GitHub Flow — MQA Governance Portal

Executive Summary

In brief: Code review and CI before production.

Why it matters: No unreviewed changes in live system.

Cost: GitHub Team ~€4/user/month if needed.

Status: CI live; branch protection pending.

Decision needed: GitHub Team/Pro if branch protection required

Executive Overview — all summaries for decision-makers.

As of: August 2026 · Repo: MQA-Group/MQA-Governance-Portal (private)

Branch Model

main ──────────────► Production (portal.mqa.group / api.mqa.group)
  ▲
  │  PR after staging smoke test
  │
develop ───────────► Staging (mqa-*-staging.onrender.com)
  ▲
  │  PR with review + CI
  │
feature/* ─────────► Development
fix/*
chore/*

Branch	Purpose	Auto-deploy
main	Production, stable	Render production
develop	Integration / staging	Render staging
feature/*, fix/*, chore/*	Short-lived work	—

Rule: Never push directly to main. Always PR → develop → after test PR → main.

Pull Request Process

1. Create branch from develop: git checkout develop && git pull && git checkout -b feature/short-description
2. Commits with Conventional Commits:
   • feat: new feature
   • fix: bug fix
   • chore: tooling, CI, docs
   • docs: documentation only
   • security: hardening
3. Open PR against develop — fill out template
4. CI Success must be green (required check, see below)
5. At least 1 review (team discipline; branch protection see below)
6. Merge (squash preferred for clean history)
7. Test staging → DEPLOYMENT-CHECKLIST
8. Release PR: develop → main (only after staging OK)

CI / GitHub Actions

Workflow: .github/workflows/ci.yml

Job	Required	Note
CI Success	✅ Yes	Aggregated gate check for branch protection
Frontend Build	✅ Yes	Lint/test advisory (continue-on-error)
Backend Build	✅ Yes	Lint/test advisory
Security audit	Advisory	npm audit --audit-level=high

Path filter: only affected jobs run (frontend/backend separate).

Dependabot: .github/dependabot.yml — weekly npm updates (Mon 06:00 Berlin).

Branch Protection (manual setup)

Note: Private repos without GitHub Pro/Team cannot enforce rulesets/branch protection via API. Until upgrade: team discipline + PR template.

After GitHub Pro / Team plan:

main

• Require PR before merge
• Required status check: CI Success
• Require 1 approval
• Dismiss stale reviews
• Do not allow bypass (admins optional)
• Restrict pushes to main

develop

• Require PR before merge
• Required status check: CI Success
• 1 approval recommended

Setup: Repo → Settings → Branches → Add branch ruleset (or classic protection).

Secrets & Security

• No secrets in commits, PRs, or issues
• Env reference: ENV-INVENTORY
• Render secrets only in Dashboard / Blueprint sync: false

Release to Production

1. PR develop → main with release notes (summary in PR body)
2. After merge: Render auto-deploys (~5–10 min)
3. Production smoke test: DEPLOYMENT-CHECKLIST
4. For DB changes: migrations run in backend entrypoint (prisma migrate deploy) — no manual seed in prod

Hotfix (exception)

Critical production fixes:

git checkout main && git pull
git checkout -b fix/short-description
# fix, commit, PR → main
# then: merge main → develop (back-merge)

Useful Commands

# Mirror CI locally
npm ci && npm run build
cd backend && npm ci && npm run build

# Create PR
gh pr create --base develop --title "feat: …" --body-file .github/pull_request_template.md

# Status checks
gh pr checks

Related Docs

• OPS-ECOSYSTEM — Architecture
• STAGING-STATUS — Staging resources
• OPS-ROADMAP — Open ops items