> ## Documentation Index
> Fetch the complete documentation index at: https://supaschema.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CI gate

> Use supaschema as a drift, replay-safety, and policy-isolation gate before schema changes merge.

Use this when schema changes should fail before merge instead of failing in a deploy.

The gate is a command set: `scan --reporter json`, `diff --fail-on-diff`, `check`, and optional `verify`. Protected deploy jobs can run `sync` with one configured target and an explicit remote approval environment variable. The CLI and GitHub Action also provide `type-contract --enforce` for breaking generated-type changes.

## Use this when

* The repository owns declarative schema files.
* Pull requests should fail on drift.
* Unsafe SQL should show as PR annotations or SARIF.
* RLS predicate changes need explicit review.

## Do this

Start with the free CI layer:

```yaml theme={null}
- uses: jmclaughlin724/supaschema@<tag>
  with:
    argv: '["scan","--reporter","json"]'

- uses: jmclaughlin724/supaschema@<tag>
  with:
    argv: '["diff","--fail-on-diff","--quiet"]'
  env:
    SUPASCHEMA_DATABASE_URL: ${{ secrets.DATABASE_URL }}
```

Compose required checks from the CLI:

```bash theme={null}
npx supaschema scan --reporter json
npx supaschema scan --contract-usage src --reporter json
npx supaschema diff --fail-on-diff --quiet
npx supaschema check --reporter github
npx supaschema verify
```

Use `--contract-usage <dir>` when the repository wants the scan report to include generated-contract import renames, query response overrides, assertions, and local copies of generated runtime roots.

Use SARIF when the organization wants findings in GitHub code scanning:

```bash theme={null}
npx supaschema check --reporter sarif
```

## Decide

* Which branches require drift checks.
* Whether `verify` runs on every PR or only protected branches.
* Who can approve destructive hints.
* Whether your organization needs additional policy enforcement outside this repository.

## Related

<CardGroup cols={2}>
  <Card title="CI recipe" icon="github" href="/docs/guides/ci-github-actions">
    Copy a full GitHub Actions workflow.
  </Card>

  <Card title="Check command" icon="shield-check" href="/docs/commands/check">
    Add PR annotations and SARIF output.
  </Card>

  <Card title="Verify command" icon="repeat-2" href="/docs/commands/verify">
    Run apply-twice verification.
  </Card>

  <Card title="Benchmarks" icon="gauge" href="/docs/benchmarks">
    Review timing and replay-safety evidence.
  </Card>
</CardGroup>