fix(branch_sweep): protect legacy trunks by name, not by containment - #281
Merged
Conversation
The first org-wide audit found a repo carrying a `master` branch alongside `main`. It landed in KEEP, but only because it happened to hold unique content — the sweep protected the *default* branch and nothing else, so a `master` fully folded into `main` after a rename is indistinguishable from spent work and would have been deleted. That is not an ordinary branch. Deleting it breaks every stale clone, bookmark, CI reference and doc link still pointing at the old trunk, and nothing about the branch's content says so — which is exactly why the skill's own recipe has always excluded both names (`grep -vE '^(main|master)$'`). Protecting only the default silently implemented half of a rule that was written whole. So `main` and `master` are now protected on NAME, whether or not either is this repo's default, alongside whatever the default actually is. Found by running the audit across 25 repos before deleting anything in any of them — the value of audit-first is that it surfaces this class of thing while it is still hypothetical. The test fails without the guard and passes with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KwqicJpMqmcT5RVbyNwdKq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by the first org-wide audit
Auditing all 25 repos before deleting anything in any of them turned up a repo carrying a
masterbranch alongsidemain.It landed in KEEP — but only because it happens to hold unique content. The sweep protected the default branch and nothing else, so a
masterfully folded intomainafter a rename is indistinguishable from spent work and would have been deleted.Why that is not an ordinary branch
Deleting a legacy trunk breaks every stale clone, bookmark, CI reference and doc link still pointing at it — and nothing about the branch's content says so. Containment is the wrong test; the name is the whole signal.
The skill's own recipe has always excluded both names:
Protecting only the default silently implemented half of a rule that was written whole.
The fix
mainandmasterare protected by name, whether or not either is this repo's default, alongside whatever the default actually is.Checks
pytest tests/→ 508 passed ·check_skill_line_counts.sh→ OK ·repos_sync.py --check→ all 12 green, tenant firewall included.The new test was verified the usual way: it fails without the guard and passes with it.
The wider point
This is the case for audit-first. The gap was real, it was in the delete path, and it surfaced while it was still hypothetical rather than after 484 deletions. Nothing has been swept in any of these repos yet.
🤖 Generated with Claude Code
https://claude.ai/code/session_01KwqicJpMqmcT5RVbyNwdKq
Generated by Claude Code