CI/CD and merge controls
Continuous integration and continuous deployment have separate owners. This separation keeps merge policy clear and keeps production credentials out of GitHub.
Authority map
Section titled “Authority map”| Decision | System of record | Rule |
|---|---|---|
| Is the change valid? | GitHub Actions | The repository check suite must pass. |
| Can the change merge? | GitHub rulesets | Required checks must pass on the current commit. |
| Can the owner merge? | GitHub repository | Required approvals remain zero for a sole-owner repository. |
| Can production build? | Cloudflare Workers Builds | Cloudflare must build the merged default branch. |
| Can production deploy? | Cloudflare | Deployment starts only after the Cloudflare build passes. |
Pull request flow
Section titled “Pull request flow”-
Open a pull request.
Use a short-lived branch. Keep unrelated work outside the change.
-
Run repository checks.
Use the designated self-hosted runner when the workflow selects it. Let the job wait in the normal queue.
-
Enforce one stable result.
Require an aggregate check such as
CI / quality. The aggregate check must fail when a required subcheck fails. -
Merge after checks pass.
The owner can merge the pull request. No second-person approval is necessary for the sole-owner model.
-
Let Cloudflare deploy.
Workers Builds receives the merged commit. Cloudflare performs the production build and deployment.
Required check classes
Section titled “Required check classes”Each repository should select the checks that fit its technology and risk:
- Source format and lint checks.
- Static type checks.
- Unit and integration tests.
- Production package or application build.
- Application programming interface contract checks.
- Database migration checks.
- Security and dependency policy checks.
- Accessibility checks for a user interface.
- Repository policy checks from
org-standards.
The required aggregate check must keep the same name. Individual subchecks can change without a ruleset update.
Sole-owner safeguards
Section titled “Sole-owner safeguards”The ruleset must not require an approval that only another person can provide. The ruleset must not add the owner as a bypass actor.
Required checks, conversation resolution, and allowed merge methods can remain strict. These controls do not prevent the owner from merging a valid change.