---
description: CI workflows, Docker, branch protection — no secrets, PR-only merges
globs: [".github/**", "**/Dockerfile*", "**/docker-compose*.yml"]
alwaysApply: false
---

# DevOps and CI

- All merges to `develop` and `main` are **manual PR merges** — no workflow auto-merge.
- Never commit secrets, `.env`, or tokens; use GitHub secrets and env-backed settings.
- Workflow changes: verify triggers, permissions, and required checks match `docs/06-ops/04-BRANCH_PROTECTION_SETUP.md`.
- Branch/commit/PR naming: `docs/07-open-source/03-NAMING_CONVENTIONS.md` (CI-enforced).
- Dependabot PRs target `develop` only.
- Docker: multi-stage where applicable; non-root user in production images when possible.

Skill: `.cursor/skills/devops/SKILL.md`