feat: add Phase 7 — Branch Protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase7_post_check.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# phase7_post_check.sh — Verify Phase 7 (Branch Protection) succeeded
+# Checks for each repo:
+#   1. Branch protection rule exists for PROTECTED_BRANCH
+#   2. Push is blocked (enable_push is false)
+# Exits 0 only if ALL checks pass.
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "${SCRIPT_DIR}/lib/common.sh"
+
+load_env
+require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
+             REPO_1_NAME REPO_2_NAME REPO_3_NAME PROTECTED_BRANCH
+
+log_info "=== Phase 7 Post-Check ==="
+
+REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
+PASS=0
+FAIL=0
+
+run_check() {
+  local description="$1"; shift
+  if "$@" 2>/dev/null; then
+    log_success "$description"
+    PASS=$((PASS + 1))
+  else
+    log_error "FAIL: $description"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+for repo in "${REPOS[@]}"; do
+  log_info "--- Checking repo: ${repo} ---"
+
+  # Check 1: Protection rule exists
+  run_check "Branch protection exists for '${PROTECTED_BRANCH}' on ${repo}" \
+    gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" -o /dev/null
+
+  # Check 2: Push is blocked (enable_push should be false)
+  check_push_blocked() {
+    local protection
+    protection=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}")
+    local enable_push
+    enable_push=$(printf '%s' "$protection" | jq -r '.enable_push')
+    [[ "$enable_push" == "false" ]]
+  }
+  run_check "Direct push blocked on '${PROTECTED_BRANCH}' for ${repo}" check_push_blocked
+done
+
+# Summary
+printf '\n'
+log_info "Results: ${PASS} passed, ${FAIL} failed"
+
+if [[ $FAIL -gt 0 ]]; then
+  log_error "Phase 7 post-check FAILED"
+  exit 1
+else
+  log_success "Phase 7 post-check PASSED — branch protection active"
+  exit 0
+fi