# Branch protection on `main` (GitHub Pro required)

Private repositories on GitHub Free cannot enable branch protection via API or
Settings. Upgrade to **GitHub Pro** (or make the repo public), then configure:

**Settings → Branches → Add branch protection rule → Branch name: `main`**

Recommended settings:

- [x] Require a pull request before merging
- [ ] Require approvals (optional for solo work)
- [x] Require status checks to pass before merging
- [x] Require branches to be up to date before merging

### Required status checks — `ghabilee-frontend2`

- `Dependency vulnerability scan`
- `Secret scan`
- `Build, test, and quality checks`

Until Pro is enabled, use **Pull Request → merge** (not direct push) and rely on
local Husky `pre-push` (`pnpm prepush:check`).

Direct pushes to `main` still trigger full CI in **Deploy frontend to VPS**
before build/deploy.

### Telegram deploy alerts

Add these repository secrets (same values as the monorepo / VPS `backend/.env`):

- `TELEGRAM_BOT_TOKEN`
- `TELEGRAM_GROUP_CHAT_ID`
- `TELEGRAM_GROUP_THREAD_ID` (optional forum topic)
- `TELEGRAM_CHAT_ID` (fallback private chat)

Successful/failed deploys send a **frontend-specific** message via
`scripts/notify-deploy.sh`.