Increase Code Coverage gate for protected `master` branch in Github Enterprise

Question

I already setup Jenkins system to automatically run tests for each and every pull requests before merging to master (Gitflow). The master branch is protected (https://github.com/blog/2051-protected-branches-and-required-status-checks) meaning that a pull request to master will be blocked if test run for it fails.

Everything is working fine now until the CTO decides to unilaterally increase the code coverage. Code coverage is defined in Instanbul ".nycrc" file and he wants to be able to increase 2-4% every week/sprint (current coverage is very low, 30%). He wants to commit/push such increase by modifying ".nycrc" file without adding tests. This means that all the builds will fail, all PRs cannot be merged until teams work on adding tests.

What is the best way to proceed with this? Please advise. I don't want to turn off/on branch protection every time he wants to increase code coverage. The CTO's "hard-handed" approach is already decided (non-negotiable): teams will work on adding tests before others to make builds green and PR mergeable again.

Side quest: teams can also reduce coverage threshold in ".nycrc" file to get their PRs merged. How can I prevent it? I don't think anyone in my team dare to mess with that file (since the CTO stays on top of that file), but I want to learn a general approach for bigger teams.

Answer 1

What I did is to add the CTO to the Admin group of the Github Organization. In Branch Protection settings, I disable “Include adminstrators” under “Require status checks to pass before merging” (go to Repository settings -> Branches -> master). In this way, the CTO can use his admin privileges to force merge pull requests for increasing code coverage thresholds (they usually fail).

The "side quest" in the original question still remains open. I have my own solution for my company's particular setup but I don't think it works well in general.