# Branch protection on `main` (Gitea)

Configure in Gitea:

**Repository → Settings → Branches → Add branch protection rule → Branch name pattern: `main`**

Recommended settings:

- [x] Enable push
- [x] Enable merge
- [x] Require pull request reviews (optional for solo work)
- [x] Enable status check
- [x] Require branches to be up to date before merging

### Required status checks

- `Dependency vulnerability scan`
- `Secret scan`
- `Build, test, and quality checks`

Until status checks are wired, use **Pull Request → merge** (not direct push) and rely on
local Husky `pre-push` (`pnpm prepush:check`).

### Gitea Actions secrets

Repo → Settings → Actions → Secrets:

| Secret        | Purpose                                       |
| ------------- | --------------------------------------------- |
| `VPS_SSH_KEY` | Private key for SSH deploy to the Iran VPS    |
| `VPS_HOST`    | VPS host/IP reachable from the Actions runner |
| `VPS_USER`    | SSH user (usually `root`)                     |

`GITHUB_TOKEN` is injected automatically by Gitea Actions (used for the container registry).

### Container registry

Images publish to: `git.ghabilee.ir/<owner>/<repo>:<sha>`

### Telegram deploy alerts

Notify scripts SSH into the VPS and use Telegram credentials already on the server
(`/opt/ghabilee-admin` / shared ops env). No extra Gitea secrets are required for notify
unless you change `scripts/notify-via-vps.sh`.

### Remotes

- Gitea (canonical): `https://git.ghabilee.ir/AliSaZa/admin.git`
- Git SSH: `ssh://git@git.ghabilee.ir:222/AliSaZa/admin.git`