Enforce the four validated GitHub Actions checks on protected dev #187

Follow-up to #156; read-only review at 385e7679fabc60b80cd65cf0a1aa4cdf3d592514 on 2026-10-23. Since this proposal was drafted, Matthew explicitly authorized permanently disabling only admin enforcement; that change was applied and independently verified at 22:22 UTC. No named-status-check change has been made. This improvement does not reinterpret the already completed checks on PR #157. That PR has since been merged using the owner-authorized admin exception; future admin integrations must retain the documented high testing bar.

Require these exact existing contexts, each bound to GitHub Actions app_id 15368, with strict: true (current target branch required):

• CI Success
• Unit Tests (Node 22.18.0)
• Unit Tests (Node 24.x)
• Installer & Deploy Config

CI Success runs always and fails unless quality/harness, every package unit job, real DB/stdio, build/bundle, Security Scan and Smoke Gate all succeed. Its prerequisites need not be duplicated in protection. Comprehensive has no failure-propagating aggregate: Report only posts outcomes and can succeed after failed tests, so require its two Node jobs and installer check directly. Actual check-run API responses on 385e7679 confirm all four names and app 15368.

Do not require advisory Showcase, PR-skipped main/nightly production smoke, or event-specific deployment jobs. No PR path filters exist in these two workflows. Do not add a merge queue here; the workflows have no merge_group trigger.

Current dev protection has required_status_checks:null, one approving review, enforce_admins:false (owner-authorized permanent admin exception), push restrictions Patel230/mvalancy (empty teams/apps), block_creations:true, no force pushes/deletions, and unchanged false review options (dismiss stale, code owner, last push). Preserve all of these, plus current linear-history/conversation/lock/fork settings. The named-check proposal must preserve that owner-authorized admin exception. No identity, permissions, ruleset or auto-merge change is proposed.

Acceptance criteria:

• An authorized administrator re-reads current protection and uses the status-check component endpoint, with the proposed JSON below; do not replace unrelated branch protection. A denial is not permission to expand credentials.
• Read back exact names/app IDs/strict mode; compare every other protection field unchanged and verify non-author review remains required for non-admins and the owner-authorized admin exception remains unchanged.
• Validate enforcement using an isolated reviewable negative control; CI prerequisite failure must fail CI Success, and either Node job/config failure must block. No such negative control is claimed by this draft.
• Document future job-name/matrix changes must update protection. GitHub accepts skipped/neutral required statuses; current CI Success rejects skipped dependencies and direct Comprehensive jobs are unconditional. Workflow review remains necessary.

GitHub branch documentation defines strict/up-to-date behavior and app-bound sources. This draft is a proposal, not authorization to mutate settings or bypass review.

Proposed status-check component only:

{
  "strict": true,
  "checks": [
    {
      "context": "CI Success",
      "app_id": 15368
    },
    {
      "context": "Unit Tests (Node 22.18.0)",
      "app_id": 15368
    },
    {
      "context": "Unit Tests (Node 24.x)",
      "app_id": 15368
    },
    {
      "context": "Installer & Deploy Config",
      "app_id": 15368
    }
  ]
}