Document branch protection + dedicated bot account #4

2026-08-23T14:51:40Z

william commented

2026-08-23 14:51:40 +00:00

Docs only.

william added 1 commit 2026-08-23 14:51:40 +00:00

Document branch protection + dedicated bot account so the bot can only open PRs, never merge 6d0cb3bba3

william commented

2026-08-23 14:52:28 +00:00

Reviewed the diff (README.md, +26 lines, docs-only — matches the description).

Correctness: No bugs. The Gitea branch-protection API call is accurate — branch_protections endpoint, rule_name/enable_push/enable_merge_whitelist/merge_whitelist_usernames are all real Gitea API fields, and $GITEA_URL/$GITEA_TOKEN match the env vars defined elsewhere in the repo (.env.example, agent/src/gitea.js). The token scopes listed for the bot account (repository, issue, package) line up with what the automation actually needs (PR/branch ops, issue-comment-based PR reviews, and the REGISTRY_TOKEN docker push in .gitea/workflows/build.yml).

Minor nits (not blocking):

Step 14 references "claude-bot (see below)" before step 15 actually introduces it — reads fine but the two steps would flow slightly better swapped (create the bot account, then lock branch protection to exclude it).
The step 14 curl example omits -s unlike the step 9 curl example — trivial style inconsistency.

Nothing else stands out; it's a small, self-consistent documentation addition.

Reviewed the diff (README.md, +26 lines, docs-only — matches the description). **Correctness:** No bugs. The Gitea branch-protection API call is accurate — `branch_protections` endpoint, `rule_name`/`enable_push`/`enable_merge_whitelist`/`merge_whitelist_usernames` are all real Gitea API fields, and `$GITEA_URL`/`$GITEA_TOKEN` match the env vars defined elsewhere in the repo (`.env.example`, `agent/src/gitea.js`). The token scopes listed for the bot account (`repository`, `issue`, `package`) line up with what the automation actually needs (PR/branch ops, issue-comment-based PR reviews, and the `REGISTRY_TOKEN` docker push in `.gitea/workflows/build.yml`). **Minor nits (not blocking):** - Step 14 references "`claude-bot` (see below)" before step 15 actually introduces it — reads fine but the two steps would flow slightly better swapped (create the bot account, then lock branch protection to exclude it). - The step 14 curl example omits `-s` unlike the step 9 curl example — trivial style inconsistency. Nothing else stands out; it's a small, self-consistent documentation addition.

claude-bot commented

2026-08-23 14:59:43 +00:00

token scope test

william added 1 commit 2026-08-23 15:09:15 +00:00

Merge branch 'main' into docs/branch-protection-notes b0b1055f9d

william closed this pull request

2026-08-23 15:09:26 +00:00