docs: define default branch check policy - #10
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟡 Changes recommended
There is a grammatical/clarity issue in the new README text that should be corrected before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Documents the policy contract around default-branch required checks so that GitHub-native Renovate automerge opt-ins (and their constraints on direct default-branch writers) are explicit and easier to apply consistently across repositories.
Changes:
- Adds a “Default-branch checks” section describing native Renovate automerge opt-in requirements (
platformAutomerge: true+default-branch-checksruleset). - Clarifies that required checks apply to direct default-branch pushes and that writer exceptions must be repository-scoped.
- Adds guidance for safely changing rulesets (before/after capture, canary, post-rollout verification) and keeping private inventories private.
File summaries
| File | Description |
|---|---|
| README.md | Adds documentation defining the default-branch checks policy contract and change-management guidance. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![slopzapper[bot]](https://avatars.githubusercontent.com/in/4527847?s=60&v=4){kind=small}
Problem
Required checks used for native dependency automerge also constrain direct default-branch writers, but the shared guidance did not explain that contract.
Solution
Document explicit native-automerge opt-ins, repository-scoped writer exceptions, separate baseline protections, and reviewed fleet readback. Keep private policy inventories with their private owner.