Summary
Both branch-protection documentation pages describe a configuration that no longer matches the repository. main is now governed by the repository ruleset main-branch-protection (id 9453100, source_type: Repository, enforcement: active), while classic branch protection is inert (protected: true, protection.enabled: false).
The most consequential mismatch: both pages state that stale-review dismissal is enforced. It is not. That control was accepted as a known gap in #2461, and the triage comment there is now publicly inconsistent with these pages.
Affected files:
Live configuration (verified 2026-08-23)
gh api repos/microsoft/hve-core/rules/branches/main
gh api repos/microsoft/hve-core/rulesets
gh api repos/microsoft/hve-core/branches/main --jq '{protected, protection}'pull_request rule parameters:
| Parameter |
Value |
required_approving_review_count |
2 |
dismiss_stale_reviews_on_push |
false |
require_code_owner_review |
true |
require_last_push_approval |
true |
required_review_thread_resolution |
true |
require_extra_approval_for_unattributed_changes |
true |
dismissal_restriction |
disabled |
allowed_merge_methods |
["squash"] |
Other active rules: deletion, non_fast_forward, code_quality (severity: errors), required_status_checks (strict_required_status_checks_policy: true).
Required status check contexts:
Spell Check / Spell CheckFrontmatter Validation / Validate Markdown FrontmatterMarkdown Lint / Markdown LintPowerShell Lint / PowerShell LintTable Format Check / Table Format CheckCodeQL Security Analysis / CodeQL Analysis (actions)
Drift inventory
docs/security/branch-protection.md
| Current text |
Problem |
| Required Controls lists "Dismiss stale approvals when new commits are pushed" |
Not enforced (false). Accepted as a gap in #2461 |
| No mention of the compensating control |
require_last_push_approval is the basis for accepting that gap and should be stated |
docs/contributing/branch-protection.md
| Current text |
Live value |
| Required reviewers: 1 |
2 |
| Dismiss stale reviews: Enabled |
false |
Required checks include Validate Dependency Pinning, npm Security Audit |
Not in the required set |
| "expected OpenSSF Scorecard Branch Protection score is ~8/10" |
Actual score is 9 |
| "Achieving 10/10 requires 2 reviewers" |
2 reviewers are already configured; this is not the remaining gap |
"Navigate to: Settings → Branches → Branch protection rules → Edit main" |
Settings → Rules → Rulesets → main-branch-protection |
| Future Considerations: "Consider migrating to Rulesets" |
Migration already happened |
| Not documented |
required_review_thread_resolution, require_extra_approval_for_unattributed_changes, squash-only merges, non_fast_forward, deletion protection, code_quality rule |
Acceptance criteria
Notes
Verification-only; no runtime behavior changes. If the ruleset is later changed to enable dismiss_stale_reviews_on_push, both pages and #2461 need a follow-up update.
Summary
Both branch-protection documentation pages describe a configuration that no longer matches the repository.
mainis now governed by the repository rulesetmain-branch-protection(id9453100,source_type: Repository,enforcement: active), while classic branch protection is inert (protected: true,protection.enabled: false).The most consequential mismatch: both pages state that stale-review dismissal is enforced. It is not. That control was accepted as a known gap in #2461, and the triage comment there is now publicly inconsistent with these pages.
Affected files:
Live configuration (verified 2026-08-23)
gh api repos/microsoft/hve-core/rules/branches/main gh api repos/microsoft/hve-core/rulesets gh api repos/microsoft/hve-core/branches/main --jq '{protected, protection}'pull_requestrule parameters:required_approving_review_countdismiss_stale_reviews_on_pushrequire_code_owner_reviewrequire_last_push_approvalrequired_review_thread_resolutionrequire_extra_approval_for_unattributed_changesdismissal_restrictionallowed_merge_methods["squash"]Other active rules:
deletion,non_fast_forward,code_quality(severity:errors),required_status_checks(strict_required_status_checks_policy: true).Required status check contexts:
Spell Check / Spell CheckFrontmatter Validation / Validate Markdown FrontmatterMarkdown Lint / Markdown LintPowerShell Lint / PowerShell LintTable Format Check / Table Format CheckCodeQL Security Analysis / CodeQL Analysis (actions)Drift inventory
docs/security/branch-protection.md
false). Accepted as a gap in #2461require_last_push_approvalis the basis for accepting that gap and should be stateddocs/contributing/branch-protection.md
Validate Dependency Pinning,npm Security Auditmain"main-branch-protectionrequired_review_thread_resolution,require_extra_approval_for_unattributed_changes, squash-only merges,non_fast_forward, deletion protection,code_qualityruleAcceptance criteria
require_last_push_approvalnamed as the compensating control and [Security][high] Branch-Protection #2461 linkedms.datefrontmatter is refreshed on both pages per repository conventionNotes
Verification-only; no runtime behavior changes. If the ruleset is later changed to enable
dismiss_stale_reviews_on_push, both pages and #2461 need a follow-up update.