feat: ✨ branch protection management — CRUD tools + forgejo:// resources (uc6) #196
No reviewers
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/OpenSpec
Kind/Security
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
RFC - Request For Comments
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Status/Abandoned
Status/Blocked
Status/Need More Info
hermes-attempted
hermes-needs-clarification
hermes-ready
hermes-review
hermes-wip
human-required
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
agentic-forges/forgejo-mcp!196
Loading…
Reference in a new issue
No description provided.
Delete branch "refs/pull/196/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
Implements the
branch-protectionOpenSpec change merged in #195 —forgejo-mcp-uc6. Newoperation/branchprotection/package.Tools (5) over
/repos/{owner}/{repo}/branch_protections:list_branch_protectionspage/limit, response echoes them for resumabilityget_branch_protectionrulenamecreate_branch_protectionbranch_name;status_check_contextscomma-separatededit_branch_protectiondelete_branch_protectionrulenameResources (2):
forgejo://repo/{owner}/{repo}/branch_protections— bounded atEmbeddedListCap, truncation sentinel nameslist_branch_protections.forgejo://repo/{owner}/{repo}/branch_protection/{rule}—{rule}may contain slashes (glob rules likerelease/*).Why
forgejo-mcp-f6h: a repo with no protection let Renovate automerge before CI was green. This gives MCP the surface to see and enforce protection.Output-bounding checklist (
docs/design/output-bounding.md)page+limit(the "list of entities" row).page/limit; collection resource emits the truncation sentinel +list_tool.Notable decision (SDK reality)
EditBranchProtectionOptionpointer fields have noomitempty, so unpassed fields marshal as explicitnull— which Forgejo reads as leave-unchanged. The handler usespkg/ptr.Toso an omittedenable_status_checkis sent asnull, neverfalse(which would silently relax protection). I refined that one spec scenario in the change to state this precisely; a test asserts the null-not-false behavior.Tests (all green)
go test ./...passes. New coverage: list (page echo), get (ok + 404→error), create (status_check_contextsround-trip; missingbranch_name→ no Forgejo call), edit (only-passed-fields null-safety; contexts round-trip), delete; URI parsers (incl. slash globs + invalid→-32602); collection truncation sentinel; 404→-32003.Quality gates
make build✅ ·go vet ./...✅ ·gofmtclean ✅ ·go test ./...✅ ·openspec validate branch-protection-management --strict✅After merge
Archive the change (syncs
openspec/specs/branch-protection/).Closes forgejo-mcp-uc6. Implements #195. Discovered from forgejo-mcp-f6h.
op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-zn94k is running.
Starting Pipelinerun forgejo-mcp-openspec-validate-pr-zn94k in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-zn94k -fop1st Pipelines as Code/forgejo-mcp-on-pull-request-wl5x8 is running.
Starting Pipelinerun forgejo-mcp-on-pull-request-wl5x8 in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-wl5x8 -fop1st Pipelines as Code/forgejo-mcp-code-scans-5jxbb is running.
Starting Pipelinerun forgejo-mcp-code-scans-5jxbb in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-5jxbb -fop1st Pipelines as Code/forgejo-mcp-code-scans-5jxbb has successfully validated your commit.
Task Statuses:
fetch-source
gitleaks-version
gitleaks
op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-zn94k has successfully validated your commit.
Task Statuses:
fetch-source
validate
op1st Pipelines as Code/forgejo-mcp-on-pull-request-wl5x8 has successfully validated your commit.
Task Statuses:
fetch-source
build-and-test
commit-title-check
op1st Pipelines as Code/forgejo-mcp-code-scans-b6w82 is running.
Starting Pipelinerun forgejo-mcp-code-scans-b6w82 in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-b6w82 -fop1st Pipelines as Code/forgejo-mcp-on-pull-request-jbdw7 is running.
Starting Pipelinerun forgejo-mcp-on-pull-request-jbdw7 in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-jbdw7 -fop1st Pipelines as Code/forgejo-mcp-openspec-validate-pr- has failed.
There was an error creating the PipelineRun: forgejo-mcp-openspec-validate-pr-
cannot use the API on the provider platform to create a in_progress status:
op1st Pipelines as Code/forgejo-mcp-code-scans-b6w82 has successfully validated your commit.
Task Statuses:
fetch-source
gitleaks-version
gitleaks
/test forgejo-mcp-openspec-validate-pr
The red status is a PaC infrastructure error (
cannot use the API on the provider platform to create a in_progress status) raised at PipelineRun creation — not a validation failure. The real run (-zn94k) reported "successfully validated";code-scansandon-pull-requestare green. Reproduced locally:openspec validate --all --strict→ 17/17,check-demos→ 0 errors. Re-running to clear the stale status.op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-c5575 is running.
Starting Pipelinerun forgejo-mcp-openspec-validate-pr-c5575 in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-c5575 -fop1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-c5575 has successfully validated your commit.
Task Statuses:
fetch-source
validate
op1st Pipelines as Code/forgejo-mcp-on-pull-request-jbdw7 has successfully validated your commit.
Task Statuses:
fetch-source
build-and-test
commit-title-check