M1 Checkpoint: Manual steps needed after PR #1 merges

[alex-bezek]

Context

PR #1 is up: #1

It adds the CI pipeline, agent instructions, install diagnostics, and Copilot review calibration. Before the workflow is fully live, there are manual GitHub settings to configure and a second PR to create.

Full spec: plans/002-pr-workflow-and-ci.md and plans/002-manual-steps.md

---

Step 1: Review and merge PR #1

• Check that the CI lint job passes on PR #1
• Check Copilot review comments (if any) — note noise level for future calibration
• Merge PR ci: add PR workflow with lint CI, agent instructions, and install diagnostics #1 (squash merge)

Step 2: Configure GitHub repository settings

All of these are in the GitHub web UI at https://github.com/alex-bezek/dotfiles/settings.

Pull Request settings (Settings → General → Pull Requests)

• Enable squash merging only (disable merge commits and rebase merging)
• Enable auto-merge
• Enable automatically delete head branches

Branch protection (Settings → Branches → Add rule)

• Branch name pattern: master
• Enable Require a pull request before merging — but leave "Require approvals" OFF (solo dev, no one to approve)
• Enable Require status checks to pass before merging
  • Check Require branches to be up to date before merging
  • Add required check: lint
• Enable Do not allow bypassing the above settings — leave OFF for now (turn ON after 10 successful PRs or after enabling auto-merge, whichever comes first)
• Leave Allow force pushes unchecked (force pushes blocked)
• Leave Allow deletions unchecked (branch deletion blocked)

Copilot auto-review (Settings → Rules → Rulesets → New branch ruleset)

• Name: Copilot Auto Review
• Enforcement: Active
• Target: All branches
• Enable: Automatically request Copilot code review

Actions permissions (Settings → Actions → General)

• Allow all actions and reusable workflows
• Workflow permissions: Read and write
• Allow GitHub Actions to create and approve pull requests

Step 3: Sync local repo

After Step 2 settings are configured:

git checkout master && git pull origin master

Step 4: Create PR #2 (pre-push hook)

Create a new branch and add the pre-push hook that blocks direct pushes to master:

git checkout -b ci/pre-push-hook

Create the file git/hooks/pre-push with this content:

#!/usr/bin/env bash
set -euo pipefail

# Block direct pushes to master/main — use PRs instead.
# Applied globally via core.hooksPath.
# Bypass for emergencies: git push --no-verify

while IFS=' ' read -r _local_ref _local_sha remote_ref _remote_sha; do
  remote_branch="${remote_ref#refs/heads/}"

  if [[ "$remote_branch" == "master" || "$remote_branch" == "main" ]]; then
    echo ""
    echo "🚫 Direct push to '$remote_branch' is blocked."
    echo ""
    echo "   Create a PR instead:  gh pr create"
    echo "   Emergency bypass:     git push --no-verify"
    echo ""
    exit 1
  fi
done

exit 0

Then commit and push:

chmod +x git/hooks/pre-push
git add git/hooks/pre-push
git commit -m "ci: add pre-push hook to block direct pushes to master"
git push -u origin ci/pre-push-hook
gh pr create --title "ci: add pre-push hook to block direct pushes to master" \
  --body "Adds pre-push hook blocking direct pushes to master/main. Second and final PR for M1. Validates the full CI + Copilot review loop."

Or ask an AI agent to create this PR — give it the agent prompt and tell it to start at Phase 6.

Step 5: Merge PR #2 and verify the full loop

After PR #2's CI passes and Copilot reviews it:

• Merge PR M1 Checkpoint: Manual steps needed after PR #1 merges #2
• Pull locally: git checkout master && git pull origin master
• Verify: git push origin master should be rejected by the pre-push hook
• Verify: creating any new PR triggers CI and Copilot review automatically

M1 is complete after this step. The PR workflow is live.

---

Reference

• Vision doc — why we're doing this, milestone roadmap
• Full implementation spec — every file, every design decision
• Manual steps doc — expanded version of this issue
• Agent prompt — copy-paste prompt for AI agents to continue the work