Skip to content
MNPPI Architecture
MNPPI on GitHub

CI/CD and merge controls

Status
Current
Reviewed
August 17, 2026
Cadence
Review each quarter

CI and CD have separate owners.

  • GitHub decides whether code can merge.
  • Cloudflare builds and deploys the merged commit.

That split keeps production Cloudflare credentials out of GitHub Actions.

Authority map

Section titled “Authority map”
Decision System of record Rule
Is the change valid? GitHub Actions The repository check suite must pass.
Can the change merge? GitHub rulesets Required checks must pass on the current commit.
Can the owner merge? GitHub repository Required approvals stay at zero for a sole-owner repository.
When does GitHub merge? GitHub auto-merge Enable squash auto-merge when the pull request opens.
Can production build? Cloudflare Workers Builds Cloudflare builds the merged default branch.
Can production deploy? Cloudflare Deploy starts only after the Cloudflare build passes.

Pull request flow

Section titled “Pull request flow”

  1. Open a pull request.

    Use a short-lived branch. Keep unrelated work out of the change. Enable squash auto-merge with gh pr merge --squash --auto.

  2. Run repository checks.

    Use the designated self-hosted runner when the workflow selects it. Leave the job in the normal queue. Do not retarget runners to skip the wait.

  3. Require one stable result.

    Require an aggregate check such as CI / quality. That check must fail when any required subcheck fails. Rulesets depend on a stable name, not on every job name.

  4. Let GitHub merge after checks pass.

    Squash auto-merge is the default. GitHub merges after required checks pass and review conversations are resolved. No second-person approval is required in the sole-owner model.

  5. Let Cloudflare deploy.

    Workers Builds receives the merged commit. Cloudflare runs the production build and deploy. Watch the Cloudflare build, not a GitHub deploy job.

Required check classes

Section titled “Required check classes”

Select the checks that fit the repo technology and risk:

  • Format and lint
  • Typecheck
  • Unit and integration tests
  • Production package or app build
  • API contract checks when the Worker exposes routes
  • D1 migration checks when schema changes
  • Security and dependency policy checks
  • Accessibility checks for a browser UI
  • Repository policy checks from org-standards

The required aggregate check keeps a stable name. Subchecks can change without a ruleset update.

For the control-to-tool map, see Quality controls and reference tooling.

Sole-owner safeguards

Section titled “Sole-owner safeguards”

The ruleset must not require an approval that only another person can give. The ruleset must not add the owner as a bypass actor.

Required checks, conversation resolution, and allowed merge methods can stay strict. They must not block the owner from merging a valid change.