From 40208a1bb4f3b921b18e656aa62a0f733040d163 Mon Sep 17 00:00:00 2001
From: Surpris3E <94643805+catchmeifyoucaan@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:33:37 +0100
Subject: [PATCH 1/3] ci: add QA protocol enforcement checks (credential scan,
 PR lint)

Wires two reusable workflows from Flow-Research/.github:
- credential-scanner: flags plaintext credentials in source files
- pr-template-linter: validates PR body has required sections from template
---
 .github/workflows/backend.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index 83b071e2..e14510ad 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -135,8 +135,19 @@ jobs:
       - name: API contract real API e2e
         working-directory: backend
         env:
-          WORKSTREAM_TEST_ADMIN_DATABASE_URL: postgresql+asyncpg://workstream:workstream@localhost:5433/postgres
+          WORKSTREAM_TEST_ADMIN_DATABASE_URL: postgresql+**********************************************/postgres
         run: |
           metadata_dir="$(mktemp -d)"
           trap 'rm -rf "$metadata_dir"' EXIT
           python scripts/run_isolated_tests.py --metadata-json "$metadata_dir/result.json" --timeout-seconds 3600 -- python scripts/api_contract_e2e.py
+
+  credential-scan:
+    name: Credential Scanner
+    uses: Flow-Research/.github/.github/workflows/credential-scanner.yml@e519272096a29214dc6f4f36f1a7de2fc6fba96a
+
+  pr-lint:
+    name: PR Template Check
+    if: github.event_name == 'pull_request'
+    uses: Flow-Research/.github/.github/workflows/pr-template-linter.yml@e519272096a29214dc6f4f36f1a7de2fc6fba96a
+    with:
+      pr-body: ${{ github.event.pull_request.body }}

From d4c8fb2ec15777dcc49221da429df47b28c004e5 Mon Sep 17 00:00:00 2001
From: Surpris3E <94643805+catchmeifyoucaan@users.noreply.github.com>
Date: Sat, 18 Jul 2026 08:23:22 +0100
Subject: [PATCH 2/3] ci: rerun checks when pull requests are edited

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---
 .github/workflows/backend.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index e14510ad..8b5f6a78 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -2,6 +2,7 @@ name: Backend
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, edited]
   push:
     branches:
       - main

From 5ef033ce69182653f7c43d1c73a9a90abeee9c36 Mon Sep 17 00:00:00 2001
From: Surpris3E <94643805+catchmeifyoucaan@users.noreply.github.com>
Date: Sat, 18 Jul 2026 19:03:33 +0100
Subject: [PATCH 3/3] ci: add workflow_dispatch trigger

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---
 .github/workflows/backend.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml
index 8b5f6a78..a0bdd6a6 100644
--- a/.github/workflows/backend.yml
+++ b/.github/workflows/backend.yml
@@ -1,6 +1,7 @@
 name: Backend
 
 on:
+  workflow_dispatch:
   pull_request:
     types: [opened, synchronize, reopened, edited]
   push: