Run Promote validated commit from dev. It validates one immutable commit, advances test and pprd in sequence, and requires explicit production confirmation by katbose before advancing prod. The same SHA and commit messages reach every branch. CI, CodeQL, Integration, and Load/Security are reusable workflows; they also validate PRs into dev. Direct force-pushes and promotion merge commits are prohibited.
The Payload advisory exception is restricted to GHSA-jg8r-5jh2-v2xj on version 3.88.0; all other findings fail CI. Missing integration/load prerequisites still produce explicit skips.
Workflow map
Stable required checks
Rulesets require aggregate jobs rather than every conditional job:
CI SuccessIntegration Success on promotion branchesLoad & Security Success on pprd and prod
Each aggregate accepts only success or an intentional skipped result. A failure
or cancellation fails the aggregate. External required checks are CodeQL, Socket,
and Codecov project and patch coverage.
Integration/E2E needs DATABASE_URL_TEST. k6 and ZAP need PPRD_URL. Their
preflight jobs emit an explicit notice when infrastructure is not configured;
Trivy remains a hard gate regardless.
Local verification
Last modified on September 22, 2026
