resolveProtectedBranches coerces a string "" to [""], protecting nothing #219

New issue

Closed

opened 2026-08-18 20:49:28 +00:00 by john · 1 comment

john commented

2026-08-18 20:49:28 +00:00

Owner

Verified live 2026-08-18: resolveProtectedBranches({protected_branches: ""}) returns [""].

A config that looks set unprotects every branch. The empty string is the one value where the string form, which all four readers honor (D-08, phase 3), produces a list whose only member matches no branch. The guard then passes for main.

Decide: warn and fall back to the default list, or refuse the value at validate time. Falling through silently is the one option that should be off the table, since the failure is permissive.

cadence-core/bin/lib/protected-branches.mjs. Pre-existing in git-guard/git-publish; adjudicated pre-existing-to-range at a phase-3 risk_surface fire and carried in the capture queue since.

Verified live 2026-08-18: `resolveProtectedBranches({protected_branches: ""})` returns `[""]`. A config that looks set unprotects every branch. The empty string is the one value where the string form, which all four readers honor (D-08, phase 3), produces a list whose only member matches no branch. The guard then passes for `main`. Decide: warn and fall back to the default list, or refuse the value at validate time. Falling through silently is the one option that should be off the table, since the failure is permissive. `cadence-core/bin/lib/protected-branches.mjs`. Pre-existing in git-guard/git-publish; adjudicated pre-existing-to-range at a phase-3 risk_surface fire and carried in the capture queue since.