+          key ? (key.read_only ? "read-only" : "ok") : "missing"
+        }, secret ${RELEASE_DEPLOY_KEY_SECRET}: ${hasSecret ? "set" : "missing"}) — the release job cannot push past the merge gating`,
+        "run: catladder project setup",
+      );
+    }
+  } catch (e) {
+    report.warn(`could not check the release deploy key (${e.message})`);
+  }
+
   const protection = await ghApiJson<any>(
     "GET",
     `repos/${repo}/branches/${branch}/protection`,
@@ -191,17 +259,15 @@ const checkGithubMergeGating = async (report: DoctorReport, repo: string) => {
   const checks: Array<{ context: string }> =
     protection?.required_status_checks?.checks ?? [];
   if (checks.some((c) => c.context === AGGREGATE_CHECK_JOB_NAME)) {
-    report.ok(`'${AGGREGATE_CHECK_JOB_NAME}' required on ${branch}`);
-  } else {
     report.fail(
-      `'${AGGREGATE_CHECK_JOB_NAME}' is not a required check on ${branch} — PRs can merge while the pipeline is red or still running`,
+      `'${AGGREGATE_CHECK_JOB_NAME}' is still required via classic branch protection on ${branch} — that rejects the release job's push (GH006)`,
       "run: catladder project setup",
     );
   }
   const stale = checks.filter((c) => c.context !== AGGREGATE_CHECK_JOB_NAME);
   if (stale.length > 0) {
     report.warn(
-      `${branch} requires ${stale.length} additional named check(s) (${stale
+      `${branch} requires ${stale.length} additional named check(s) via classic branch protection (${stale
         .map((c) => c.context)
         .join(
           ", ",

package/src/apps/cli/commands/project/githubMergeGating.ts

@@ -0,0 +1,101 @@
+import { AGGREGATE_CHECK_JOB_NAME } from "@catladder/pipeline";
+
+/**
+ * github merge gating — shared between `project setup` (writes it) and
+ * `project doctor` (verifies it).
+ *
+ * The gating lives in a repository RULESET, not classic branch
+ * protection: only rulesets can carry bypass actors, and the release
+ * job needs one. It pushes the release commit and tag straight to the
+ * default branch — under classic protection the required `catladder ✅`
+ * check rejects that push (GH006), because the fresh release commit
+ * cannot have a passing check yet.
+ *
+ * The bypass actor is a DEPLOY KEY: github deliberately refuses the
+ * built-in GitHub Actions app on bypass lists (any collaborator could
+ * push anywhere by authoring a workflow), so the workflow token can
+ * never bypass. Instead `project setup` provisions a write deploy key
+ * (public half on the repo, private half as an actions secret) and the
+ * release job pushes over ssh with it. Deploy keys are repo-scoped,
+ * only admins can add them, and they never expire — gitlab's
+ * counterpart is the maintainer-role `GL_TOKEN`, which has to be
+ * renewed yearly.
+ */
+
+/** the app id of GitHub Actions — the integration reporting the check */
+export const GITHUB_ACTIONS_APP_ID = 15368;
+
+export const MERGE_GATING_RULESET_NAME = "catladder merge gating";
+
+/** title of the deploy key `project setup` registers on the repo */
+export const RELEASE_DEPLOY_KEY_TITLE = "catladder release";
+
+/**
+ * actions secret holding the deploy key's private half; the generated
+ * release jobs pass it to catci, which pushes over ssh when it is set
+ */
+export const RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
+
+export type GithubRuleset = {
+  id: number;
+  name: string;
+  enforcement: string;
+  rules?: Array<{
+    type: string;
+    parameters?: {
+      required_status_checks?: Array<{ context: string }>;
+    };
+  }>;
+  bypass_actors?: Array<{
+    actor_id?: number | null;
+    actor_type: string;
+    bypass_mode: string;
+  }>;
+};
+
+/** the ruleset `project setup` creates (and restores on drift) */
+export const desiredMergeGatingRuleset = () => ({
+  name: MERGE_GATING_RULESET_NAME,
+  target: "branch",
+  enforcement: "active",
+  conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+  rules: [
+    {
+      type: "required_status_checks",
+      parameters: {
+        strict_required_status_checks_policy: false,
+        do_not_enforce_on_create: false,
+        required_status_checks: [
+          {
+            context: AGGREGATE_CHECK_JOB_NAME,
+            integration_id: GITHUB_ACTIONS_APP_ID,
+          },
+        ],
+      },
+    },
+  ],
+  bypass_actors: [
+    // deploy keys carry no id — the bypass covers every deploy key of
+    // the repository (adding one requires admin anyway)
+    { actor_id: null, actor_type: "DeployKey", bypass_mode: "always" },
+  ],
+});
+
+/**
+ * whether a ruleset provides working merge gating: active, requires
+ * the aggregate check, and lets the release deploy key bypass it.
+ * Extra rules or bypass actors someone added are fine.
+ */
+export const rulesetProvidesMergeGating = (ruleset: GithubRuleset): boolean =>
+  ruleset.enforcement === "active" &&
+  (ruleset.rules ?? []).some(
+    (rule) =>
+      rule.type === "required_status_checks" &&
+      (rule.parameters?.required_status_checks ?? []).some(
+        (check) => check.context === AGGREGATE_CHECK_JOB_NAME,
+      ),
+  ) &&
+  (ruleset.bypass_actors ?? []).some(
+    (actor) =>
+      actor.actor_type === "DeployKey" && actor.bypass_mode === "always",
+  );

package/src/apps/cli/commands/project/setup/index.ts

@@ -40,13 +40,14 @@ export const setupProject = async (
 
   const enabledPipelines = config ? getEnabledPipelineTypes(config) : [];
   await logSection(instance, "base setup", async () => {
-    // gitlab-specific provisioning (access token, agent webhooks) —
-    // meaningless (and failing) on a github-only project
+    // gitlab-specific provisioning (access token, agent webhooks, the
+    // `catladder` project topic) — meaningless (and failing) on a
+    // github-only project
     if (enabledPipelines.includes("gitlab")) {
       await setupAccessTokens(instance);
       await setupAgents(instance);
+      await setupTopic(instance);
     }
-    await setupTopic(instance);
     if (config) {
       await setupGithub(instance, config);
     }

package/src/apps/cli/commands/project/setup/setupGithub.ts

@@ -4,9 +4,29 @@ import {
   getEnabledPipelineTypes,
   getPipelineGitRemote,
 } from "@catladder/pipeline";
+import { execFile as execFileCb } from "child_process";
+import { mkdtemp, readFile, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { promisify } from "util";
 import { getConfiguredGithubRepo } from "../../../../../commands/project/commandSecretsSyncGithub";
 import type { IO } from "../../../../../core/types";
-import { ghApiJson, isGhAuthenticated } from "../../../../../utils/github";
+import {
+  ghApiJson,
+  isGhAuthenticated,
+  listGithubSecretNames,
+  setGithubSecret,
+} from "../../../../../utils/github";
+import type { GithubRuleset } from "../githubMergeGating";
+import {
+  desiredMergeGatingRuleset,
+  MERGE_GATING_RULESET_NAME,
+  RELEASE_DEPLOY_KEY_SECRET,
+  RELEASE_DEPLOY_KEY_TITLE,
+  rulesetProvidesMergeGating,
+} from "../githubMergeGating";
+
+const execFile = promisify(execFileCb);
 
 /**
  * configures github merge gating — the sane default gitlab ships
@@ -15,15 +35,20 @@ import { ghApiJson, isGhAuthenticated } from "../../../../../utils/github";
  * auto-merge button never appears.
  *
  * - repo settings: allow auto-merge, delete merged head branches
- * - branch protection on the default branch: require the generated
+ * - the release deploy key: a write deploy key on the repo, its
+ *   private half stored as the CATLADDER_RELEASE_KEY actions secret —
+ *   the release job pushes the release commit and tag with it
+ * - a repository ruleset on the default branch requiring the generated
  *   `catladder ✅` aggregate check (the one stable context — individual
- *   job names change with every component add/rename)
+ *   job names change with every component add/rename), with a deploy
+ *   key bypass so the release push goes through (see
+ *   githubMergeGating.ts for the full rationale)
  *
- * Deliberately non-destructive: existing protection settings
- * (enforce-admins, required reviews, restrictions, strictness) are
- * preserved; the aggregate context is merged into the required checks
- * rather than replacing them. Admins can still bypass per PR — this is
- * a default, not a cage.
+ * Earlier versions required the check via classic branch protection,
+ * which has no bypass list — the release job's direct push to the
+ * default branch bounced off catladder's own gating (GH006). Setup
+ * migrates that away: the aggregate context is removed from an
+ * existing classic rule, everything else in it is preserved.
  */
 export const setupGithub = async (instance: IO, config: Config) => {
   if (!getEnabledPipelineTypes(config).includes("github")) {
@@ -59,34 +84,167 @@ export const setupGithub = async (instance: IO, config: Config) => {
     instance.log("✅ auto-merge already enabled");
   }
 
+  await ensureReleaseDeployKey(instance, repo);
+
   const branch = repoInfo.default_branch;
+  const rulesets = await ghApiJson<Array<{ id: number; name: string }>>(
+    "GET",
+    `repos/${repo}/rulesets?per_page=100`,
+  );
+  const existing = rulesets.find((r) => r.name === MERGE_GATING_RULESET_NAME);
+  if (!existing) {
+    await ghApiJson(
+      "POST",
+      `repos/${repo}/rulesets`,
+      desiredMergeGatingRuleset(),
+    );
+    instance.log(
+      `✅ ruleset '${MERGE_GATING_RULESET_NAME}': '${AGGREGATE_CHECK_JOB_NAME}' required on ${branch} — merges wait for the pipeline, the release job can push`,
+    );
+  } else {
+    const detail = await ghApiJson<GithubRuleset>(
+      "GET",
+      `repos/${repo}/rulesets/${existing.id}`,
+    );
+    if (rulesetProvidesMergeGating(detail)) {
+      instance.log(
+        `✅ ruleset '${MERGE_GATING_RULESET_NAME}' already in place on ${branch}`,
+      );
+    } else {
+      await ghApiJson(
+        "PUT",
+        `repos/${repo}/rulesets/${existing.id}`,
+        desiredMergeGatingRuleset(),
+      );
+      instance.log(
+        `✅ ruleset '${MERGE_GATING_RULESET_NAME}' restored — '${AGGREGATE_CHECK_JOB_NAME}' required, release-job bypass in place`,
+      );
+    }
+  }
+
+  await migrateAwayFromClassicProtection(instance, repo, branch);
+};
+
+/**
+ * provisions the release deploy key: an ed25519 keypair whose public
+ * half becomes a write deploy key on the repo and whose private half
+ * becomes the CATLADDER_RELEASE_KEY actions secret. The key and the
+ * secret only work as a pair, so when either half is missing the pair
+ * is rotated (github secrets are write-only — the private half can
+ * never be read back to check it matches).
+ */
+const ensureReleaseDeployKey = async (instance: IO, repo: string) => {
+  const [keys, secretNames] = await Promise.all([
+    ghApiJson<Array<{ id: number; title: string; read_only: boolean }>>(
+      "GET",
+      `repos/${repo}/keys?per_page=100`,
+    ),
+    listGithubSecretNames(repo),
+  ]);
+  const existingKey = keys.find((k) => k.title === RELEASE_DEPLOY_KEY_TITLE);
+  const hasSecret = secretNames.some(
+    (name) => name.toUpperCase() === RELEASE_DEPLOY_KEY_SECRET,
+  );
+  if (existingKey && !existingKey.read_only && hasSecret) {
+    instance.log(
+      `✅ release deploy key '${RELEASE_DEPLOY_KEY_TITLE}' + secret ${RELEASE_DEPLOY_KEY_SECRET} in place`,
+    );
+    return;
+  }
+  if (existingKey) {
+    await ghApiJson("DELETE", `repos/${repo}/keys/${existingKey.id}`);
+    instance.log(
+      `♻️ release deploy key '${RELEASE_DEPLOY_KEY_TITLE}' rotated (${
+        existingKey.read_only
+          ? "was read-only"
+          : `secret ${RELEASE_DEPLOY_KEY_SECRET} missing`
+      })`,
+    );
+  }
+
+  const dir = await mkdtemp(join(tmpdir(), "catladder-release-key-"));
+  try {
+    const keyFile = join(dir, "id_ed25519");
+    await execFile("ssh-keygen", [
+      ...["-t", "ed25519"],
+      ...["-C", `${RELEASE_DEPLOY_KEY_TITLE} (${repo})`],
+      ...["-N", ""],
+      ...["-f", keyFile],
+      "-q",
+    ]);
+    const [privateKey, publicKey] = await Promise.all([
+      readFile(keyFile, "utf-8"),
+      readFile(`${keyFile}.pub`, "utf-8"),
+    ]);
+    await ghApiJson("POST", `repos/${repo}/keys`, {
+      title: RELEASE_DEPLOY_KEY_TITLE,
+      key: publicKey.trim(),
+      read_only: false,
+    });
+    await setGithubSecret(repo, RELEASE_DEPLOY_KEY_SECRET, privateKey);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+  instance.log(
+    `✅ release deploy key '${RELEASE_DEPLOY_KEY_TITLE}' registered, private half stored as secret ${RELEASE_DEPLOY_KEY_SECRET} — the release job pushes with it`,
+  );
+};
+
+/**
+ * removes the aggregate check from a classic branch protection rule
+ * set up by earlier catladder versions — with the check now required
+ * via the ruleset, the classic one would still reject the release
+ * job's push. Everything else in the rule is preserved; the whole rule
+ * is deleted when the check was all it carried.
+ */
+const migrateAwayFromClassicProtection = async (
+  instance: IO,
+  repo: string,
+  branch: string,
+) => {
   const protection = await ghApiJson<any>(
     "GET",
     `repos/${repo}/branches/${branch}/protection`,
-  ).catch(() => null); // 404: branch not protected yet
-
-  const existingChecks: Array<{ context: string; app_id?: number }> =
+  ).catch(() => null); // 404: branch not protected
+  const checks: Array<{ context: string; app_id?: number }> =
     protection?.required_status_checks?.checks ?? [];
-  if (existingChecks.some((c) => c.context === AGGREGATE_CHECK_JOB_NAME)) {
+  if (!checks.some((c) => c.context === AGGREGATE_CHECK_JOB_NAME)) {
+    return;
+  }
+  const remaining = checks.filter(
+    (c) => c.context !== AGGREGATE_CHECK_JOB_NAME,
+  );
+  const carriesAnythingElse =
+    remaining.length > 0 ||
+    protection?.enforce_admins?.enabled ||
+    protection?.required_pull_request_reviews ||
+    protection?.restrictions ||
+    protection?.required_linear_history?.enabled ||
+    protection?.required_conversation_resolution?.enabled ||
+    protection?.required_signatures?.enabled ||
+    protection?.lock_branch?.enabled ||
+    protection?.allow_force_pushes?.enabled ||
+    protection?.allow_deletions?.enabled;
+  if (!carriesAnythingElse) {
+    await ghApiJson("DELETE", `repos/${repo}/branches/${branch}/protection`);
     instance.log(
-      `✅ '${AGGREGATE_CHECK_JOB_NAME}' already required on ${branch}`,
+      `✅ classic branch protection on ${branch} removed — '${AGGREGATE_CHECK_JOB_NAME}' was all it carried, and it is now required via the ruleset`,
     );
     return;
   }
-
-  // merge into whatever protection exists; PUT replaces the whole rule,
-  // so every preserved setting must be carried over explicitly
+  // PUT replaces the whole rule, so every preserved setting must be
+  // carried over explicitly
   await ghApiJson("PUT", `repos/${repo}/branches/${branch}/protection`, {
-    required_status_checks: {
-      strict: protection?.required_status_checks?.strict ?? false,
-      checks: [
-        ...existingChecks.map(({ context, app_id }) => ({
-          context,
-          ...(app_id !== undefined ? { app_id } : {}),
-        })),
-        { context: AGGREGATE_CHECK_JOB_NAME },
-      ],
-    },
+    required_status_checks:
+      remaining.length > 0
+        ? {
+            strict: protection?.required_status_checks?.strict ?? false,
+            checks: remaining.map(({ context, app_id }) => ({
+              context,
+              ...(app_id !== undefined ? { app_id } : {}),
+            })),
+          }
+        : null,
     enforce_admins: protection?.enforce_admins?.enabled ?? false,
     required_pull_request_reviews: protection?.required_pull_request_reviews
       ? {
@@ -108,10 +266,15 @@ export const setupGithub = async (instance: IO, config: Config) => {
           apps: protection.restrictions.apps.map((a: any) => a.slug),
         }
       : null,
+    required_linear_history:
+      protection?.required_linear_history?.enabled ?? false,
+    required_conversation_resolution:
+      protection?.required_conversation_resolution?.enabled ?? false,
+    lock_branch: protection?.lock_branch?.enabled ?? false,
     allow_force_pushes: protection?.allow_force_pushes?.enabled ?? false,
     allow_deletions: protection?.allow_deletions?.enabled ?? false,
   });
   instance.log(
-    `✅ branch protection on ${branch}: '${AGGREGATE_CHECK_JOB_NAME}' required (merges now wait for the pipeline)`,
+    `✅ '${AGGREGATE_CHECK_JOB_NAME}' removed from classic branch protection on ${branch} — now required via the ruleset; the rest of the rule is preserved`,
   );
 };