A change is waiting on the client's branch. Tonight, three proofs, in a repository you or the client can open. Name each status check the branch requires, and the conclusion of that check on the latest commit. Show a pull request whose required check failed, or never reported, cannot merge. Then show a different check that the rule does not require, failing or absent, while a pull request whose required checks have passed can still merge. If the rule, the refusal, or the other check requires the person who set up the repository, you have not proved the gate. You have a green mark on a page and a story about what it means.
This is the check the merge is waiting on. It is not the account that merged. Name who merged their change is that account, and the refusal of a push that account was not allowed to make. A person is not a check. It is not the diff. Read their change before it ships is a person looking at the code. A passing check is not that reading. It is not the third-party action a workflow runs, or the ref that action was pinned to. Name the action the workflow runs is that ref. A required context name is not a commit SHA in a uses line. It is not the digest that is actually running. Name the commit they are running is the release. A check on a pull request is not the image in production. It is not the version a lockfile resolved. Name the package the lockfile pinned is that version. A test that imported the package is not the pin.
None of what follows is a finding that a ruleset is the right one for this client, and none of it is legal advice. The counts below are one 2016 study of open-source projects, and the sentences below that are GitHub's current description of a required check. Open-source GitHub in that study is not this client's private repository. A percentage in the study is not the share of this client's pull requests. The docs' sample error is not this repository's log.
The study that counted whether a pull request even had a build is Michael Hilton, Timothy Tunnell, Kai Huang, Darko Marinov, and Danny Dig, ASE 2016. Three corpora, and they do not share a denominator. The breadth corpus is 34,544 GitHub projects. 13,910 use a CI service they could detect, 40.27%. 20,634 do not, 59.73%. 13,910 plus 20,634 is the 34,544 they started with. 40.27 is not 59.73. They say the scripts miss privately hosted CI, so 40.27 is a lower bound on public services they could query, not a census. The depth corpus is a subset: 620 projects, 1,529,291 builds, 1,503,092 commits, 653,404 pull requests. 620 is not 34,544. 1,529,291 is not 653,404. The survey is a third object: 4,508 emails, 442 developers answering. 442 is not 4,508. Do not compute a response rate they did not print and then cite it as theirs (Hilton, Tunnell, Huang, Marinov, and Dig, Usage, Costs, and Benefits of Continuous Integration in Open-Source Projects).
Which service, inside the projects that use one, is a second table. Travis CI is 90.1%, 12,528 projects. CircleCI is 19.1%, 2,657. AppVeyor is 3.5%, 484. CloudBees is 1.6%, 223. Werker is 0.4%, 59. The caption says the percents add past 100 because some projects use more than one service. 90.1 is not 40.27. 12,528 is not 13,910. 19.1 is not 90.1. Of the projects that use CI, 14% use more than one. 14 is not the sum of those service percents, and it is not 90.1. Travis's own report, which the paper quotes, is over 300,000 projects. 300,000 is not 12,528. The State of Agile survey they cite, 50% of 3,880 participants, is not 40.27% of 34,544. 3,880 is not 442. A Google Trends figure they cite, searches up 350% in a decade, is not a share of projects. Flickr deploying more than ten times a day, and a product group at HP cutting development cost by 78%, are other people's claims, cited as motivation. Neither is a cell in their corpus.
Popularity is not the headline rate. They sort the breadth corpus into 64 groups of around 540 projects by stars. In the most popular group, 70% use CI. The share declines to 23% as the projects get less popular. 70 is not 23, and neither is 40.27. A language row is not the corpus either. The table's Ruby cell is 64.61% of 2,721 projects. The implications text says 64% of 2,721. 64 is not 64.61. Objective-C is 20.44% of 2,745 in the table, and 20% of 2,745 in that sentence. 20 is not 20.44. JavaScript is 43.46% of 8,495. 43.46 is not 40.27. Do not cite a language row as the share of all 34,544. The median time from a project's start to its first CI build is around one year, and that figure comes from the depth corpus, because the breadth corpus has no first-build date. One year is not 40.27%.
What the humans said they wanted is not what the builds did. Projects that use CI average .54 releases a month. Projects that do not average .24. The paper says that is more than double, and the difference is significant. .54 is not .24. More than double is their comparison of those two rates. It is not a third number you should invent. Pull requests that had no CI information were 5 percentage points more likely to be merged than pull requests that had it. Their reading is that the missing points are the ones CI talked a maintainer out of. 5 percentage points is not a refuse rate, and it is not a ruleset. It is a gap in what maintainers chose to merge, on open-source projects, in that corpus. Separately, among accepted pull requests, the mean time with CI information is 81 hours and the median is 5.2 hours. Without it, the mean is 140 hours and the median is 6.8. The 1.6 hours they report is the gap between the medians. 6.8 minus 5.2 is that 1.6. 140 minus 81 is not. 81 is not 5.2. 140 is not 6.8. Builds on pull requests to master pass 72.03% of the time. Builds on other branches pass 65.36%. 72.03 is not 65.36. A higher pass rate on master is not a rule that master cannot move.
The survey's reasons for not using CI are a multiple-choice list, so they are not a partition. 47.00% said the developers were not familiar enough. 44.12% said the project had no automated tests. 35.29% said the project did not commit often enough. 26.47% said they would like to use CI later. 20.59% named maintenance cost. 17.65% said setup takes too long. 5.88% said the project already tested enough. 47.00 is not 44.12. Adding them does not produce 100. The paper does not print the integer base of that non-user subgroup next to 47.00, so 47.00 is not a share of the 442, and it is not a share of the 34,544. The average time for a completed build, after they drop cancelled ones, is just under 500 seconds. 500 seconds is not the seven-day window in the current docs, and it is not 1.6 hours.
A green mark on a pull request, in that paper, is information a person used. GitHub's current required check is a refusal. Those are not the same mechanism, and the 2016 study is not a measurement of the refusal. The troubleshooting page says that to be required, a status check must have completed successfully in that repository during the past seven days. After you turn the rule on, every required check has to pass against the latest commit SHA. A success on an older SHA is not the check. The statuses that page counts as successful are success, skipped, and neutral. The protected-branch page, quoted below, requires a status of successful, skipped, or neutral. success is not successful. They are two strings on two pages, and a log that prints one does not satisfy a sentence about the other. If a test-merge commit has a status, that status is the one that has to pass. Otherwise the head commit's status has to pass. When those two disagree, the pull request says it is showing checks for the merge commit. The sample push error on that page is a protected-branch update failed for the main ref, then a required status check named ci-build is failing. They label that sample GH006. The GH006 already quoted on name who merged their change is a different sample, on a different page, about changes requested in review. Do not quote one as the other. Quoting either, without the refusal from this repository, is a citation. It is not the proof (GitHub, Troubleshooting required status checks).
Skipped is a word the docs use for more than one outcome. The status-checks page says a job that is skipped will report its status as Success, and will not prevent a merge, even when the check is required. The conclusions table, separately, lists a conclusion named skipped, and says that conclusion is treated as a success for dependent checks in GitHub Actions. Neutral has the same sentence: treated as a success for dependent checks. A skipped job reporting Success is not a conclusion whose text is skipped. Both can let the merge through. Neither is a test that ran. The troubleshooting page then splits skip into three causes, and they do not share a result. A workflow skipped by a path filter, a branch filter, or a commit message leaves the associated checks Pending, and Pending blocks the merge. The page's advice is to avoid requiring a workflow that can be skipped. A job skipped by a conditional reports Success. A job skipped because a job it needs has failed may not block. Pending is not Success. A workflow that did not run is not a job that ran and was skipped. A pass on a workflow_dispatch run does not fill the pull request's checks, and it does not satisfy a required check in a ruleset. The events that page lists for a workflow job's check to count are push, pull_request, pull_request_review, pull_request_target, deployment, and deployment_status. A merge queue wants merge_group, which that page says is separate. Six events are not one, and merge_group is not pull_request. Failure, timed out, and action required usually mean someone has to look before the pull request can merge. Usually is the status-checks page's word. It is not always. Cancelled and stale are their own conclusions. Do not file them under success because a conditional skip got there (GitHub, Status checks).
Who is allowed to paint the mark is the rest of the control. Anyone with write permission can set the state of any status check in the repository. On a protected branch you can name a GitHub App that has recently set that check as the only source you will accept. If the status arrives from anyone else, the merge is not allowed. If you leave the source as any, the merge box still shows who set it, and write permission is enough to set it. A required check that accepts any source is a check an author can satisfy. The strict form, which that page calls the default, also requires the branch to be up to date with the base before the merge. The loose form does not, and the page says the checks may then fail after the merge if the two sides do not combine. Disabled means the branch has no restriction from status checks at all. Strict is not loose. Default is not a switch you remember turning on. Required checks on that page must have a successful, skipped, or neutral status. successful is not the success string on the troubleshooting page. After the required checks pass, the same page says commits are pushed to another branch and then merged, or pushed directly. That is not the troubleshooting page's other sentence, that an up-to-date pull request which already passes can be merged locally and pushed without the checks running again on the merge commit. A push that skipped the merge commit is still a merge. Write down which of those two sentences this repository is using (GitHub, About protected branches).
Checks and commit statuses are both things a rule can require, and they are not the same object. Checks carry logs, annotations, and a conclusion. Commit statuses are the simpler mark an external service sets. GitHub Actions writes checks, not commit statuses. If a check and a status share a name and you require that name, the troubleshooting page says both are required. Requiring the name once is not requiring one of them. The Checks tab is populated only when the repository has checks. A commit status alone does not fill it. An empty Checks tab is not a passing suite.
Do the three proofs on one real pull request, in the repository the client can open. First, the rule. Read the required contexts. For each one, write the conclusion on the latest SHA, and write the source if the rule named an app. A badge in a README is not the rule. Second, the refusal. Open a pull request whose required check failed, or has not reported inside the window the docs describe, and show the merge is refused. If an admin bypass is on, write that, and do not tell the client the check held. The account that would have been allowed to bypass is name who merged their change. Third, the other check. A check the rule does not name can fail while the pull request still merges, once the required ones have passed. If the only way the proof succeeds is to turn the rule off, you have not shown a gate. You have shown a repository with no gate.
Three moves feel like the proof and are a second problem. Pointing at a green badge from a build that ran on an older SHA. The latest commit is the one the rule reads. Calling a skipped job a passed test. The docs already say a skip reports success and does not block. Treating 40.27% as the share of this client's merges that had a required check. That figure is a lower bound on detectable public CI in a 2016 corpus. This client's rule is a setting you can open. A workflow file that names an action is still name the action the workflow runs. The action can be pinned and the required check can still be absent. A digest in production is still name the commit they are running. The check and the deploy are two events.
The path is ordinary when the client, or you, can open the ruleset without the person who wrote the workflow narrating it. Haystack is one search layer across documents, data lakes, and repositories. The shape that matters here is a repository the engagement can open. That case is not a check ledger. Nothing in the description is a headcount, a duration, or a result figure. If the only way to see the rule is a slide, you do not have this proof.
There is a version of this merge where hiring the path is the wrong purchase. The work is not sold, so there is no repository yet. The client asked to meet the people who will build, and the document in front of you is a term sheet. The criteria for that choice sit on the page written for a top saas development company. That page is criteria. It does not rank anyone, including us. The room only has a slide, or the buyer only wants a template of a ruleset. A template is not the conclusion on this SHA. Or the buyer wants a legal opinion about whether a particular check is the right control. Hire the lawyer.
When the change is real and the rule is not on a screen you can open, the missing object is specific. The required contexts, the conclusion of each on the latest SHA, a failing required check that cannot merge, and a check you did not require that still lets a good pull request through. A white label software development partner that expects this will put the repository where the client can read the rule, before the first merge, because a green mark on a laptop you do not hold is not a check you can name. One that can only paste a screenshot into chat is telling you who holds the gate. Where the next slice is one capability and the acceptance sentence names the required checks, an AI integration sprint is the shape that can require the three proofs as the definition of done. Where you are not sure which repository the current engagement merges into, a two-week AI readiness assessment maps the systems. The findings are yours. They are not a promise that 5 percentage points of this client's pull requests were saved by a badge, and they are not a rate.
A hostname a customer attached, and a reason a model stopped, are different objects: show the name their domain points at and name the stop the response carried. Do not record either on this page. A DNS target is not a status. A stop reason is not a required check.
Before you tell the client the change was allowed to land, do the three proofs and write the contexts. Name each required check and its conclusion on the latest SHA. Show a failing required check refused. Show a check you did not require, and a pull request that still merges. Do not treat a skipped job as a test that ran, and do not borrow 40.27% from a corpus this repository is not in. The badge is how a person felt. The refusal is how you know the rule was on.
Find this useful? Tell Google to show you more of it.