CI Checks Gating a PR

Goal: every commit runs CI, and nothing merges to main without a passing rollup and one fresh approval.

You need: a repo you hold git.admin on, a clone, and the dodil CLI.

CI credentials. CI jobs run outside Dodil’s apps cluster, so pick the credential by target: a dk_ API key works against every control-plane endpoint (git over HTTP, registry push, Ignite deploy via the API) but is rejected with 401 by direct worker endpoints (e.g. Ignite invoke) — those accept only a service-account JWT. See API Keys .

1. Add a workflow

Runs start from files in the repo: a workflow under .github/workflows/ or a .dodil/checks.yaml. A minimal two-job workflow with a dependency:


# .github/workflows/ci.yaml
name: ci
jobs:
  build:
    steps:
      - run: make build
  test:
    needs: build
    steps:
      - run: make test


git switch -c ci/setup
git add .github/workflows/ci.yaml
git commit -m "Add CI workflow"
git push -u origin ci/setup

Each job reports a check named workflow/job (ci/build, ci/test); needs renders as the job graph in the console’s Actions tab.

2. Watch the run


SHA=$(git rev-parse HEAD)
dodil git check list my-service "$SHA"
# rollup: running
# NAME      STATE    SUMMARY
# ci/build  passed   …
# ci/test   running  …

Re-run until the rollup is terminal, or tail a job’s log live over SSE. Job secrets come from CI secrets — set them in Settings → Secrets and reference them by name; the runner injects and masks them.

3. Protect the target branch

Protection is a control-plane PUT (or Settings → Branch protection in the console):


curl -X PUT "https://git.dodil.io/api/v1/repos/$REPO_ID/protection" \
  -u "user:$DK_KEY" -H 'Content-Type: application/json' \
  -d '{
    "branch_pattern": "main",
    "required_approvals": 1,
    "require_green_checks": true,
    "block_force_push": true,
    "dismiss_stale_approvals": true
  }'

4. Open the PR and try to merge


dodil git pr create my-service --title "Add CI workflow" --head ci/setup --base main
dodil git pr merge my-service 1
# HTTP 409: protection unsatisfied — approvals 0/1

The gate holds. Get an approval (from someone else — enable block_self_approval to enforce that), and merge once the rollup is passed:


dodil git pr approve my-service 1 --body "CI looks right"
dodil git pr merge my-service 1 --method squash
# PR #1 merged

Verify

dodil git pr get my-service 1 → state: merged, a review pinned to the merged head_sha, checks_state: passed.
Push another commit to an open PR and watch dismiss_stale_approvals discard the old approval — the merge blocks again until re-approved.