[M0-R][CI] Consolidate existing workflows into mandatory scientific quality gates and protected PR governance #13

Verified current state — 31 August 2026

canonical master = 2c60b63dfb3d42ee573d749c23cf5033aabdbc68
implementation PR = #67
PR head with prior evidence = 4f6a0c8714609f02a4a55f693419c7178bfa46e2
PR state = open
mergeable_state = dirty

The original premise that CI was absent is obsolete. Existing and candidate workflows cover dependency/reproducibility checks, documentation, secret scanning, Django compatibility, image workflows, UI screenshots and deployment.

PR #67 contains the substantive #13 implementation:

• one stable protected required result;
• immutable external Action pins and pin inventory;
• explicit base/head pull-request safety mode;
• synthetic and privacy-safe CI isolation;
• documentation-contract validation;
• PR template, structured issue forms and CODEOWNERS;
• bounded artifact retention;
• branch-protection and stale-branch audit preparation.

Its previous green evidence belongs to its older base. Because master subsequently advanced through dependency, Django 5.2 and documentation merges, GitHub now reports PR #67 as dirty/non-mergeable. The implementation is real but not currently merge-ready.

Objective

Reconcile the candidate with current master and establish an enforceable, privacy-safe scientific merge contract without duplicating checks or silently changing numerical/scientific behavior.

Current exact execution

rebase or reconcile PR #67 onto master 2c60b63
→ resolve conflicts without numerical/scientific/semantic drift
→ rerun every protected check on the reconciled head
→ record reviewer or governed solo-maintainer decision
→ re-read branch protection
→ merge and close #13

Existing assets to preserve and rationalize

• frozen uv.lock environment and governed uv version;
• supported Django 5.2.17 LTS and sqlparse 0.6.0 baseline;
• Python 3.11/3.12 core matrix;
• numerical baseline check;
• dependency audit;
• repository hygiene check;
• Secret Scan;
• strict MkDocs build;
• Docker/GHCR build paths;
• UI screenshot workflow where privacy-safe;
• local staged-diff research safety script;
• PR [M0-R][CI] Add mandatory scientific quality gates and protected PR workflow #67 exact base/head CI companion.

Do not create a second divergent implementation of the same checks.

Required protected aggregate

The stable branch-protection context is:

required

It must fail if any mandatory job fails. Logical coverage includes:

repository-hygiene
quality
Django-integrity
scientific-regression
documentation-contracts
dependency-security
secret-scan
container-build
required

Branch protection must depend on the stable aggregate status rather than volatile matrix-job names.

Exact-PR safety contract

The final implementation must support both:

local staged-diff mode
CI explicit base/head diff mode

CI mode must:

• receive and verify explicit base and head SHAs;
• fail closed on invalid refs or missing merge base;
• inspect the exact proposed change;
• enforce repository-wide invariants where needed;
• never traverse, upload or print private ignored payloads;
• report rule identifiers and paths instead of sensitive matched values.

Workflow hardening

• pin every external GitHub Action to a verified immutable full commit SHA;
• record the human-readable release/tag in comments or an inventory;
• use least-privilege permissions;
• use bounded job timeouts and cancellation of superseded runs;
• expose no production secrets to pull-request workflows;
• cache dependency artifacts only, never patient/research data;
• use disposable database/media/log/cache/artifact paths;
• set explicit privacy-safe artifact retention;
• prohibit continue-on-error for required jobs.

Documentation contracts

Pull requests must validate at least:

• MkDocs strict build and internal links;
• canonical/current/target/archive metadata;
• referenced repository paths;
• named routes and management commands where checked;
• intended-use wording and forbidden-claim regressions;
• archived-document banners;
• immutable Action pins.

Pull-request governance

Version and enforce:

.github/pull_request_template.md
.github/ISSUE_TEMPLATE/
.github/CODEOWNERS

The PR template must require:

linked issue
scope and non-goals
source-of-truth statement
change class
migrations
numerical-output impact
model/data/version impact
intended-use impact
privacy/PHI impact
authorization impact
tests and evidence
rollback
known limitations

Current conservative ownership may remain:

* @andreazedda

until additional maintainers are verified.

Branch-protection target

For master:

• pull request required;
• stable aggregate status required required;
• conversation resolution required;
• branch up to date before merge;
• force pushes disabled;
• branch deletion disabled;
• direct push restricted under normal operation;
• stale approvals dismissed when approvals are used.

Do not require an impossible independent approval when no eligible second reviewer exists. Record either an actual reviewer or an explicit governed solo-maintainer exception.

Stale branch audit

Audit andreazedda/issue7 for:

unique commits
open PR dependency
private/unreviewed work
full containment in master

Delete only when all loss-prevention conditions pass.

Acceptance criteria

• PR [M0-R][CI] Add mandatory scientific quality gates and protected PR workflow #67 is reconciled with current master and has no unresolved conflicts.
• Existing workflows are inventoried and rationalized rather than duplicated.
• Every external Action is pinned to a verified immutable SHA.
• A clean PR produces one stable required status.
• Lint, formatting, type, Django integrity, migration drift, exact-diff safety, numerical regression, documentation, dependency audit, Secret Scan and container build failures block the aggregate gate.
• No workflow uses production patient data or production secrets.
• CI artifacts are privacy-safe and have explicit retention.
• Exact-PR safety mode has deterministic positive and negative tests.
• PR template, issue forms and CODEOWNERS exist.
• Required checks are documented in CONTRIBUTING.md and canonical operations documentation.
• Branch protection is applied and re-read, or any platform/permission blocker is explicit.
• Reviewer or governed solo-maintainer decision is recorded.
• Stale branches are audited before removal.
• Fresh checks pass on the reconciled PR head and the merge commit is recorded.

Cross-system operating boundary

GitHub = technical source of truth and acceptance evidence
Notion = strategy, decisions and evidence summaries
Trello = short-horizon operational sequencing derived from GitHub/Notion

• PR [M0-R][CI] Add mandatory scientific quality gates and protected PR workflow #67: [M0-R][CI] Add mandatory scientific quality gates and protected PR workflow #67
• Notion task: https://app.notion.com/p/3c5446e899ab810ca227f8c2c22e02cf
• Trello current-week card: https://trello.com/c/Ktqt2JtN/763-bmycure4mm-reconcile-pr-67-and-close-github-13
• Trello board: https://trello.com/b/HR0eM6EP/az

Non-goals

This issue does not implement the extended PostgreSQL/E2E/property/coverage programme from #23, alter scientific equations, update golden outputs, expand intended use, redesign production runtime or begin patient-specific M1 scientific runs.