From be686f739f72e77d05763b2f1ac699147613ae04 Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Fri, 18 Sep 2026 22:16:43 +0530
Subject: [PATCH 1/2] ci(gates): add stable consumer and compatibility checks

---
 .github/workflows/compatibility.yml | 11 +++++++++++
 .github/workflows/tests.yml         | 11 +++++++++++
 docs/branch-protection.md           | 22 ++++++++++++++++++++++
 3 files changed, 44 insertions(+)
 create mode 100644 docs/branch-protection.md

diff --git a/.github/workflows/compatibility.yml b/.github/workflows/compatibility.yml
index c7d2940..f6a4fd6 100644
--- a/.github/workflows/compatibility.yml
+++ b/.github/workflows/compatibility.yml
@@ -74,3 +74,14 @@ jobs:
         run: python -m pip install --no-deps dist/*.whl
       - name: Run the non-blocking upcoming compatibility check
         run: python -m pytest -q
+
+  required-compatibility:
+    name: required-compatibility
+    if: ${{ always() }}
+    needs: [supported]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require the supported compatibility matrix
+        env:
+          COMPATIBILITY_RESULT: ${{ needs.supported.result }}
+        run: test "$COMPATIBILITY_RESULT" = success
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a96020f..97a2d89 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -41,3 +41,14 @@ jobs:
         run: python -m pip install ".[dev,typer,rich,telemetry]"
       - name: Run optional integration tests
         run: python -m pytest -q tests/test_optional_scenarios.py
+
+  required-consumer:
+    name: required-consumer
+    if: ${{ always() }}
+    needs: [validate]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require the consumer validation job
+        env:
+          VALIDATION_RESULT: ${{ needs.validate.result }}
+        run: test "$VALIDATION_RESULT" = success
diff --git a/docs/branch-protection.md b/docs/branch-protection.md
new file mode 100644
index 0000000..467d16c
--- /dev/null
+++ b/docs/branch-protection.md
@@ -0,0 +1,22 @@
+# Required Pull Request Checks
+
+The default branch should require these stable GitHub Actions check contexts:
+
+- `Tests / required-consumer`
+- `Compatibility / required-compatibility`
+
+The aggregate jobs always run and fail if their underlying validation job or
+supported-version matrix is skipped, cancelled, or unsuccessful. The optional
+Typer/Rich/OpenTelemetry job remains useful coverage, but is not a merge
+requirement for contributors who have not installed those extras.
+
+Keep pull requests and both required checks mandatory. If the repository has a
+single maintainer, the narrow exception is review approval only: configure no
+required approval count (or allow that maintainer to self-approve), while still
+requiring both checks to pass. Do not use a broad ruleset bypass for a failed or
+pending check.
+
+After this workflow change is merged, select both contexts in the
+`Base default branch protection` ruleset and read the ruleset back to confirm
+they are required. Until that external settings step is complete, this document
+and the workflow alone do not enforce the checks at merge time.

From 1700bd434b76f5d37b8b9b2bd9db5ce944f9175b Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Fri, 18 Sep 2026 22:24:56 +0530
Subject: [PATCH 2/2] docs(ci): name exact required status checks

---
 docs/branch-protection.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/branch-protection.md b/docs/branch-protection.md
index 467d16c..43018c5 100644
--- a/docs/branch-protection.md
+++ b/docs/branch-protection.md
@@ -1,9 +1,9 @@
 # Required Pull Request Checks
 
-The default branch should require these stable GitHub Actions check contexts:
+The default branch should require these stable GitHub Actions check names:
 
-- `Tests / required-consumer`
-- `Compatibility / required-compatibility`
+- `required-consumer`
+- `required-compatibility`
 
 The aggregate jobs always run and fail if their underlying validation job or
 supported-version matrix is skipped, cancelled, or unsuccessful. The optional
@@ -16,7 +16,7 @@ required approval count (or allow that maintainer to self-approve), while still
 requiring both checks to pass. Do not use a broad ruleset bypass for a failed or
 pending check.
 
-After this workflow change is merged, select both contexts in the
+After this workflow change is merged, select both exact job names in the
 `Base default branch protection` ruleset and read the ruleset back to confirm
 they are required. Until that external settings step is complete, this document
 and the workflow alone do not enforce the checks at merge time.