---
title: "CI/CD and merge controls"
description: "GitHub validates and authorizes each merge. Cloudflare builds and deploys the merged default branch."
url: "https://architecture.mnppi.org/delivery/ci-cd-and-merge-controls/"
status: "Current"
last_updated: "2026-07-23"
---

# CI/CD and merge controls

**Standard details**

- Status: Current
- Reviewed: July 23, 2026
- Cadence: Review each quarter

Continuous integration and continuous deployment have separate owners.
This separation keeps merge policy clear and keeps production credentials out of GitHub.

## Authority map

| Decision               | System of record          | Rule                                                        |
| ---------------------- | ------------------------- | ----------------------------------------------------------- |
| Is the change valid?   | GitHub Actions            | The repository check suite must pass.                       |
| Can the change merge?  | GitHub rulesets           | Required checks must pass on the current commit.            |
| Can the owner merge?   | GitHub repository         | Required approvals remain zero for a sole-owner repository. |
| Can production build?  | Cloudflare Workers Builds | Cloudflare must build the merged default branch.            |
| Can production deploy? | Cloudflare                | Deployment starts only after the Cloudflare build passes.   |

## Pull request flow

1. **Open a pull request.**

   Use a short-lived branch.
   Keep unrelated work outside the change.

2. **Run repository checks.**

   Use the designated self-hosted runner when the workflow selects it.
   Let the job wait in the normal queue.

3. **Enforce one stable result.**

   Require an aggregate check such as `CI / quality`.
   The aggregate check must fail when a required subcheck fails.

4. **Merge after checks pass.**

   The owner can merge the pull request.
   No second-person approval is necessary for the sole-owner model.

5. **Let Cloudflare deploy.**

   Workers Builds receives the merged commit.
   Cloudflare performs the production build and deployment.

## Required check classes

Each repository should select the checks that fit its technology and risk:

- Source format and lint checks.
- Static type checks.
- Unit and integration tests.
- Production package or application build.
- Application programming interface contract checks.
- Database migration checks.
- Security and dependency policy checks.
- Accessibility checks for a user interface.
- Repository policy checks from `org-standards`.

The required aggregate check must keep the same name.
Individual subchecks can change without a ruleset update.

## Sole-owner safeguards

The ruleset must not require an approval that only another person can provide.
The ruleset must not add the owner as a bypass actor.

Required checks, conversation resolution, and allowed merge methods can remain strict.
These controls do not prevent the owner from merging a valid change.

> **Danger**
>
> Do not move production deployment credentials into GitHub to reduce Cloudflare setup.
> Cloudflare must own the normal build and deploy path.