The brief
Team lead hardening a repo after a broken-main incident: require green CI + 1 review + linear history before merge; contributor must land a feature through the gate, including one red→green cycle.
Starter state (seed script)
Use the repo from Scenario 6 (CI present, versions bumped). Protection is OFF. The seed adds a lint failure so your first push is red:
# in the S6 repo
echo "x = 1 " >> src.py # trailing whitespace -> ruff fails
git add . && git commit -m "seed: introduce lint failure"
git push origin main
Your task
- Enable branch protection on
main: Settings → Branches → Add rule — require status checks (Lint, Test), require 1 review, require linear history, no direct pushes. - Create a feature branch, fix the lint failure, push → watch CI go red then green (capture both run links).
- Open a PR; address a review comment in a follow-up commit (never force-push over it).
- Squash-merge + delete the branch, sync your fork.
- Write
GOVERNANCE.md: the ruleset chosen, why squash-merge, a CODEOWNERS entry.
Deliverables
- Repo URL + branch-protection screenshot/CFG (submission notes).
- Merged PR link + red and green Actions run links.
GOVERNANCE.mdfile upload.
Submission contract: paste the repo URL, merged PR link, and both Actions run links into submission notes; upload GOVERNANCE.md. Reviewer checks the protection ruleset is enabled and the PR shows a red→green cycle.
100-pt rubric
- Protection ruleset enabled (required checks + review + no direct push) (25)
- PR shows red→green with both run links (25)
- Review comment addressed in a follow-up commit, not force-pushed over (20)
- Squash-merge + branch cleanup, fork synced (15)
- GOVERNANCE.md justifies each rule (15)