Stop naming a ruleset and a required check this repository does not have

[iderex]

The issue this belongs to

Closes #151

What changed

.github/workflows/dependency-review.yml explained why its job carries no
name: by naming a "Protect main" ruleset whose required status check matches
the literal check-run name. There is one ruleset on this repository, it is called
gate, and it requires no status check, so nothing was standing behind that job
for a rename to break.

The advice is kept and its reason is corrected. Setting a name: still moves the
check-run name, and the comment now says that no rule reads that name today and
names #26 as where the names are required on main once they exist.

Comments only. No trigger, permission, step or action moved.

What failure it prevents

A reader takes that paragraph as a description of the repository's configuration.
This is the more expensive kind of wrong in that directory, because a ruleset is
not in the tree: somebody checking a claim about a file opens the file, and
nobody checks a claim about a ruleset against the API.

It is also the third site of one defect, and the sweep that found it is written
into #151 along with why the two closes before it each left something standing.

Evidence

At the commit being pushed, 0ed29704bac25ab8bccafba93776658519597571.

The sentence is gone:

git grep -n 'Protect main' -- .github/workflows; echo "exit=$?"
exit=1

What the repository actually carries, which is what the comment now describes:

gh api repos/Flowfin/core/rulesets --jq '.[] | "\(.id) \(.name)"'
20572113 gate

gh api repos/Flowfin/core/rulesets/20572113 --jq '[.rules[].type]'
["deletion","non_fast_forward","pull_request"]

gh api repos/Flowfin/core/rulesets/20572113 --jq '[.rules[] | select(.type=="required_status_checks")] | length'
0

Every reference under that directory, in shape rather than in literal, because
the hygiene check reads a literal in this body as an issue here:

git grep -ohE '[A-Za-z0-9._/-]*#[0-9]+' -- .github/workflows | sed 's/[0-9][0-9]*$/N/' | sort | uniq -c
      5 #N
      2 Flowfin/jellyfin-plugin-sso#N

git grep -ohE '[A-Za-z0-9._/-]*#[0-9]+' -- .github/workflows | grep -v / | tr -d '#' | while read n; do gh api repos/Flowfin/core/issues/$n --jq '"\(.number) \(.state) \(.title)"'; done
26 open Require the gate's check names on main once they exist
110 closed Refuse a document that names a path or a command that does not exist
83 closed Add the deterministic pull-request hygiene check
89 open Publish machine-readable statements for the vulnerabilities that are not fixed
94 open Build and publish the release artifacts, reproducibly

Five bare references and every one resolves here. The one added by this change is
the first in that list.

The YAML still parses, which is the one thing a comment edit can break:

python -c "import yaml,glob;[yaml.safe_load(open(f,encoding='utf-8')) for f in glob.glob('.github/workflows/*.yml')]"; echo "exit=$?"
exit=0

The two checks that run on this machine:

bash .github/doc-paths/doc-paths.sh check >/dev/null; echo "exit=$?"
exit=0

bash .github/pr-hygiene/hygiene.sh selftest >/dev/null; echo "exit=$?"
exit=0

What this does not cover

This changes no ruleset and asks for none. #26 is where a required check name is
written down, and it is open.

Two sentences in that directory were read and deliberately left, and #151 carries
both with the reason. zizmor.yml forbids restoring a cache in a job that
publishes a release, which forbids rather than asserts. unicode-guard.yml
explains a byte-order mark exemption by naming a kind of file that exists in the
world rather than in this tree.

Still no check refuses any of this. The document check reads Markdown and prints
on every run that it read nothing else. What found all three sites was somebody
reading the directory, and the two earlier closes are what that method costs when
it is done as a search instead.

Neither zizmor nor Scorecard was run on this machine. Neither tool is installed
here and I installed neither.

Who has read it

Nobody other than me. The evidence above stands in place of a second reader
rather than the question being left open.