Repository navigation
[engineering-practices] Verify branch protection when CI pipelines are created #39
Description
When agents create CI (and CD) pipelines, there is no check that the integration branch has protection rules requiring the pipeline to pass.
Observed behavior
- Agent created a CI pipeline. Code was merged and PRs landed without waiting for the pipeline because no branch protection was configured.
Desired behavior
- After a pipeline is created (or detected in the session), the agent checks whether the integration branch has protection rules that require the pipeline.
- If protection is missing, the agent suggests adding it.
Acceptance criteria
- Pipeline creation flow verifies branch protection and prompts the user when it is absent.
Activity
fedeoliv commentedon Oct 16, 2026
Implementation verified, pending merge.
Added a read-only Pipeline Protection Check and wired it into planning and implementation, including established projects and low-impact pipeline work. It checks the actual integration branch and check/build names, effective GitHub protection and rulesets, or enabled blocking ADO build validation. Missing protection produces a recommendation, while access errors and unknown checks remain explicitly unverified or pending. Changing protection still requires approval.
Validation:
git diff --checkandnpm --prefix docs run buildpassed. Independent instruction review covered these paths with no remaining significant findings. No live branch-protection settings were changed.Branch:
feature/39-pipeline-protection.Commit:
8d2d5ca537b5a0b5a1aeb180ba3b38f94175bca5.PR: #80.
Changes are committed and pushed. Merge the dependency first: #79. Retarget this PR to main if GitHub has not done so automatically. The issue remains open until merge.