The main ruleset requires bonk (app 15368), but a skipped job satisfies a required status check. The bonk job's if: excludes fork PRs (head.repo.id == base.repo.id) and bot senders, so on those PRs bonk reports skipped and the requirement is met with no review having happened.
Evidence: fork PR #221 merged with bonk: SKIPPED, after the ruleset was created on 2026-08-05. Dependabot #217 and #218 likewise.
What makes this more than cosmetic: the ruleset sets required_approving_review_count: 0 and leans on require_code_owner_review: true, but there is no CODEOWNERS file in the repo (checked .github/, root, docs/) — so that requirement is vacuous. Net effect: a PR opened from a fork can merge with neither a Bonk review nor a human approval.
Excluding forks from Bonk is deliberate (it must not run untrusted code with secrets), so the fix probably isn't to review them — it's to stop skipped from counting as a pass. Options: a small always-running gate job that is the required context and asserts the real outcome, or add CODEOWNERS so human review is actually enforced.
Pre-existing; noting it while working on the break-glass path in #244.
The
mainruleset requiresbonk(app 15368), but a skipped job satisfies a required status check. Thebonkjob'sif:excludes fork PRs (head.repo.id == base.repo.id) and bot senders, so on those PRsbonkreportsskippedand the requirement is met with no review having happened.Evidence: fork PR #221 merged with
bonk: SKIPPED, after the ruleset was created on 2026-08-05. Dependabot #217 and #218 likewise.What makes this more than cosmetic: the ruleset sets
required_approving_review_count: 0and leans onrequire_code_owner_review: true, but there is no CODEOWNERS file in the repo (checked.github/, root,docs/) — so that requirement is vacuous. Net effect: a PR opened from a fork can merge with neither a Bonk review nor a human approval.Excluding forks from Bonk is deliberate (it must not run untrusted code with secrets), so the fix probably isn't to review them — it's to stop
skippedfrom counting as a pass. Options: a small always-running gate job that is the required context and asserts the real outcome, or add CODEOWNERS so human review is actually enforced.Pre-existing; noting it while working on the break-glass path in #244.