Concept
Advisory and enforced
Updated
On this page
Zof decides whether a change may merge, and GitHub is what blocks the merge. GitHub does that only on branches where a ruleset or branch protection requires the Zof / Control check from the Zof GitHub App, the app you installed. On GitHub, the Zof GitHub App appears under the name it was registered with, which is Zof AI on Zof's hosted service.
Who decides, and who blocks?
Zof posts its result on every pull request as the Zof / Control check. On its own, a red check is only a message. A rule in GitHub that requires the check turns it into a block: GitHub then keeps the merge button disabled until the check is green.
Zof reads your GitHub rules to see whether that rule is in place. It never creates or changes them, for the reasons in Make Zof block merges.
What does advisory mean?
A branch without that rule is advisory. Zof still decides, but anyone with write access can merge:
- A check that isn't green starts with "Not enforced: developers can merge this PR despite this result".
- A green check ends by saying that merges into the branch aren't blocked by GitHub.
- When someone merges a pull request that Zof hadn't allowed, Zof records it, and your company's admins get a "Merged without Zof's approval" notification.
An advisory branch isn't the same as an optional rule in your release policy. An optional rule's result is reported on the check with an "Optional" tag, but it never stops the release, on any branch. See Required or optional.
How does Zof know a branch is enforced?
Zof checks the branches it gates: each repository's default branch, and the base branch of every open pull request. For each one, it reads GitHub's active rulesets and classic branch protection. The branch is enforced only when one of them requires Zof / Control from the Zof GitHub App. A rule that accepts the check from any source doesn't count, because anyone could post a check with that name.
Zof checks a repository again when one of its rulesets or branch protection rules changes, and checks every gated branch again about every 10 minutes. So a change to an organization ruleset shows within about 10 minutes. A reading older than 24 hours no longer counts, and the branch shows Can't confirm.
| Label in Zof | What it means |
|---|---|
| Enforced | GitHub requires the check from the Zof GitHub App on this branch. |
| Not enforced | No active rule requires it. |
| Needs a paid plan | GitHub won't allow rules on this private repository on its current plan. |
| Can't confirm | Zof couldn't tell. |
Each label, with its causes and fixes, is in Enforcement statuses.
What doesn't Enforced cover?
Enforced means GitHub requires the check. It doesn't mean nobody can merge around it:
- Zof doesn't read a ruleset's bypass list. Anyone on that list can still merge.
- With classic branch protection, admins can merge around the check unless "Do not allow bypassing the above settings" is on. The Configuration tab then says "admins can merge around it" under the branch name.
- A branch that uses a merge queue can't be gated yet. The Configuration tab notes it.
Zof / Review, the check a posted code review adds, is always neutral and never blocks.
Why is "Can't confirm" never treated as enforced?
Zof fails closed. If it can't confirm that GitHub blocks merges, it assumes GitHub doesn't. Pull requests into that branch get the same warning as for Not enforced until a check succeeds.
What this means for you
- To turn a branch from advisory into enforced, see Make Zof block merges.
- To merge around Zof safely when you must, see Bypass Zof in an emergency.
- To read a blocked check, see Find out why a pull request is blocked.