main branch protection has required_status_checks: [] (no CI enforced) while requiring 1 review with enforce_admins: true. For a solo-maintainer repo with no second approver, this means every merge must use --admin (which bypasses the review), and a red audit/test can't block a merge — exactly how the wasmtime CVE sat red unnoticed. Recommend requiring test (*), lint, spec-check, audit as status checks (and/or adding a second reviewer/bot). Requires repo-admin action.
Filed from a skeptical staff-level review (Medium-severity tier). All Critical/High findings and the correctness/doc Medium findings were fixed in #432–442.
main branch protection has
required_status_checks: [](no CI enforced) while requiring 1 review withenforce_admins: true. For a solo-maintainer repo with no second approver, this means every merge must use--admin(which bypasses the review), and a redaudit/testcan't block a merge — exactly how the wasmtime CVE sat red unnoticed. Recommend requiringtest (*),lint,spec-check,auditas status checks (and/or adding a second reviewer/bot). Requires repo-admin action.Filed from a skeptical staff-level review (Medium-severity tier). All Critical/High findings and the correctness/doc Medium findings were fixed in #432–442.