From 247bc5cba5ff865d120c8931904a32cf28725142 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sun, 16 Aug 2026 21:29:40 +1000
Subject: [PATCH] Protect main on the arr forks + require the Woodpecker build

Now that each fork's Woodpecker image build is green, lock down main:
Owners-only merge, PRs must pass the build check, and the owner may push
main directly for upstream-fix maintenance merges.

- add branch_protection(main) to sonarr/radarr/prowlarr.yaml
- required check: ci/woodpecker/pr/docker; merge whitelist: Owners; push whitelist: unkinben
---
 config/git.unkin.net/unkin/repository/prowlarr.yaml | 11 +++++++++++
 config/git.unkin.net/unkin/repository/radarr.yaml   | 11 +++++++++++
 config/git.unkin.net/unkin/repository/sonarr.yaml   | 11 +++++++++++
 3 files changed, 33 insertions(+)

diff --git a/config/git.unkin.net/unkin/repository/prowlarr.yaml b/config/git.unkin.net/unkin/repository/prowlarr.yaml
index 122ca33..3f54f94 100644
--- a/config/git.unkin.net/unkin/repository/prowlarr.yaml
+++ b/config/git.unkin.net/unkin/repository/prowlarr.yaml
@@ -3,3 +3,14 @@ private: true
 default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Owner can push main directly for fork maintenance (upstream-fix merges);
+    # everyone else opens a PR that must pass the Woodpecker image build.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/docker"
diff --git a/config/git.unkin.net/unkin/repository/radarr.yaml b/config/git.unkin.net/unkin/repository/radarr.yaml
index aa50edd..baa1c2b 100644
--- a/config/git.unkin.net/unkin/repository/radarr.yaml
+++ b/config/git.unkin.net/unkin/repository/radarr.yaml
@@ -3,3 +3,14 @@ private: true
 default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Owner can push main directly for fork maintenance (upstream-fix merges);
+    # everyone else opens a PR that must pass the Woodpecker image build.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/docker"
diff --git a/config/git.unkin.net/unkin/repository/sonarr.yaml b/config/git.unkin.net/unkin/repository/sonarr.yaml
index 691d276..8a19e0a 100644
--- a/config/git.unkin.net/unkin/repository/sonarr.yaml
+++ b/config/git.unkin.net/unkin/repository/sonarr.yaml
@@ -3,3 +3,14 @@ private: true
 default_branch: "main"
 default_delete_branch_after_merge: true
 default_merge_style: "squash"
+branch_protection:
+  - rule_name: "main"
+    merge_whitelist_teams:
+      - "Owners"
+    # Owner can push main directly for fork maintenance (upstream-fix merges);
+    # everyone else opens a PR that must pass the Woodpecker image build.
+    enable_push: true
+    push_whitelist_users:
+      - "unkinben"
+    status_check_contexts:
+      - "ci/woodpecker/pr/docker"
-- 
2.47.3