--- title: Pushing to main still needs a process | daily.dev description: Pushing straight to main reveals nothing about how carefully a change was checked, Flavio Copes argues. He points to Amp's 'How We Build' page, which keeps... canonical: https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Pushing to main still needs a process | daily.dev og:description: Pushing straight to main reveals nothing about how carefully a change was checked, Flavio Copes argues. He points to Amp's 'How We Build' page, which keeps... og:url: https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn og:image: https://api.daily.dev/og/posts/8FiuV9Qrn.png og:image:alt: Pushing to main still needs a process og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Pushing to main still needs a process **[Flavio Copes](https://daily.dev/sources/flaviocopes)** · 4 min read · 0 upvotes · 0 comments ## Summary Pushing straight to main reveals nothing about how carefully a change was checked, Flavio Copes argues. He points to Amp's 'How We Build' page, which keeps changes small enough to test and revert and holds the merger responsible for the result. Before trusting a workflow, Copes says to check who can update the production branch, whether agents can push unattended, and what GitHub's branch protection rules actually enforce. He also warns that a SOC 2 report doesn't confirm a specific push workflow meets its controls, and that teams need a recorded deployed revision and a real recovery path, since reverting code won't undo a database migration or a sent email. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does having a SOC 2 report mean a team's push-to-main workflow is safe? No, a SOC 2 report alone doesn't establish that a direct-push workflow meets the commitments and controls examined in that report. SOC 2 is assurance reporting from the AICPA about controls relevant to areas like security and availability, but you need the actual scope and relevant controls to assess a specific organization's workflow, not just the branch name it uses. _Teams weighing compliance claims against real git practices can track these debates on daily.dev._ ### What questions should I ask before trusting a team's direct push-to-main workflow? Ask who can update the production branch, which credentials can deploy it, and whether an unattended agent can push changes. Also check whether you can trace a production change to its author, confirm which checks ran on it, and verify whether someone can bypass those checks without that action becoming visible, since a written policy and an enforced repository rule are not the same thing. _Developers designing safer deployment processes can follow workflow debates like this one on daily.dev._ ## Similar posts on daily.dev - [A Practical GitFlow Setup That Works on GitHub](https://daily.dev/posts/a-practical-gitflow-setup-that-works-on-github-40nmgdovs) · This is Learning · 2 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-l8tq260qn) · Medium · 0 upvotes · 0 comments --- Tags: [#cicd](https://daily.dev/tags/cicd), [#code-review](https://daily.dev/tags/code-review) [View this post on daily.dev](https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Pushing to main still needs a process","url":"https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn"},"datePublished":"2026-10-25T16:22:09.779Z","dateModified":"2026-10-25T16:22:38.216Z","description":"Pushing straight to main reveals nothing about how carefully a change was checked, Flavio Copes argues. He points to Amp's 'How We Build' page, which keeps...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f7281f0ad2baa744a03104a45cdf82c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f7281f0ad2baa744a03104a45cdf82c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Flavio Copes","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Flavio Copes","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1f2dbd275797411bbd37bfdaaf0951a9","url":"https://daily.dev/sources/flaviocopes"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cicd,code-review","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Flavio Copes","item":"https://daily.dev/sources/flaviocopes"},{"@type":"ListItem","position":3,"name":"Pushing to main still needs a process"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pushing-to-main-still-needs-a-process-8fiuv9qrn#faq","mainEntity":[{"@type":"Question","name":"Does having a SOC 2 report mean a team's push-to-main workflow is safe?","acceptedAnswer":{"@type":"Answer","text":"No, a SOC 2 report alone doesn't establish that a direct-push workflow meets the commitments and controls examined in that report. SOC 2 is assurance reporting from the AICPA about controls relevant to areas like security and availability, but you need the actual scope and relevant controls to assess a specific organization's workflow, not just the branch name it uses. Teams weighing compliance claims against real git practices can track these debates on daily.dev."}},{"@type":"Question","name":"What questions should I ask before trusting a team's direct push-to-main workflow?","acceptedAnswer":{"@type":"Answer","text":"Ask who can update the production branch, which credentials can deploy it, and whether an unattended agent can push changes. Also check whether you can trace a production change to its author, confirm which checks ran on it, and verify whether someone can bypass those checks without that action becoming visible, since a written policy and an enforced repository rule are not the same thing. Developers designing safer deployment processes can follow workflow debates like this one on daily.dev."}}]} ```