Main Branch Merge & Deployment Protection

Overview

Only @CreativeArtDesign can authorize merges to the main branch. This is enforced at two levels: PR merge gating and deployment cancellation.

How It Works

Layer 1: PR Merge Gate (restrict-merge-main.yml)

Trigger: Every PR targeting main (and every review submitted on such PRs).

What it does:

1. Workflow file protection — If the PR modifies any file in .github/workflows/, it is blocked entirely unless the PR author is CreativeArtDesign. This prevents anyone from tampering with the protection workflows.
2. Approval check — The PR cannot pass the check unless CreativeArtDesign has submitted an APPROVED review on the PR.

Security: Uses pull_request_target instead of pull_request, which means the workflow version from main is executed — not the PR's version. This prevents attackers from modifying the workflow in their PR to bypass the check.

Layer 2: Deployment Gate (ci.yaml)

Trigger: Every push to main (after a PR is merged).

What it does:

1. Authorization check — Finds the PR associated with the merge commit and verifies that CreativeArtDesign approved it.
2. If unauthorized — Cancels the running Amplify build via AWS CLI (aws amplify stop-job), preventing deployment.
3. If authorized — Proceeds with normal Amplify deployment monitoring.
4. Direct pushes — If no PR is found for the commit (direct push), the deployment is blocked and the Amplify build is cancelled.

Dev branch: The authorization check is skipped for pushes to dev. Dev deployments proceed without approval.

Protection Summary

Scenario	What Happens
PR to main without CreativeArtDesign's approval	Check fails, merge is discouraged (red X on PR)
PR modifies .github/workflows/ by non-authorized author	Check fails immediately, no approval possible
Someone modifies the workflow in a PR to bypass checks	pull_request_target runs the main version, bypass attempt ignored
Unauthorized merge somehow reaches main	ci.yaml detects it, cancels the Amplify build
Direct push to main (no PR)	ci.yaml blocks it, cancels the Amplify build
Push to dev	No restrictions, deploys normally

Limitations

• GitHub Free plan does not support required status checks on private repos, so the merge button is not hard-blocked. Team members will see a failing check (red X) but can technically still click merge.
• If someone bypasses the PR check and merges anyway, Layer 2 catches it and cancels the Amplify deployment.
• Repo admins can push directly to main. Layer 2 will cancel the deployment in this case.

Files

• .github/workflows/restrict-merge-main.yml — PR merge gate
• .github/workflows/ci.yaml — Deployment gate + Amplify monitoring

Authorized User

To change the authorized user, update CreativeArtDesign in both workflow files:

• restrict-merge-main.yml — line with const AUTHORIZED_USER = 'CreativeArtDesign'
• ci.yaml — line with const AUTHORIZED_USER = 'CreativeArtDesign'

Last updated: 2026-03-05