ADR on our branch protection settings

[RothAndrew]

Differences between what the settings are right now and what this documents (to discuss when we meet up next)

• Restrict who can dismiss pull request reviews: We don't need to specify the delivery-aws-iac-admin team since they are already given that ability due to being repository administrators.
• Required status checks to pass before merging currently only enforces the pre-commit status checks. From our conversations we are deciding we want to require the automated tests to pass as well.
• Renovate is currently allowed to push to main, we can take that away, unless we feel it is valuable to set up Renovate's auto-merge functionality.

[zack-is-cool]

Can we have the e2e test run (meaning specifically the makefile running go test underdelivery-aws-iac/test/e2e) only if appropriate files are changed? What would those files be (.tf, .tfvars,.gosomething)? How can we incorporate that logic in the pipeline?

example: we don't need to test e2e if we update a readme for spelling mistakes or clarity, modify a pre-commit hook, etc.

[RothAndrew]

Can we have the e2e test run (meaning specifically the makefile running go test underdelivery-aws-iac/test/e2e) only if appropriate files are changed? What would those files be (.tf, .tfvars,.gosomething)? How can we incorporate that logic in the pipeline?

example: we don't need to test e2e if we update a readme for spelling mistakes or clarity, modify a pre-commit hook, etc.

The issue with this is that if we make the tests a required status check and they don't run because only a certain file type was changed then the PR won't be mergeable. It is possible to do but it requires additional logic in the job itself to check which files were changed and then bail out of the test early with a successful result if, for example, only markdown files were changed.

We can add that logic but I'd prefer to do it as an incremental enhancement rather than up front