[PR-A/Phase 1] Add required status checks to rebuild + develop branch rulesets #158

Problem

develop branch has zero protection rules. gh api repos/BillyOutlast/drop/branches/develop/protection returns HTTP 404 ("Branch not protected"). The default branch rebuild has only the "keep summer safe" ruleset (deletion + non_fast_forward) — NO required status checks anywhere.

Without branch protection, NO CI check can block a merge. This is the root cause of all rubber-stamping in PR #155.

Fix

1a. Update existing "keep summer safe" ruleset (ID 19814537)

Add required_status_checks covering all top-level jobs from ci.yml:

• Validate workflows
• Typecheck
• Test + Coverage
• Lint & Format
• SonarCloud Scan
• CodeQL Advanced
• OSV-Scanner
• Dockerfile Lint
• Shellcheck
• Dependency Review
• Secret Scan

gh api -X PUT repos/BillyOutlast/drop/rulesets/19814537 \
  -f rules='[{...required_status_checks...}]'

1b. Create new ruleset for develop (identical protection)

gh api -X POST repos/BillyOutlast/drop/rulesets \
  -f name="develop-protection" \
  -f target="branch" \
  -f conditions.ref_name.include[]="develop" \
  -f enforcement=active

1c. Verify bypass is blocked

Both rulesets must have bypass_actors: [] and current_user_can_bypass: "never".

Risk

HIGH. Misconfigured required checks can lock out pushes to rebuild. Mitigation:

• Only include jobs from ci.yml (non-path-filtered), not per-workspace workflows
• Per-workspace workflows already covered by husky pre-commit hook
• Test on a synthetic branch first (remediation/test-target from develop)

Verification Gates

# Gate 1a
gh api repos/BillyOutlast/drop/rulesets/19814537 | jq '.rules[] | select(.type == "required_status_checks")' | head

# Gate 1b
gh api repos/BillyOutlast/drop/rulesets | jq '.[] | select(.conditions.ref_name.include[]? == "develop")' | head

# Gate 1c — synthetic PR test
gh pr create --base develop --head remediation/test-target --title "test: required checks" --body "verification" --draft

Rollback

# Revert rebuild ruleset
gh api -X PATCH repos/BillyOutlast/drop/rulesets/19814537 -f rules='[]'

# Delete develop ruleset (capture id from gate 1b first)
gh api -X DELETE repos/BillyOutlast/drop/rulesets/{id}

Effort

~90 min (creating accurate required-checks list + testing)

Provenance

Adversarial 4-member hyperplan, 3 rounds. Phase 1 of the umbrella remediation plan.