From c44f90e1ff8b9c102b0d413675fff551beb5d272 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 22 Aug 2026 15:05:31 +1000
Subject: [PATCH] waitfordb: add branch protection on main

Owners-only merge, benvin approval, and the required Woodpecker PR check.
Requires the repo to be activated in Woodpecker so ci/woodpecker/pr/build
reports before a PR can merge.
---
 .../git.unkin.net/unkin/repository/waitfordb.yaml   | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/config/git.unkin.net/unkin/repository/waitfordb.yaml b/config/git.unkin.net/unkin/repository/waitfordb.yaml
index bed69fb..5e366e6 100644
--- a/config/git.unkin.net/unkin/repository/waitfordb.yaml
+++ b/config/git.unkin.net/unkin/repository/waitfordb.yaml
@@ -3,7 +3,12 @@ private: false
 default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
-# branch_protection is intentionally omitted on creation: the required Woodpecker
-# status checks do not exist until the repo is created and its first pipeline
-# runs, so requiring them up front would block the very first PR. Add protection
-# in a follow-up PR (mirroring node-lookup.yaml) once CI is green.
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    enable_push: false
+    status_check_contexts:
+      - "ci/woodpecker/pr/build"
+    approval_whitelist_users:
+      - "benvin"