feat(github): require PR checks on managed repositories

gh-protections.tf

@@ -1,30 +1,24 @@
-# Branch protection here is intentionally relaxed for a solo-maintainer,
-# personal-dev organization: `contexts` is empty (CI is advisory, not a merge
-# gate) and `required_approving_review_count` is zero. The PR workflow exists
-# for CI validation, plan output, and change history — not review ceremony.
-# If collaborators join or a repo gains external contributors, tighten
-# `contexts` and `required_approving_review_count` at that time.
+# Every active repository requires a pull request with its configured CI checks
+# passing before merge. The check map lives in main.tf because check-run names
+# differ by repository and GitHub treats an unknown required check as pending.
 resource "github_branch_protection" "protections" {
   for_each                        = toset([for repo in local.github_repositories : repo if !contains(local.archived_github_repositories, repo)])
   repository_id                   = github_repository.repositories[each.key].node_id
   pattern                         = "main"
-  enforce_admins                  = false
+  enforce_admins                  = true
   allows_force_pushes             = false
-  force_push_bypassers            = ["${var.github_owner}/${github_team.admins.slug}"]
   required_linear_history         = true
   require_conversation_resolution = true
   required_status_checks {
     strict   = true
-    contexts = []
+    contexts = local.required_status_checks_by_repository[each.key]
   }
+  # This block requires a pull request while retaining the solo-maintainer
+  # workflow: zero approvals, no code-owner gate, and no bypass actors.
   required_pull_request_reviews {
-    dismissal_restrictions          = ["${var.github_owner}/${github_team.admins.slug}"]
-    dismiss_stale_reviews           = true
-    pull_request_bypassers          = ["${var.github_owner}/${github_team.admins.slug}"]
-    require_code_owner_reviews      = true
+    require_code_owner_reviews      = false
     required_approving_review_count = 0
-    require_last_push_approval      = true
-    restrict_dismissals             = true
+    require_last_push_approval      = false
   }
   restrict_pushes {
     push_allowances = [

main.tf

@@ -32,6 +32,24 @@ locals {
     for repo in local.github_repositories : repo
     if !contains(local.archived_github_repositories, repo)
   ])
+  # Status-check names are GitHub check-run names, not workflow filenames.
+  # Keep this exhaustive for active repositories so a newly managed repository
+  # cannot silently receive a branch rule without a required CI check.
+  required_status_checks_by_repository = {
+    ".github"                  = ["pre-commit"]
+    "cflan"                    = ["lint-and-test (3.10)", "lint-and-test (3.11)", "lint-and-test (3.12)", "lint-and-test (3.13)", "type-check"]
+    "images"                   = ["checks"]
+    "kustomize-cluster"        = ["test"]
+    "opencode-server-config"   = ["lint"]
+    "shared-workflows"         = ["lint"]
+    "terraform-libvirt-domain" = ["test"]
+    "tfroot-aws"               = ["opentofu / test", "opentofu / plan"]
+    "tfroot-cloudflare"        = ["opentofu / test", "opentofu / plan"]
+    "tfroot-gcp"               = ["opentofu / test", "opentofu / plan"]
+    "tfroot-github"            = ["opentofu / test", "opentofu / plan"]
+    "tfroot-libvirt"           = ["opentofu / test", "opentofu / plan"]
+    "www"                      = ["static-checks"]
+  }
   secrets = {
     "onion_s3_bucket" = {
       name         = "ONION_AWS_S3_BUCKET"