-- Binds commit statuses to the workflow definition that produced them, so branch protection only accepts
-- required checks whose workflow file matches the base branch (CI-3).
ALTER TABLE commit_statuses ADD COLUMN workflow_path TEXT;
ALTER TABLE commit_statuses ADD COLUMN workflow_hash TEXT;

-- Runs that execute untrusted code (fork merge queue groups) get no secrets and a read-only token (CI-6).
ALTER TABLE workflow_runs ADD COLUMN untrusted INTEGER NOT NULL DEFAULT 0;

-- Head commit auto-merge was enabled for; a fork push that moves the head disables auto-merge (PR-6).
ALTER TABLE pull_auto_merges ADD COLUMN head_sha TEXT;

-- 'ci' (gitfor Actions, workflow-bound) or 'api' (external integration); NULL for statuses written before this.
ALTER TABLE commit_statuses ADD COLUMN source TEXT CHECK (source IN ('ci', 'api'));