Ruleset enforcing status checks can be bypassed by anyone

[serpro69]

Select Topic Area

Bug

Body

We have a ruleset on the main branch that requires status checks to pass before merge.

Those status checks didn't pass in the PR (they were skipped because an dependency status check failed) and we could merge the PR with the account that is not in the "bypass list"

[collinmcneese]

Hello! Just wanted to drop a note here that in the screenshots, it looks like the check-pr/lint and check-pr/test status checks were being checked and in the subsequent screenshot it looks like those jobs show as a status of skipped .

Skipped jobs count as success when it comes to status checks. There are a number of reasons for this, one of which is so that jobs can be conditional with if: type checks at the job level and skipped jobs then status as success rather than failure.

From the docs:

Note: A job that is skipped will report its status as "Success". It will not prevent a pull request from merging, even if it is a required check.

[serpro69]

Oh, I see. Thank you for the clarification!