Skip to main content
Use this when schema changes should fail before merge instead of failing in a deploy. The gate is a command set: scan --reporter json, diff --fail-on-diff, check, and optional verify. Protected deploy jobs can run sync with one configured target and an explicit remote approval environment variable. The CLI and GitHub Action also provide type-contract --enforce for breaking generated-type changes.

​
Use this when

  • The repository owns declarative schema files.
  • Pull requests should fail on drift.
  • Unsafe SQL should show as PR annotations or SARIF.
  • RLS predicate changes need explicit review.

​
Do this

Start with the free CI layer:
Compose required checks from the CLI:
Use --contract-usage <dir> when the repository wants the scan report to include generated-contract import renames, query response overrides, assertions, and local copies of generated runtime roots. Use SARIF when the organization wants findings in GitHub code scanning:

​
Decide

  • Which branches require drift checks.
  • Whether verify runs on every PR or only protected branches.
  • Who can approve destructive hints.
  • Whether your organization needs additional policy enforcement outside this repository.

CI recipe

Copy a full GitHub Actions workflow.

Check command

Add PR annotations and SARIF output.

Verify command

Run apply-twice verification.

Benchmarks

Review timing and replay-safety evidence.
Last modified on July 24, 2026