cleveragents/cleveragents-core

Fork 3

[WATCHDOG] Branch protection requires 0 approvals — CONTRIBUTING.md mandates ≥1 #7861

New issue

Open

opened 2026-04-12 05:43:47 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-12 05:43:47 +00:00

Owner

System Watchdog Finding — HIGH Severity

Audit: Branch Protection Verification (Audit 2)
Severity: HIGH
Detected: Cycle 19 (2026-04-12)

Finding

The master branch protection rule has required_approvals: 0, but CONTRIBUTING.md explicitly states:

Peer Review: Minimum 1 approving review (formal or comment; self-approval permitted).

This means PRs can be merged without any review, bypassing the peer review requirement.

Current Branch Protection State

{
  "branch_name": "master",
  "required_approvals": 0,
  "enable_status_check": true,
  "apply_to_admins": true
}

Impact

PRs can be merged without any review
Quality gate for peer review is not enforced at the infrastructure level
Agents could merge their own PRs without review

Recommended Fix

Update the branch protection rule to require at least 1 approving review:

PATCH /repos/cleveragents/cleveragents-core/branch_protections/master
{
  "required_approvals": 1
}

Note: CONTRIBUTING.md allows self-approval, so this should not block automated workflows if the reviewer account approves.

Definition of Done

Branch protection updated to require ≥1 approving review
Verified that automated PR review workflow still functions correctly

Automated by CleverAgents Bot
Supervisor: System Watchdog | Agent: system-watchdog

## System Watchdog Finding — HIGH Severity **Audit**: Branch Protection Verification (Audit 2) **Severity**: HIGH **Detected**: Cycle 19 (2026-04-12) ## Finding The master branch protection rule has `required_approvals: 0`, but CONTRIBUTING.md explicitly states: > **Peer Review**: Minimum **1 approving review** (formal or comment; self-approval permitted). This means PRs can be merged without any review, bypassing the peer review requirement. ## Current Branch Protection State ```json { "branch_name": "master", "required_approvals": 0, "enable_status_check": true, "apply_to_admins": true } ``` ## Impact - PRs can be merged without any review - Quality gate for peer review is not enforced at the infrastructure level - Agents could merge their own PRs without review ## Recommended Fix Update the branch protection rule to require at least 1 approving review: ``` PATCH /repos/cleveragents/cleveragents-core/branch_protections/master { "required_approvals": 1 } ``` Note: CONTRIBUTING.md allows self-approval, so this should not block automated workflows if the reviewer account approves. ## Definition of Done - [ ] Branch protection updated to require ≥1 approving review - [ ] Verified that automated PR review workflow still functions correctly --- **Automated by CleverAgents Bot** Supervisor: System Watchdog | Agent: system-watchdog

HAL9000 referenced this issue

2026-04-12 05:45:24 +00:00

[AUTO-WATCHDOG] System Health Report (Cycle 19) #7857

HAL9000 referenced this issue

2026-04-12 06:08:03 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 1) #7878

HAL9000 referenced this issue

2026-04-12 06:53:07 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 2) #7900

HAL9000 referenced this issue

2026-04-12 07:21:22 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 3) #7909

HAL9000 added the

Automation Tracking

label

2026-04-12 07:30:43 +00:00

HAL9000 referenced this issue

2026-04-12 07:39:17 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 4) #7919

HAL9000 referenced this issue

2026-04-12 07:52:48 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 5) #7928

HAL9000 referenced this issue

2026-04-12 07:55:50 +00:00

[AUTO-BLOG] Backlog Grooming Report (Cycle 1) #7889

HAL9000 referenced this issue

2026-04-12 08:03:23 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 6) #7933

HAL9000 referenced this issue

2026-04-12 08:11:21 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 7) #7941

HAL9000 referenced this issue

2026-04-12 08:20:42 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 8) #7949

HAL9000 referenced this issue

2026-04-12 08:34:11 +00:00

[AUTO-WDOG] Watchdog Status (Cycle 9) #7958

HAL9000 added the

labels

2026-04-12 19:28:03 +00:00

HAL9000 referenced this issue

2026-04-12 19:32:29 +00:00

[AUTO-GROOMER] Backlog Grooming Report (Cycle 1) #8009

freemo removed the

Automation Tracking

label

2026-04-13 18:05:23 +00:00

HAL9000 added

and removed

labels

2026-04-14 05:48:41 +00:00

HAL9000 commented

2026-04-14 05:50:08 +00:00

Author

Owner

✅ Verified — Critical process issue: branch protection requires 0 approvals but CONTRIBUTING.md mandates ≥1. This is a governance violation that allows unreviewed code to merge. MoSCoW: Must-have. Priority: Critical — @freemo please review and fix branch protection settings.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Critical process issue: branch protection requires 0 approvals but CONTRIBUTING.md mandates ≥1. This is a governance violation that allows unreviewed code to merge. MoSCoW: Must-have. Priority: Critical — @freemo please review and fix branch protection settings. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 referenced this issue

2026-04-14 06:38:45 +00:00

[AUTO-PROJ-OWN] Project Owner Supervisor - Cycle 1 Status #9005