Responds to the independent review of the writer-branch PR.
Adopted (the reviewer's strongest recommendation): a test that PROVES master is
protected, rather than documenting the setting. It attempts a direct push to
master with the deploy key and requires it to be rejected - the same way an
attacker would find out. It currently FAILS, which is the correct result: branch
protection is genuinely not enabled on armistace/blog, and the failure is now
visible in every test run instead of buried in prose.
Cannot fix from here: setting branch protection on armistace/blog returns
403 "user should be an owner or a collaborator with admin write"
for the bot account (it is a collaborator, not the owner). This is an operator
action, documented in docs/writer-branch-workflow.md with the exact Gitea
settings. Until it is done the writer-branch model is advisory, not enforced.
Also fixed three assertions that were stale rather than wrong:
- "installer markers present" now accepts the post-install state (config.php
populated) as valid, since the operator has completed the installer.
- "posts found == 20" is now ">= 20" - the operator has added a file, so an
exact count was always going to fail.
- "branch == master" is now master|atheos-writer - the writer branch is the
intended steady state under the new workflow, so asserting master was
asserting the opposite of the design.
Result: 40 passed, 1 failed - the single failure being the branch-protection gap.
hermes
0b72cf48b1