From fdb918202e8abf800564ae9fbcc912fb6b060caf Mon Sep 17 00:00:00 2001 From: Sam Date: Thu, 30 Jul 2026 07:05:36 +0200 Subject: [PATCH] docs(github-pr-workflow): add warning about GitHub Free deleting branch protection on private repos --- .../skills/github-pr-workflow/skill.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/recipes/software-delivery/skills/github-pr-workflow/skill.md b/src/recipes/software-delivery/skills/github-pr-workflow/skill.md index 922126b..1d7b607 100644 --- a/src/recipes/software-delivery/skills/github-pr-workflow/skill.md +++ b/src/recipes/software-delivery/skills/github-pr-workflow/skill.md @@ -133,6 +133,16 @@ When a PR is opened during a session, retrieve the channel ID and thread timesta If there was no Slack thread (the PR was opened from a Linear ticket alone, or it's a Sam-noticed self-maintenance PR), write `Discussion: none (Sam-noticed during on )` so the chain knows there's no thread to ack into and Sam can still attribute the work. +## Branch protection & auto-merge limits (GitHub Free) + +Under GitHub's organization Free plan, branch protection rules (including required status checks and required reviews) are **silently and permanently deleted** when a repository's visibility is changed to private (which might occur temporarily to handle security incidents or credential rotations). + +The consequence is that `gh pr merge --auto --squash` will see zero branch protection requirements and will **merge the PR instantly** upon creation, bypassing all human review and CI checks. + +To guard against unreviewed merges: +- Before running or relying on `--auto` merge as a review gate on a newly privatized repository, verify if branch protection is actually active (e.g. by running `gh api repos///branches/main/protection`). +- If branch protection has been deleted, do NOT use auto-merge; instead, wait for explicit manual review and merge, or coordinate with the operator to restore the branch protection rules. + ## Labels (sam repo only) When opening a PR on `dembrane/sam`, attach a label per source area the diff touches. This is how reviewers see the tier at a glance without opening the file list.