Proposal: improve quality-enforcer — add branch protection required_approvals check and fix to enforce CONTRIBUTING.md 2-approval requirement #5386

New issue

Open

opened 2026-04-09 06:17:10 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-09 06:17:10 +00:00

Owner

Agent Improvement Proposal

Pattern Detected

Type: workflow_fix
Affected Agent: quality-enforcer
Evidence: System watchdog cycle 43 report (issue #5299, 2026-04-09T05:44:00Z) identified that branch protection has required_approvals: 0 despite CONTRIBUTING.md requiring 2 approvals per PR. This means PRs can merge without any human review, which is a significant quality gate violation.

Detailed Evidence

From watchdog cycle 43 report (issue #5299):

### 2. Branch Protection — ⚠️ Required Approvals = 0
- Branch protection is active with status checks required ✅
- However: required_approvals: 0 — PRs can merge without any human review
- CONTRIBUTING.md requires 2 approvals per PR
- Severity: HIGH — This allows unreviewed code to reach master

From CONTRIBUTING.md (inferred from watchdog report):

PRs require 2 approvals before merging

Root cause: The quality-enforcer agent is described as verifying and repairing Forgejo branch protection configuration, but it does not currently check or fix the required_approvals setting. The agent focuses on CI status checks but misses the approval count requirement.

Impact: Any PR can be merged without human review. This undermines the entire code review process and allows unreviewed code to reach master. The watchdog has flagged this as HIGH severity.

Proposed Change

Add a required_approvals check to quality-enforcer.md:

Add to the branch protection verification section:

The quality-enforcer should:

Query the branch protection settings for master via Forgejo API:
GET /repos/{owner}/{repo}/branches/master/protection
Check that required_approvals is set to 2 (as required by CONTRIBUTING.md)
If required_approvals is 0 or less than 2:
- Attempt to update branch protection to set required_approvals: 2 via:
  PATCH /repos/{owner}/{repo}/branches/master/protection
- If the update succeeds: log the fix
- If the update fails (insufficient permissions): create a Priority/CI-Blocker issue:
  Title: "fix(ci): branch protection required_approvals=0 — must be set to 2 per CONTRIBUTING.md"
  Body: Include current setting, required setting, and steps to fix manually
Report the finding in the quality-enforcer's health report

Specific check to add:

### Required Approvals Check

1. GET /repos/{owner}/{repo}/branches/master/protection
2. Check response.required_pull_request_reviews.required_approving_review_count
3. If count < 2:
   - Try PATCH to set required_approving_review_count: 2
   - If PATCH fails: create Priority/CI-Blocker issue documenting the gap
   - If PATCH succeeds: log "Fixed: required_approvals set to 2"
4. Report result in health tracking issue

Expected Impact

Quality gate enforced: PRs will require 2 human approvals before merging, as CONTRIBUTING.md requires
Automated detection: The quality-enforcer will catch this setting drift automatically rather than relying on watchdog reports
Automated remediation: If the bot has sufficient permissions, it will fix the setting automatically
Audit trail: If it cannot fix automatically, it creates a tracked issue for human attention

Risk Assessment

Low risk: This is a purely defensive check. If the bot lacks permissions to update branch protection, it creates an issue instead of failing silently.
Potential concern: Setting required_approvals=2 may slow down the merge pipeline if reviewers are not available. However, this is the correct behavior per CONTRIBUTING.md — the pipeline should not bypass review requirements.
Potential concern: The bot may not have admin permissions to update branch protection. Mitigation: the proposal includes fallback to issue creation if the update fails.

This is a proposal from the agent evolver. A human must approve this issue before the change will be implemented. To approve: remove the needs feedback label, add State/Verified, or comment with approval.

Automated by CleverAgents Bot
Supervisor: Agent Evolver | Agent: agent-evolver

## Agent Improvement Proposal ### Pattern Detected **Type**: workflow_fix **Affected Agent**: `quality-enforcer` **Evidence**: System watchdog cycle 43 report (issue #5299, 2026-04-09T05:44:00Z) identified that branch protection has `required_approvals: 0` despite CONTRIBUTING.md requiring 2 approvals per PR. This means PRs can merge without any human review, which is a significant quality gate violation. ### Detailed Evidence From watchdog cycle 43 report (issue #5299): ``` ### 2. Branch Protection — ⚠️ Required Approvals = 0 - Branch protection is active with status checks required ✅ - However: required_approvals: 0 — PRs can merge without any human review - CONTRIBUTING.md requires 2 approvals per PR - Severity: HIGH — This allows unreviewed code to reach master ``` From CONTRIBUTING.md (inferred from watchdog report): > PRs require 2 approvals before merging **Root cause**: The `quality-enforcer` agent is described as verifying and repairing Forgejo branch protection configuration, but it does not currently check or fix the `required_approvals` setting. The agent focuses on CI status checks but misses the approval count requirement. **Impact**: Any PR can be merged without human review. This undermines the entire code review process and allows unreviewed code to reach master. The watchdog has flagged this as HIGH severity. ### Proposed Change Add a `required_approvals` check to `quality-enforcer.md`: **Add to the branch protection verification section:** The quality-enforcer should: 1. Query the branch protection settings for master via Forgejo API: `GET /repos/{owner}/{repo}/branches/master/protection` 2. Check that `required_approvals` is set to 2 (as required by CONTRIBUTING.md) 3. If `required_approvals` is 0 or less than 2: - Attempt to update branch protection to set `required_approvals: 2` via: `PATCH /repos/{owner}/{repo}/branches/master/protection` - If the update succeeds: log the fix - If the update fails (insufficient permissions): create a `Priority/CI-Blocker` issue: Title: "fix(ci): branch protection required_approvals=0 — must be set to 2 per CONTRIBUTING.md" Body: Include current setting, required setting, and steps to fix manually 4. Report the finding in the quality-enforcer's health report **Specific check to add:** ``` ### Required Approvals Check 1. GET /repos/{owner}/{repo}/branches/master/protection 2. Check response.required_pull_request_reviews.required_approving_review_count 3. If count < 2: - Try PATCH to set required_approving_review_count: 2 - If PATCH fails: create Priority/CI-Blocker issue documenting the gap - If PATCH succeeds: log "Fixed: required_approvals set to 2" 4. Report result in health tracking issue ``` ### Expected Impact - **Quality gate enforced**: PRs will require 2 human approvals before merging, as CONTRIBUTING.md requires - **Automated detection**: The quality-enforcer will catch this setting drift automatically rather than relying on watchdog reports - **Automated remediation**: If the bot has sufficient permissions, it will fix the setting automatically - **Audit trail**: If it cannot fix automatically, it creates a tracked issue for human attention ### Risk Assessment - **Low risk**: This is a purely defensive check. If the bot lacks permissions to update branch protection, it creates an issue instead of failing silently. - **Potential concern**: Setting required_approvals=2 may slow down the merge pipeline if reviewers are not available. However, this is the correct behavior per CONTRIBUTING.md — the pipeline should not bypass review requirements. - **Potential concern**: The bot may not have admin permissions to update branch protection. Mitigation: the proposal includes fallback to issue creation if the update fails. --- *This is a proposal from the agent evolver. A human must approve this issue before the change will be implemented. To approve: remove the `needs feedback` label, add `State/Verified`, or comment with approval.* --- **Automated by CleverAgents Bot** Supervisor: Agent Evolver | Agent: agent-evolver

HAL9000 added the

labels

2026-04-09 06:17:19 +00:00

HAL9000 commented

2026-04-09 06:33:29 +00:00

Author

Owner

Label compliance fix applied:

Added missing labels to bring issue into compliance with CONTRIBUTING.md

Automated by CleverAgents Bot
Supervisor: Backlog Grooming | Agent: backlog-groomer

Label compliance fix applied: - Added missing labels to bring issue into compliance with CONTRIBUTING.md --- **Automated by CleverAgents Bot** Supervisor: Backlog Grooming | Agent: backlog-groomer

Rows
Columns