# Merge enforcement (finding 1 — external dependency)

A workflow file in `.github/workflows/` **defines** jobs; it does **not** enforce
that they pass before merge. Enforcement is a server-side GitHub setting
(branch protection / repository ruleset) that marks the jobs as **required
status checks** on `main` and the merge queue. That setting lives in the GitHub
repository configuration, not in this repository's tree, and applying it
requires repository-admin privileges and an authenticated `gh`/API token.

This is therefore BLOCKED on external infrastructure. To close the gap, a repo
admin applies the ruleset in `main-required-checks.json`:

```bash
# Requires: gh auth login as a repo admin
gh api -X POST repos/<owner>/<repo>/rulesets \
  --input .github/rulesets/main-required-checks.json

# Verify the required checks are active:
gh api repos/<owner>/<repo>/rulesets --jq '.[].name'
gh api repos/<owner>/<repo>/branches/main/protection 2>/dev/null \
  || echo "no classic protection (rulesets in use)"
```

Until that ruleset is active, the `merge-gates` and `web-rust-gates` jobs are
*advisory CI*, not merge enforcement. Do not treat their presence in the tree as
satisfying the merge-blocking requirement.