Admin: enforce main branch protection controls
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
Research direction
Start in the repository's branch protection and ruleset settings by inspecting ruleset 17221683 and the required controls listed in this issue. Apply the protection to main only with the necessary repository-admin access, then verify the three required checks and review rules through a test PR. Done means the specified merge restrictions work, force pushes and deletion are blocked, and OpenSSF BranchProtectionID closes.
Written by the indexing model from the issue text.
Description
Context
The September 21, 2026 repository audit resolved the code, workflow-permission, dependency-pinning, and CodeQL findings in #31-#33. OpenSSF Scorecard still reports BranchProtectionID because the current ruleset only restricts branch updates and does not require PR review or status checks.
The authenticated maintainer identity has write but not repository-admin permission, so the branch-protection and ruleset APIs return 404 and this cannot be completed from the current session.
Required configuration
Protect main with:
- Require a pull request before merging
- Require 1 approving review
- Dismiss stale approvals when new commits are pushed
- Require code-owner review (
CODEOWNERSnow maps*to@msfttoler) - Require approval of the most recent reviewable push
- Require all review conversations to be resolved
- Require the branch to be up to date
- Require status checks:
Validate (Node 22.12.0)Validate (Node 24)Analyze (javascript-typescript)
- Enforce for administrators, with a documented emergency bypass actor if organizational policy requires one
- Require linear history
- Block force pushes and deletion
Replace or narrow ruleset 17221683 (Only msfttoler can update branches) after the protection is active so normal reviewed PR merges are not blocked.
Acceptance criteria
- OpenSSF
BranchProtectionIDcloses on the next Scorecard run - A test PR cannot merge with a failing required check
- A test PR cannot merge without the required review unless an authorized emergency bypass is explicitly used
- Dominant language
- TypeScript
- Stars
- 14
- Forks
- 8
- Avg merge
- 3m
- Merged PRs (30d)
- 6
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/cates
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 4 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day