feat: ✨ add whitelist params to edit_branch_protection

goern commented

2026-06-02 15:40:57 +00:00

(Migrated from codeberg.org)

Adds push/merge/approvals whitelist params to edit_branch_protection so an admin can allow a specific user (e.g. a release bot like op1st-gitops) to push to an otherwise locked branch.

Params added

enable_push_whitelist / push_whitelist_usernames
enable_merge_whitelist / merge_whitelist_usernames
enable_approvals_whitelist / approvals_whitelist_usernames

Username lists are comma-separated and replace the existing list. Each user must already be a write collaborator — the whitelist filters which writers may push, it does not grant access.

PATCH null-safety

Unpassed whitelist lists serialize as null (leave-unchanged), never [] (which would silently wipe an existing whitelist). Asserted by TestEditBranchProtectionFn_PushWhitelistRoundTrip.

Docs

Updated the co-located branch-protection showboat demo (openspec/specs/branch-protection/branch-protection.demo.md).
Linked it from demos/README.md (new "Branch protection (governance)" section).

Motivation: live config change earlier whitelisted op1st-gitops on goern/forgejo-mcp main via the raw Forgejo API because the MCP tool lacked these params. This closes that gap.

Adds push/merge/approvals whitelist params to `edit_branch_protection` so an admin can allow a specific user (e.g. a release bot like `op1st-gitops`) to push to an otherwise locked branch. ## Params added - `enable_push_whitelist` / `push_whitelist_usernames` - `enable_merge_whitelist` / `merge_whitelist_usernames` - `enable_approvals_whitelist` / `approvals_whitelist_usernames` Username lists are comma-separated and **replace** the existing list. Each user must already be a write collaborator — the whitelist filters *which writers* may push, it does not grant access. ## PATCH null-safety Unpassed whitelist lists serialize as `null` (leave-unchanged), never `[]` (which would silently wipe an existing whitelist). Asserted by `TestEditBranchProtectionFn_PushWhitelistRoundTrip`. ## Docs - Updated the co-located branch-protection showboat demo (`openspec/specs/branch-protection/branch-protection.demo.md`). - Linked it from `demos/README.md` (new "Branch protection (governance)" section). Motivation: live config change earlier whitelisted `op1st-gitops` on `goern/forgejo-mcp` main via the raw Forgejo API because the MCP tool lacked these params. This closes that gap.

op1st-gitops commented

2026-06-02 15:41:15 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-code-scans-28mhv is running.

Starting Pipelinerun forgejo-mcp-code-scans-28mhv in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-28mhv -f

op1st Pipelines as Code/forgejo-mcp-code-scans-28mhv is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-28mhv](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-28mhv)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-28mhv) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-28mhv -f</code>

op1st-gitops commented

2026-06-02 15:41:15 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-tmnth is running.

Starting Pipelinerun forgejo-mcp-openspec-validate-pr-tmnth in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-tmnth -f

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-tmnth is running. Starting Pipelinerun <b>[forgejo-mcp-openspec-validate-pr-tmnth](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-tmnth)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-tmnth) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-tmnth -f</code>

op1st-gitops commented

2026-06-02 15:41:15 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lhcsg is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-lhcsg in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-lhcsg -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lhcsg is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-lhcsg](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lhcsg)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lhcsg) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-lhcsg -f</code>

op1st-gitops commented

2026-06-02 15:41:41 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-code-scans-28mhv has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: forgejo-mcp-code-scans-28mhv

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	10 seconds	gitleaks-version
Succeeded	9 seconds	gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-28mhv has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-28mhv">forgejo-mcp-code-scans-28mhv</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-28mhv/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-28mhv/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-28mhv/logs/gitleaks) </td></tr> </table>

op1st-gitops commented

2026-06-02 15:41:45 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-tmnth has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: forgejo-mcp-openspec-validate-pr-tmnth

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	14 seconds	validate

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-tmnth has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-tmnth">forgejo-mcp-openspec-validate-pr-tmnth</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-tmnth/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-tmnth/logs/validate) </td></tr> </table>

op1st-gitops commented

2026-06-02 15:43:10 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lhcsg has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: forgejo-mcp-on-pull-request-lhcsg

Task Statuses:

Status	Duration	Name
Succeeded	14 seconds	fetch-source
Succeeded	21 seconds	commit-title-check
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lhcsg has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lhcsg">forgejo-mcp-on-pull-request-lhcsg</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lhcsg/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>21 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lhcsg/logs/commit-title-check) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lhcsg/logs/build-and-test) </td></tr> </table>

Rows
Columns

feat: ✨ add whitelist params to edit_branch_protection #200

Params added

PATCH null-safety

Docs

Task Statuses:

Task Statuses:

Task Statuses: