I already setup Jenkins system to automatically run tests for each and every pull requests before merging to master (Gitflow). The master branch is protected (https://github.com/blog/2051-protected-branches-and-required-status-checks) meaning that a pull request to master will be blocked if test run for it fails.
Everything is working fine now until the CTO decides to unilaterally increase the code coverage. Code coverage is defined in Instanbul ".nycrc" file and he wants to be able to increase 2-4% every week/sprint (current coverage is very low, 30%). He wants to commit/push such increase by modifying ".nycrc" file without adding tests. This means that all the builds will fail, all PRs cannot be merged until teams work on adding tests.
What is the best way to proceed with this? Please advise. I don't want to turn off/on branch protection every time he wants to increase code coverage. The CTO's "hard-handed" approach is already decided (non-negotiable): teams will work on adding tests before others to make builds green and PR mergeable again.
Side quest: teams can also reduce coverage threshold in ".nycrc" file to get their PRs merged. How can I prevent it? I don't think anyone in my team dare to mess with that file (since the CTO stays on top of that file), but I want to learn a general approach for bigger teams.