diff --git a/backend/.sqlx/query-16c6e24ae06b52feed597a0c3d299107f989d50ea651546e964670cf99fd2de6.json b/backend/.sqlx/query-16c6e24ae06b52feed597a0c3d299107f989d50ea651546e964670cf99fd2de6.json
new file mode 100644
index 0000000000..f5bb8e14d1
--- /dev/null
+++ b/backend/.sqlx/query-16c6e24ae06b52feed597a0c3d299107f989d50ea651546e964670cf99fd2de6.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO git_sync_ci_test_check\n            (workspace_id, poster_workspace_id, head_sha, head_ref, repo_url,\n             repo_resource_path, check_run_id,\n             created_at, concluded, conclusion, concluded_at, github_posted)\n         VALUES ($1, $2, $3, $4, $5, $6, NULL, now(), false, NULL, NULL, false)\n         ON CONFLICT (workspace_id, repo_resource_path, head_sha) DO UPDATE SET\n            poster_workspace_id = EXCLUDED.poster_workspace_id,\n            head_ref = EXCLUDED.head_ref,\n            repo_url = EXCLUDED.repo_url,\n            check_run_id = NULL,\n            created_at = now(),\n            concluded = false,\n            conclusion = NULL,\n            concluded_at = NULL,\n            github_posted = false",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "16c6e24ae06b52feed597a0c3d299107f989d50ea651546e964670cf99fd2de6"
+}
diff --git a/backend/.sqlx/query-18ba139acef81d4de18bf21755fa8605c3851b48bab4964c380538ada93f06a9.json b/backend/.sqlx/query-18ba139acef81d4de18bf21755fa8605c3851b48bab4964c380538ada93f06a9.json
new file mode 100644
index 0000000000..8647442530
--- /dev/null
+++ b/backend/.sqlx/query-18ba139acef81d4de18bf21755fa8605c3851b48bab4964c380538ada93f06a9.json
@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT test_script_path, tested_item_path, tested_item_kind, has_wildcard AS \"has_wildcard!\" FROM ci_test_reference WHERE workspace_id = $1 ORDER BY test_script_path, tested_item_kind, tested_item_path",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "test_script_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "tested_item_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "tested_item_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "has_wildcard!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "18ba139acef81d4de18bf21755fa8605c3851b48bab4964c380538ada93f06a9"
+}
diff --git a/backend/.sqlx/query-1b5f6620d35dd74b32ce6325891be02fe144a2da1ebf446b0df92944da791fa7.json b/backend/.sqlx/query-1b5f6620d35dd74b32ce6325891be02fe144a2da1ebf446b0df92944da791fa7.json
new file mode 100644
index 0000000000..a78e343072
--- /dev/null
+++ b/backend/.sqlx/query-1b5f6620d35dd74b32ce6325891be02fe144a2da1ebf446b0df92944da791fa7.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT u.username, u.email FROM workspace w JOIN usr u ON u.workspace_id = w.id AND u.email = w.owner WHERE w.id = $1 AND NOT u.disabled",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "username",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "email",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "1b5f6620d35dd74b32ce6325891be02fe144a2da1ebf446b0df92944da791fa7"
+}
diff --git a/backend/.sqlx/query-35783f52031d7ba14142108480b3599f083dee7415acdbe4410412309dfa2ca1.json b/backend/.sqlx/query-35783f52031d7ba14142108480b3599f083dee7415acdbe4410412309dfa2ca1.json
new file mode 100644
index 0000000000..9f9cf036fb
--- /dev/null
+++ b/backend/.sqlx/query-35783f52031d7ba14142108480b3599f083dee7415acdbe4410412309dfa2ca1.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT r->>'script_path' as \"script_path\"\n           FROM workspace_settings ws,\n                jsonb_array_elements(\n                    CASE WHEN jsonb_typeof(ws.git_sync->'repositories') = 'array'\n                         THEN ws.git_sync->'repositories' END\n                ) r\n           WHERE ws.workspace_id = $1\n             AND r->>'git_repo_resource_path' IN ($2, '$res:' || $2)\n           LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "script_path",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "35783f52031d7ba14142108480b3599f083dee7415acdbe4410412309dfa2ca1"
+}
diff --git a/backend/.sqlx/query-422490f2f91b4d97331e87da135884932eab27f53171c12291cca15a6ec33586.json b/backend/.sqlx/query-422490f2f91b4d97331e87da135884932eab27f53171c12291cca15a6ec33586.json
new file mode 100644
index 0000000000..2d0bb40c18
--- /dev/null
+++ b/backend/.sqlx/query-422490f2f91b4d97331e87da135884932eab27f53171c12291cca15a6ec33586.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_ci_test_check\n         SET concluded = true, github_posted = true, concluded_at = now(),\n             conclusion = COALESCE(conclusion, 'failure')\n         WHERE (check_run_id IS NULL AND NOT concluded\n                AND created_at < now() - make_interval(secs => $1))\n            OR (concluded AND NOT github_posted\n                AND concluded_at < now() - make_interval(secs => $2))",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Float8",
+        "Float8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "422490f2f91b4d97331e87da135884932eab27f53171c12291cca15a6ec33586"
+}
diff --git a/backend/.sqlx/query-45d0e716fa402a63b0bf6877c21c0fa50b81d46845c400d569d6d8e49e503b59.json b/backend/.sqlx/query-45d0e716fa402a63b0bf6877c21c0fa50b81d46845c400d569d6d8e49e503b59.json
new file mode 100644
index 0000000000..526f3f5537
--- /dev/null
+++ b/backend/.sqlx/query-45d0e716fa402a63b0bf6877c21c0fa50b81d46845c400d569d6d8e49e503b59.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_synced_head SET tests_dispatched_at = NULL\n                 WHERE workspace_id = $1 AND repo_resource_path = $2 AND branch = $3 AND sha = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "45d0e716fa402a63b0bf6877c21c0fa50b81d46845c400d569d6d8e49e503b59"
+}
diff --git a/backend/.sqlx/query-4dde939e92f5b8a9cc165c9ea383a456eef081d16c2a58e7262f86d80289c2da.json b/backend/.sqlx/query-4dde939e92f5b8a9cc165c9ea383a456eef081d16c2a58e7262f86d80289c2da.json
new file mode 100644
index 0000000000..8c784b664e
--- /dev/null
+++ b/backend/.sqlx/query-4dde939e92f5b8a9cc165c9ea383a456eef081d16c2a58e7262f86d80289c2da.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_synced_head SET tests_dispatched_at = now()\n           WHERE workspace_id = $1 AND repo_resource_path = $2 AND branch = $3 AND sha = $4\n             AND (tests_dispatched_at IS NULL\n                  OR (ci_test_job_ids IS NULL\n                      AND tests_dispatched_at < now() - make_interval(secs => $5)))\n           RETURNING true as \"claimed!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "claimed!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Float8"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "4dde939e92f5b8a9cc165c9ea383a456eef081d16c2a58e7262f86d80289c2da"
+}
diff --git a/backend/.sqlx/query-4e4b31e97f0cc946f26cc0faf9a09de2846c43ee48f047e0f2ea9ee7a6502c81.json b/backend/.sqlx/query-4e4b31e97f0cc946f26cc0faf9a09de2846c43ee48f047e0f2ea9ee7a6502c81.json
new file mode 100644
index 0000000000..c8b8b94da4
--- /dev/null
+++ b/backend/.sqlx/query-4e4b31e97f0cc946f26cc0faf9a09de2846c43ee48f047e0f2ea9ee7a6502c81.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT (\n               SELECT h.sha FROM git_sync_synced_head h\n               WHERE h.workspace_id = $1 AND h.repo_resource_path = $4 AND h.branch = $3\n               ORDER BY h.synced_at DESC LIMIT 1\n           ) = $2 AND NOT EXISTS (\n               SELECT 1\n               FROM v2_job_queue q\n               JOIN v2_job j ON j.id = q.id\n               WHERE q.workspace_id = $1\n                 AND j.kind = 'deploymentcallback'\n                 AND j.args->'__git_sync_auto_pull'->>'branch' = $3\n                 AND j.args->'__git_sync_auto_pull'->>'repo_resource_path'\n                     IN ($4, '$res:' || $4)\n           ) AND NOT EXISTS (\n               SELECT 1\n               FROM v2_job_queue q\n               JOIN v2_job j ON j.id = q.id\n               WHERE q.workspace_id = $1\n                 AND j.kind IN ('dependencies', 'flowdependencies', 'appdependencies')\n           ) as \"ready\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ready",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "4e4b31e97f0cc946f26cc0faf9a09de2846c43ee48f047e0f2ea9ee7a6502c81"
+}
diff --git a/backend/.sqlx/query-5fcaf17e24fa00ffafdc5f0f425fe4c1c745457d463d8ea61627ebe61ba8ab2c.json b/backend/.sqlx/query-5fcaf17e24fa00ffafdc5f0f425fe4c1c745457d463d8ea61627ebe61ba8ab2c.json
new file mode 100644
index 0000000000..53a3b04d6b
--- /dev/null
+++ b/backend/.sqlx/query-5fcaf17e24fa00ffafdc5f0f425fe4c1c745457d463d8ea61627ebe61ba8ab2c.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_synced_head SET ci_test_job_ids = NULL, tests_dispatched_at = NULL\n             WHERE workspace_id = $1 AND repo_resource_path = $2 AND branch = $3 AND sha = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5fcaf17e24fa00ffafdc5f0f425fe4c1c745457d463d8ea61627ebe61ba8ab2c"
+}
diff --git a/backend/.sqlx/query-6e3cd83ad7eef0dddacf9359f662193e094ca44642342778fb4281a711263385.json b/backend/.sqlx/query-6e3cd83ad7eef0dddacf9359f662193e094ca44642342778fb4281a711263385.json
new file mode 100644
index 0000000000..427ba00075
--- /dev/null
+++ b/backend/.sqlx/query-6e3cd83ad7eef0dddacf9359f662193e094ca44642342778fb4281a711263385.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_synced_head SET ci_test_job_ids = $5\n         WHERE workspace_id = $1 AND repo_resource_path = $2 AND branch = $3 AND sha = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "UuidArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6e3cd83ad7eef0dddacf9359f662193e094ca44642342778fb4281a711263385"
+}
diff --git a/backend/.sqlx/query-7a0ddb6821d8f628bcf85f786e5864e09c7a5a421ba99647570c2b557d53aa51.json b/backend/.sqlx/query-7a0ddb6821d8f628bcf85f786e5864e09c7a5a421ba99647570c2b557d53aa51.json
new file mode 100644
index 0000000000..b7cccbfad4
--- /dev/null
+++ b/backend/.sqlx/query-7a0ddb6821d8f628bcf85f786e5864e09c7a5a421ba99647570c2b557d53aa51.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_ci_test_check SET github_posted = true\n                 WHERE workspace_id = $1 AND repo_resource_path = $4 AND head_sha = $2\n                   AND check_run_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7a0ddb6821d8f628bcf85f786e5864e09c7a5a421ba99647570c2b557d53aa51"
+}
diff --git a/backend/.sqlx/query-89a7f413f6f37aeb7e777faeebb0c4e1612928737a5fb2b4ff1336d8827f788b.json b/backend/.sqlx/query-89a7f413f6f37aeb7e777faeebb0c4e1612928737a5fb2b4ff1336d8827f788b.json
new file mode 100644
index 0000000000..e0d369fd12
--- /dev/null
+++ b/backend/.sqlx/query-89a7f413f6f37aeb7e777faeebb0c4e1612928737a5fb2b4ff1336d8827f788b.json
@@ -0,0 +1,37 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_ci_test_check\n            SET concluded = true, conclusion = $3, concluded_at = now()\n          WHERE workspace_id = $1 AND repo_resource_path = $4 AND head_sha = $2 AND NOT concluded\n        RETURNING check_run_id, poster_workspace_id, repo_url",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "check_run_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "poster_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "repo_url",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "89a7f413f6f37aeb7e777faeebb0c4e1612928737a5fb2b4ff1336d8827f788b"
+}
diff --git a/backend/.sqlx/query-8efe5509034327c202cb3fdd409ce00cc1dbd4921a9ccee8f906515286190b8f.json b/backend/.sqlx/query-8efe5509034327c202cb3fdd409ce00cc1dbd4921a9ccee8f906515286190b8f.json
new file mode 100644
index 0000000000..db3362bf0c
--- /dev/null
+++ b/backend/.sqlx/query-8efe5509034327c202cb3fdd409ce00cc1dbd4921a9ccee8f906515286190b8f.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ci_test_job_ids\n           FROM git_sync_synced_head\n           WHERE workspace_id = $1 AND repo_resource_path = $2 AND branch = $3 AND sha = $4",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ci_test_job_ids",
+        "type_info": "UuidArray"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "8efe5509034327c202cb3fdd409ce00cc1dbd4921a9ccee8f906515286190b8f"
+}
diff --git a/backend/.sqlx/query-98b036be15cbd5efbaf2420feb56dd175aeab87f6377f6ac7b51956ce6d5f039.json b/backend/.sqlx/query-98b036be15cbd5efbaf2420feb56dd175aeab87f6377f6ac7b51956ce6d5f039.json
new file mode 100644
index 0000000000..b63a9d294e
--- /dev/null
+++ b/backend/.sqlx/query-98b036be15cbd5efbaf2420feb56dd175aeab87f6377f6ac7b51956ce6d5f039.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_synced_head SET tests_dispatched_at = NULL\n         WHERE workspace_id = $1 AND repo_resource_path = $2 AND branch = $3 AND sha = $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "98b036be15cbd5efbaf2420feb56dd175aeab87f6377f6ac7b51956ce6d5f039"
+}
diff --git a/backend/.sqlx/query-a7d5a7b6b3bb88f5f7926da577f2cc25020b11882fb359b136466c82b040f8a1.json b/backend/.sqlx/query-a7d5a7b6b3bb88f5f7926da577f2cc25020b11882fb359b136466c82b040f8a1.json
new file mode 100644
index 0000000000..26301c39b2
--- /dev/null
+++ b/backend/.sqlx/query-a7d5a7b6b3bb88f5f7926da577f2cc25020b11882fb359b136466c82b040f8a1.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM git_sync_ci_test_check c\n         WHERE c.concluded AND c.github_posted\n           AND c.concluded_at < now() - make_interval(secs => $1)\n           AND NOT EXISTS (\n               SELECT 1 FROM git_sync_synced_head h\n               WHERE h.workspace_id = c.workspace_id\n                 AND h.repo_resource_path = c.repo_resource_path\n                 AND h.sha = c.head_sha\n           )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Float8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a7d5a7b6b3bb88f5f7926da577f2cc25020b11882fb359b136466c82b040f8a1"
+}
diff --git a/backend/.sqlx/query-a970bbf4d3d064614bc47d438a0447eff928c4518fd2f6800145bf1211086352.json b/backend/.sqlx/query-a970bbf4d3d064614bc47d438a0447eff928c4518fd2f6800145bf1211086352.json
new file mode 100644
index 0000000000..258ee9eaa7
--- /dev/null
+++ b/backend/.sqlx/query-a970bbf4d3d064614bc47d438a0447eff928c4518fd2f6800145bf1211086352.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT repo_resource_path, head_sha FROM git_sync_ci_test_check\n         WHERE workspace_id = $1 AND NOT concluded",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "repo_resource_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "head_sha",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "a970bbf4d3d064614bc47d438a0447eff928c4518fd2f6800145bf1211086352"
+}
diff --git a/backend/.sqlx/query-b7c72ecebf6818d4e60a02edb986c920aa2e14365e63ef8c28c7f65da7c6c9ab.json b/backend/.sqlx/query-b7c72ecebf6818d4e60a02edb986c920aa2e14365e63ef8c28c7f65da7c6c9ab.json
new file mode 100644
index 0000000000..2991d30d1c
--- /dev/null
+++ b/backend/.sqlx/query-b7c72ecebf6818d4e60a02edb986c920aa2e14365e63ef8c28c7f65da7c6c9ab.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE git_sync_ci_test_check\n         SET github_posted = github_posted\n                 AND check_run_id IS NOT DISTINCT FROM GREATEST(check_run_id, $3),\n             check_run_id = GREATEST(check_run_id, $3)\n         WHERE workspace_id = $1 AND repo_resource_path = $4 AND head_sha = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b7c72ecebf6818d4e60a02edb986c920aa2e14365e63ef8c28c7f65da7c6c9ab"
+}
diff --git a/backend/.sqlx/query-bafee32cbff8bb7fff26a241d9ad203ea689c1e4b094a2c90eb90c8e4b6e0dff.json b/backend/.sqlx/query-bafee32cbff8bb7fff26a241d9ad203ea689c1e4b094a2c90eb90c8e4b6e0dff.json
new file mode 100644
index 0000000000..31c628c1a8
--- /dev/null
+++ b/backend/.sqlx/query-bafee32cbff8bb7fff26a241d9ad203ea689c1e4b094a2c90eb90c8e4b6e0dff.json
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS (\n               SELECT 1 FROM git_sync_ci_test_check\n               WHERE poster_workspace_id = $1 AND repo_resource_path = $2 AND head_sha = $3\n           ) as \"exists!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "bafee32cbff8bb7fff26a241d9ad203ea689c1e4b094a2c90eb90c8e4b6e0dff"
+}
diff --git a/backend/.sqlx/query-c38a1cf8d2a8fd89008a98f03ab87a438b619eb1919c028c6c80e972b4ae438d.json b/backend/.sqlx/query-c38a1cf8d2a8fd89008a98f03ab87a438b619eb1919c028c6c80e972b4ae438d.json
new file mode 100644
index 0000000000..c904dc72fd
--- /dev/null
+++ b/backend/.sqlx/query-c38a1cf8d2a8fd89008a98f03ab87a438b619eb1919c028c6c80e972b4ae438d.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) as \"count!\"\n           FROM git_sync_synced_head h\n           JOIN v2_job_completed pc ON pc.id = h.job_id\n           JOIN v2_job j ON j.workspace_id = h.workspace_id\n             AND j.kind IN ('dependencies', 'flowdependencies', 'appdependencies')\n             AND j.created_at >= pc.started_at\n             AND j.created_at <= COALESCE(h.tests_dispatched_at, now())\n           JOIN v2_job_completed c ON c.id = j.id AND c.status IN ('failure', 'canceled')\n           WHERE h.workspace_id = $1 AND h.repo_resource_path = $4\n             AND h.branch = $3 AND h.sha = $2\n             AND h.source = 'pull'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "c38a1cf8d2a8fd89008a98f03ab87a438b619eb1919c028c6c80e972b4ae438d"
+}
diff --git a/backend/.sqlx/query-cfbe6784b3d108f935ba884fe2d3b36afde836fbc6db046279b015bea6f70201.json b/backend/.sqlx/query-cfbe6784b3d108f935ba884fe2d3b36afde836fbc6db046279b015bea6f70201.json
new file mode 100644
index 0000000000..cb87d3b3f6
--- /dev/null
+++ b/backend/.sqlx/query-cfbe6784b3d108f935ba884fe2d3b36afde836fbc6db046279b015bea6f70201.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT args->>'repo_url_resource_path' FROM v2_job WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "cfbe6784b3d108f935ba884fe2d3b36afde836fbc6db046279b015bea6f70201"
+}
diff --git a/backend/.sqlx/query-d644b9cd3407e58f235cc2e97558257c07785c8b3123f13d59ee361b4ee0bc0a.json b/backend/.sqlx/query-d644b9cd3407e58f235cc2e97558257c07785c8b3123f13d59ee361b4ee0bc0a.json
new file mode 100644
index 0000000000..70fd38193c
--- /dev/null
+++ b/backend/.sqlx/query-d644b9cd3407e58f235cc2e97558257c07785c8b3123f13d59ee361b4ee0bc0a.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT path FROM script WHERE workspace_id = $1 AND deleted = false AND archived = false",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "d644b9cd3407e58f235cc2e97558257c07785c8b3123f13d59ee361b4ee0bc0a"
+}
diff --git a/backend/.sqlx/query-dfffd6573a1eab11c0515805f85b95a942f71651a4f34e671f25ba6816a506c8.json b/backend/.sqlx/query-dfffd6573a1eab11c0515805f85b95a942f71651a4f34e671f25ba6816a506c8.json
new file mode 100644
index 0000000000..9129b657d3
--- /dev/null
+++ b/backend/.sqlx/query-dfffd6573a1eab11c0515805f85b95a942f71651a4f34e671f25ba6816a506c8.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) as \"count!\" FROM v2_job WHERE id = ANY($1::uuid[])",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "dfffd6573a1eab11c0515805f85b95a942f71651a4f34e671f25ba6816a506c8"
+}
diff --git a/backend/.sqlx/query-e64ec4941cbbee016c14d958b7220ddfc414c7e741a171fb80673c23644e3619.json b/backend/.sqlx/query-e64ec4941cbbee016c14d958b7220ddfc414c7e741a171fb80673c23644e3619.json
new file mode 100644
index 0000000000..cf4d577dbb
--- /dev/null
+++ b/backend/.sqlx/query-e64ec4941cbbee016c14d958b7220ddfc414c7e741a171fb80673c23644e3619.json
@@ -0,0 +1,50 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id, poster_workspace_id, head_sha, repo_url, repo_resource_path,\n                  check_run_id\n           FROM git_sync_ci_test_check\n           WHERE NOT concluded OR NOT github_posted",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "poster_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "head_sha",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "repo_url",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "repo_resource_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 5,
+        "name": "check_run_id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "e64ec4941cbbee016c14d958b7220ddfc414c7e741a171fb80673c23644e3619"
+}
diff --git a/backend/.sqlx/query-e6f2a6fa47bf3b5c774d6bc6060ca5a99addffab3dd44529ce9f40de115b0a3c.json b/backend/.sqlx/query-e6f2a6fa47bf3b5c774d6bc6060ca5a99addffab3dd44529ce9f40de115b0a3c.json
new file mode 100644
index 0000000000..f8c42256bb
--- /dev/null
+++ b/backend/.sqlx/query-e6f2a6fa47bf3b5c774d6bc6060ca5a99addffab3dd44529ce9f40de115b0a3c.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM git_sync_synced_head h\n         WHERE h.synced_at < now() - make_interval(secs => $1)\n           AND EXISTS (\n               SELECT 1 FROM git_sync_synced_head n\n               WHERE n.workspace_id = h.workspace_id\n                 AND n.repo_resource_path = h.repo_resource_path\n                 AND n.branch = h.branch\n                 AND n.synced_at > h.synced_at\n           )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Float8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e6f2a6fa47bf3b5c774d6bc6060ca5a99addffab3dd44529ce9f40de115b0a3c"
+}
diff --git a/backend/.sqlx/query-ea397add5eb6555457883e5b6bdc67efbe6b0559adb891dba65d8b8e1430f357.json b/backend/.sqlx/query-ea397add5eb6555457883e5b6bdc67efbe6b0559adb891dba65d8b8e1430f357.json
new file mode 100644
index 0000000000..5d0e560ced
--- /dev/null
+++ b/backend/.sqlx/query-ea397add5eb6555457883e5b6bdc67efbe6b0559adb891dba65d8b8e1430f357.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COALESCE(jc.status::text, 'running') as \"status!\"\n           FROM unnest($1::uuid[]) AS run(id)\n           LEFT JOIN v2_job_completed jc ON jc.id = run.id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "status!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "ea397add5eb6555457883e5b6bdc67efbe6b0559adb891dba65d8b8e1430f357"
+}
diff --git a/backend/.sqlx/query-f1282393a95b499f1a9fce5939205879d507b9697eed7e5e232f8e6cb95c2bd0.json b/backend/.sqlx/query-f1282393a95b499f1a9fce5939205879d507b9697eed7e5e232f8e6cb95c2bd0.json
new file mode 100644
index 0000000000..7020c21b0d
--- /dev/null
+++ b/backend/.sqlx/query-f1282393a95b499f1a9fce5939205879d507b9697eed7e5e232f8e6cb95c2bd0.json
@@ -0,0 +1,19 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO git_sync_synced_head\n            (workspace_id, repo_resource_path, branch, sha, source, job_id)\n         VALUES ($1, $2, $3, $4, $5, $6)\n         ON CONFLICT (workspace_id, repo_resource_path, branch, sha)\n         DO UPDATE SET source = EXCLUDED.source, job_id = EXCLUDED.job_id, synced_at = now()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f1282393a95b499f1a9fce5939205879d507b9697eed7e5e232f8e6cb95c2bd0"
+}
diff --git a/backend/.sqlx/query-f6a2a8fbc22c69fd5da86626372f84d0ec7b6cb9375e30b10415605cba9b2fcb.json b/backend/.sqlx/query-f6a2a8fbc22c69fd5da86626372f84d0ec7b6cb9375e30b10415605cba9b2fcb.json
new file mode 100644
index 0000000000..dda976de02
--- /dev/null
+++ b/backend/.sqlx/query-f6a2a8fbc22c69fd5da86626372f84d0ec7b6cb9375e30b10415605cba9b2fcb.json
@@ -0,0 +1,66 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT repo_url, check_run_id, poster_workspace_id, conclusion,\n                  created_at, concluded, github_posted, head_ref\n           FROM git_sync_ci_test_check\n           WHERE workspace_id = $1 AND repo_resource_path = $3 AND head_sha = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "repo_url",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "check_run_id",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "poster_workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "conclusion",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "concluded",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 6,
+        "name": "github_posted",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 7,
+        "name": "head_ref",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true,
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "f6a2a8fbc22c69fd5da86626372f84d0ec7b6cb9375e30b10415605cba9b2fcb"
+}
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 665ac56988..a1a358c4e4 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15727,6 +15727,7 @@ dependencies = [
  "tracing",
  "uuid",
  "windmill-common",
+ "windmill-dep-map",
  "windmill-queue",
 ]
 
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index cdd93efb54..9f9388b41a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-be7262ca144933128cc7924e418c88ffe4e5a6ef
+a4da009a5eae72bd55f34de41ba7929b53d53c9b
diff --git a/backend/migrations/20260714142042_add_git_sync_ci_test_check.down.sql b/backend/migrations/20260714142042_add_git_sync_ci_test_check.down.sql
new file mode 100644
index 0000000000..b21e2bb474
--- /dev/null
+++ b/backend/migrations/20260714142042_add_git_sync_ci_test_check.down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS git_sync_ci_test_check;
diff --git a/backend/migrations/20260714142042_add_git_sync_ci_test_check.up.sql b/backend/migrations/20260714142042_add_git_sync_ci_test_check.up.sql
new file mode 100644
index 0000000000..59fabb890c
--- /dev/null
+++ b/backend/migrations/20260714142042_add_git_sync_ci_test_check.up.sql
@@ -0,0 +1,39 @@
+-- One "Windmill CI tests" GitHub check run per (fork workspace, repository, PR head commit):
+-- the pull_request webhook opens the check in_progress and it is concluded once
+-- the fork's CI tests settle, so the results can gate a GitHub PR.
+CREATE TABLE git_sync_ci_test_check (
+    -- The fork workspace whose CI tests gate the PR: keys the row, and its `ci_test`
+    -- jobs are what the check reflects.
+    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE,
+    head_sha VARCHAR(64) NOT NULL,
+    -- The PR's head branch: the check waits until the fork's synced state for this
+    -- branch (written by its pushes and pulls alike) names `head_sha`.
+    head_ref VARCHAR(255) NOT NULL,
+    -- The workspace whose git host credential posts the check: the one that received
+    -- the pull request webhook (the parent owning the repo hook).
+    poster_workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE,
+    repo_url TEXT NOT NULL,
+    -- The fork's copy of the repository resource: keys the synced-head lookup, since a
+    -- fork syncing two repositories names its branch identically in both.
+    repo_resource_path VARCHAR(255) NOT NULL,
+    -- NULL when the GitHub check-run creation failed; the poller retries the create.
+    check_run_id BIGINT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    concluded BOOLEAN NOT NULL DEFAULT false,
+    conclusion TEXT,
+    concluded_at TIMESTAMPTZ,
+    -- Decoupled from `concluded` so a failed check-run PATCH is retried by the
+    -- poller instead of hanging a required check on GitHub.
+    github_posted BOOLEAN NOT NULL DEFAULT false,
+    PRIMARY KEY (workspace_id, repo_resource_path, head_sha)
+);
+
+-- Rows still needing action (create retry, conclusion, timeout, delivery retry).
+-- A row drops out only once it is both concluded and delivered to GitHub, so the
+-- per-job conclusion hook and the poller sweeper both scan a small live set.
+CREATE INDEX idx_git_sync_ci_test_check_pending
+    ON git_sync_ci_test_check (workspace_id)
+    WHERE NOT concluded OR NOT github_posted;
+
+GRANT ALL ON git_sync_ci_test_check TO windmill_user;
+GRANT ALL ON git_sync_ci_test_check TO windmill_admin;
diff --git a/backend/migrations/20260909092950_add_git_sync_synced_head.down.sql b/backend/migrations/20260909092950_add_git_sync_synced_head.down.sql
new file mode 100644
index 0000000000..a089085444
--- /dev/null
+++ b/backend/migrations/20260909092950_add_git_sync_synced_head.down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS git_sync_synced_head;
diff --git a/backend/migrations/20260909092950_add_git_sync_synced_head.up.sql b/backend/migrations/20260909092950_add_git_sync_synced_head.up.sql
new file mode 100644
index 0000000000..a0c81d2671
--- /dev/null
+++ b/backend/migrations/20260909092950_add_git_sync_synced_head.up.sql
@@ -0,0 +1,24 @@
+-- One row per commit a workspace has come to reflect on a branch, written when a
+-- pull of that commit succeeds or a deploy push produces it. The "Windmill CI
+-- tests" PR check reads it to know when a workspace reflects a PR head, and
+-- records the head's CI test runs on it. Kept apart from `workspace_settings.git_sync.auto_pull.last_synced_sha`,
+-- which decides whether the next poll pulls and is client-round-tripped settings.
+CREATE TABLE git_sync_synced_head (
+    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE,
+    -- Repository resource path without its `$res:` prefix.
+    repo_resource_path VARCHAR(255) NOT NULL,
+    branch VARCHAR(255) NOT NULL,
+    sha VARCHAR(64) NOT NULL,
+    -- 'pull' rows name the pull job; 'push' rows the deploy push job.
+    source VARCHAR(4) NOT NULL CHECK (source IN ('pull', 'push')),
+    job_id UUID,
+    synced_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    -- The head's own CI test suite, dispatched once the workspace reflects it and its
+    -- dependency jobs settled: the "Windmill CI tests" check reads exactly these runs.
+    tests_dispatched_at TIMESTAMPTZ,
+    ci_test_job_ids UUID[],
+    PRIMARY KEY (workspace_id, repo_resource_path, branch, sha)
+);
+
+GRANT ALL ON git_sync_synced_head TO windmill_user;
+GRANT ALL ON git_sync_synced_head TO windmill_admin;
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 81571bc942..dc8072d684 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -4711,6 +4711,14 @@ pub async fn poll_git_auto_pull(db: &Pool<Postgres>) {
     {
         tracing::error!("git auto-pull: advisory unlock failed: {e:#}");
     }
+
+    // Backstop for the "Windmill CI tests" checks: retry a failed GitHub create or
+    // delivery, conclude checks whose tests settled, time out stuck ones, prune old
+    // rows. Detached and outside the advisory lock: its writes are guarded (claimed
+    // conclude, greatest-id upsert), it is single-flight, and its GitHub calls must not
+    // count against the monitor pass's budget.
+    let db = db.clone();
+    tokio::spawn(async move { windmill_git_sync::sweep_ci_test_checks(&db).await });
 }
 
 #[cfg(feature = "private")]
diff --git a/backend/summarized_schema.txt b/backend/summarized_schema.txt
index df3e6ddbf8..41dd70ca93 100644
--- a/backend/summarized_schema.txt
+++ b/backend/summarized_schema.txt
@@ -113,6 +113,11 @@ folder: name(char), workspace_id(char), display_name(char), owners(char), extra_
 folder_permission_history: id(bigint), workspace_id(char), folder_name(char), changed_by(char), changed_at(ts), change_type(char), affected(char)
   FK: (workspace_id, folder_name) -> folder(workspace_id, name)
 gcp_trigger: gcp_resource_path(char), topic_id(char), subscription_id(char), delivery_type(delivery_mode), delivery_config(jsonb), path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), subscription_mode(gcp_subscription_mode), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), auto_acknowledge_msg(bool), ack_deadline(int), mode(trigger_mode), labels(text[])
+git_sync_ci_test_check: workspace_id(char), head_sha(char), head_ref(char), poster_workspace_id(char), repo_url(text), repo_resource_path(char), check_run_id(bigint), created_at(timestamptz), concluded(bool), conclusion(text), concluded_at(timestamptz), github_posted(bool)
+  FK: (workspace_id) -> workspace(id)
+  FK: (poster_workspace_id) -> workspace(id)
+git_sync_synced_head: workspace_id(char), repo_resource_path(char), branch(char), sha(char), source(char), job_id(uuid), synced_at(timestamptz), tests_dispatched_at(timestamptz), ci_test_job_ids(uuid[])
+  FK: (workspace_id) -> workspace(id)
 global_settings: name(char), value(jsonb), updated_at(ts)
 guest_activity: email(char), workspace_id(char), day(date), last_seen_at(timestamptz), jwt_entry(bool)
 group_: workspace_id(char), name(char), summary(text), extra_perms(jsonb)
diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index d985078e71..2093ac5fec 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -827,6 +827,29 @@ async fn create_flow(
         WebhookMessage::CreateFlow { workspace: w_id.clone(), path: nf.path.clone() },
     );
 
+    // Trigger CI tests for items that reference this flow
+    {
+        let db2 = db.clone();
+        let w_id2 = w_id.clone();
+        let flow_path2 = nf.path.clone();
+        let email2 = authed.email.clone();
+        let username2 = authed.username.clone();
+        tokio::spawn(async move {
+            if let Err(e) = windmill_dep_map::ci_tests::trigger_ci_tests_for_item(
+                &db2,
+                &w_id2,
+                &flow_path2,
+                "flow",
+                &email2,
+                &username2,
+            )
+            .await
+            {
+                tracing::error!(%e, "error triggering CI tests after flow creation");
+            }
+        });
+    }
+
     Ok((StatusCode::CREATED, nf.path.to_string()))
 }
 
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index 45c8695585..ad040c5905 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -191,7 +191,7 @@ pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28958/sync-script-to-git-repo
 /// ignores the slug, so the slug is kept free of characters that would be
 /// percent-encoded into the run URL (a `:` becomes `%3A`, which some hardened
 /// reverse proxies reject as double-encoding when the client re-encodes it).
-pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28948/git-sync-init-repository-windmill";
+pub const GIT_SYNC_PULL_SCRIPT_PATH: &str = "hub/28957/git-sync-init-repository-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.
@@ -559,9 +559,10 @@ impl AutoPullSettings {
     /// Whether a freshly observed `(git_ref, head_sha)` warrants enqueuing a pull.
     ///
     /// A trigger (poll or webhook) is only a hint: we pull when auto-pull is
-    /// enabled and the observed head differs from the last sha we synced for
-    /// that ref. Re-observing the same head (e.g. a redundant poll, or the
-    /// commit our own deploy callback just pushed back) is a no-op.
+    /// enabled and the observed head differs from the last sha we pulled for
+    /// that ref. Re-observing the same head (a redundant poll) is a no-op. A
+    /// commit our own deploy pushed is not: pushes never write here, so the pull
+    /// it triggers picks up anything pushed under it.
     pub fn should_pull(&self, git_ref: &str, head_sha: &str) -> bool {
         self.enabled && self.last_synced_sha.get(git_ref).map(String::as_str) != Some(head_sha)
     }
diff --git a/backend/windmill-dep-map/src/ci_tests.rs b/backend/windmill-dep-map/src/ci_tests.rs
index 79f1b7e30b..8f56111b35 100644
--- a/backend/windmill-dep-map/src/ci_tests.rs
+++ b/backend/windmill-dep-map/src/ci_tests.rs
@@ -19,3 +19,13 @@ pub async fn trigger_ci_tests_for_item(
 ) -> error::Result<Vec<Uuid>> {
     Ok(vec![])
 }
+
+#[cfg(not(feature = "private"))]
+pub async fn trigger_all_ci_tests(
+    _db: &sqlx::Pool<sqlx::Postgres>,
+    _w_id: &str,
+    _email: &str,
+    _username: &str,
+) -> error::Result<Vec<Uuid>> {
+    Ok(vec![])
+}
diff --git a/backend/windmill-git-sync/Cargo.toml b/backend/windmill-git-sync/Cargo.toml
index 148746dcca..f74581ba67 100644
--- a/backend/windmill-git-sync/Cargo.toml
+++ b/backend/windmill-git-sync/Cargo.toml
@@ -9,7 +9,7 @@ name = "windmill_git_sync"
 path = "./src/lib.rs"
 
 [features]
-private = ["windmill-common/private"]
+private = ["windmill-common/private", "windmill-dep-map/private"]
 enterprise = ["windmill-queue/enterprise", "windmill-common/enterprise"]
 all_sqlx_features = ["enterprise"]
 default = []
@@ -22,5 +22,6 @@ serde_json.workspace = true
 tracing.workspace = true
 windmill-common = { workspace = true, default-features = false }
 windmill-queue.workspace = true
+windmill-dep-map.workspace = true
 regex = "1.10.3"
 tokio = { workspace = true, features = ["full"] }
\ No newline at end of file
diff --git a/backend/windmill-git-sync/src/lib.rs b/backend/windmill-git-sync/src/lib.rs
index ccb14e9028..d65e230988 100644
--- a/backend/windmill-git-sync/src/lib.rs
+++ b/backend/windmill-git-sync/src/lib.rs
@@ -17,7 +17,16 @@ pub use git_sync_ee::{
     clear_auto_pull_failure, enqueue_git_pull_dry_run, enqueue_git_pull_job,
     handle_deployment_metadata, handle_deployment_metadata_batch, handle_fork_branch_creation,
     persist_auto_pull_state, reconcile_and_enqueue_pull, reconcile_fork_branch_pull,
-    record_auto_pull_failure, tally_deployed_object_changes,
+    record_auto_pull_failure, record_synced_head, sweep_ci_test_checks,
+    tally_deployed_object_changes,
+};
+
+// The CI-test check exists only on enterprise builds; `private` alone (the CE image)
+// compiles git_sync_ee without them.
+#[cfg(all(feature = "private", feature = "enterprise"))]
+pub use git_sync_ee::{
+    ensure_ci_test_check_for_pr, evaluate_and_conclude_ci_test_checks,
+    post_ci_test_check_not_applicable, resolve_pr_head_workspace,
 };
 
 #[cfg(not(feature = "private"))]
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 72513d2d63..126cf97106 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -1297,9 +1297,26 @@ async fn create_resource(
 
     webhook.send_message(
         w_id.clone(),
-        WebhookMessage::CreateResource { workspace: w_id, path: resource.path.clone() },
+        WebhookMessage::CreateResource { workspace: w_id.clone(), path: resource.path.clone() },
     );
 
+    // Trigger CI tests for items that reference this resource
+    {
+        let db2 = db.clone();
+        let path2 = resource.path.clone();
+        let email2 = authed.email.clone();
+        let username2 = authed.username.clone();
+        tokio::spawn(async move {
+            if let Err(e) = windmill_dep_map::ci_tests::trigger_ci_tests_for_item(
+                &db2, &w_id, &path2, "resource", &email2, &username2,
+            )
+            .await
+            {
+                tracing::error!(%e, "error triggering CI tests after resource creation");
+            }
+        });
+    }
+
     Ok((
         StatusCode::CREATED,
         format!("resource {} created", resource.path),
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index fd4f08f5fb..21b83b32ff 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -983,19 +983,21 @@ mod git_sync_check_tests {
     }
 }
 
-/// When an auto-pull job (carrying `__git_sync_auto_pull`) fails, roll the
+/// When an auto-pull job (carrying `__git_sync_auto_pull`) completes: on success,
+/// record the commit as a head the workspace reflects; on failure, roll the
 /// optimistic `last_synced_sha` advance back to the pre-pull value so the commit
 /// is retried instead of being silently treated as synced, and record the failure.
+/// The recorded commit is the one the pull script reports having checked out
+/// (`{sha, branch}` in its result): the branch can move between the observation
+/// the marker holds and the clone. A result without it falls back to the marker.
 #[cfg(all(feature = "enterprise", feature = "private"))]
 async fn maybe_reconcile_git_sync_auto_pull(
     db: &DB,
     job_id: &uuid::Uuid,
     workspace_id: &str,
     success: bool,
+    result: &str,
 ) {
-    if success {
-        return; // the optimistic synced state is already correct
-    }
     let marker: Option<serde_json::Value> = match sqlx::query_scalar!(
         "SELECT args->'__git_sync_auto_pull' FROM v2_job WHERE id = $1",
         job_id
@@ -1015,12 +1017,50 @@ async fn maybe_reconcile_git_sync_auto_pull(
     #[derive(serde::Deserialize)]
     struct AutoPullMarker {
         repo_resource_path: String,
+        branch: Option<String>,
+        head_sha: Option<String>,
         #[serde(default)]
         prev_synced: std::collections::HashMap<String, String>,
     }
     let Ok(m) = serde_json::from_value::<AutoPullMarker>(marker) else {
         return;
     };
+    if success {
+        // The optimistic synced state is already correct; record that the workspace
+        // now reflects the commit, which the PR CI-test check waits for.
+        #[derive(serde::Deserialize)]
+        struct PullResult {
+            sha: Option<String>,
+            branch: Option<String>,
+        }
+        let applied = serde_json::from_str::<PullResult>(result).ok();
+        let branch = applied
+            .as_ref()
+            .and_then(|r| r.branch.as_deref())
+            .or(m.branch.as_deref());
+        let sha = applied
+            .as_ref()
+            .and_then(|r| r.sha.as_deref())
+            .or(m.head_sha.as_deref());
+        if let (Some(branch), Some(sha)) = (branch, sha) {
+            if let Err(e) = windmill_git_sync::record_synced_head(
+                db,
+                workspace_id,
+                &m.repo_resource_path,
+                branch,
+                sha,
+                "pull",
+                Some(*job_id),
+            )
+            .await
+            {
+                tracing::warn!(
+                    "git auto-pull: failed to record synced head {sha} on {branch}: {e:#}"
+                );
+            }
+        }
+        return;
+    }
     windmill_git_sync::record_auto_pull_failure(
         db,
         workspace_id,
@@ -1109,6 +1149,70 @@ fn git_sync_push_result_pushed(result: &str) -> Option<bool> {
         .as_bool()
 }
 
+/// When a git-sync push job pushed a commit, record it as a head the workspace
+/// reflects, the way a successful pull records the commit it applied. The PR
+/// CI-test check waits for that record. Best-effort: failures are logged, never
+/// propagated.
+#[cfg(all(feature = "enterprise", feature = "private"))]
+async fn maybe_record_git_sync_pushed_head(
+    db: &DB,
+    job_id: &uuid::Uuid,
+    workspace_id: &str,
+    result: &str,
+) {
+    #[derive(serde::Deserialize)]
+    struct PushResult {
+        pushed: bool,
+        sha: Option<String>,
+        branch: Option<String>,
+        #[serde(default)]
+        rebased: bool,
+    }
+    let Ok(PushResult { pushed: true, sha: Some(sha), branch: Some(branch), rebased }) =
+        serde_json::from_str::<PushResult>(result)
+    else {
+        return;
+    };
+    // A push that had to rebase sits on commits this workspace has not pulled, so the
+    // pushed head is not something it reflects yet; the pull those commits trigger
+    // records the head once they are in.
+    if rebased {
+        tracing::info!(
+            "git sync push: {sha} on {branch} was rebased onto unpulled commits; not recording it as synced for {workspace_id}"
+        );
+        return;
+    }
+    let repo_path = match sqlx::query_scalar!(
+        "SELECT args->>'repo_url_resource_path' FROM v2_job WHERE id = $1",
+        job_id
+    )
+    .fetch_optional(db)
+    .await
+    {
+        Ok(Some(Some(p))) => p,
+        Ok(_) => return,
+        Err(e) => {
+            tracing::error!("git sync push: failed to read job args: {e:#}");
+            return;
+        }
+    };
+    if let Err(e) = windmill_git_sync::record_synced_head(
+        db,
+        workspace_id,
+        &repo_path,
+        &branch,
+        &sha,
+        "push",
+        Some(*job_id),
+    )
+    .await
+    {
+        tracing::warn!(
+            "git sync push: failed to record pushed head {sha} on {branch} for {workspace_id}/{repo_path}: {e:#}"
+        );
+    }
+}
+
 /// When a git-sync push job carrying `__git_sync_open_pr` succeeds, open (or
 /// reopen) the PR for the branch it pushed: `wm-fork/<base>/<id>` for a fork
 /// deploy, `wm_deploy/**` for a promotion deploy. Runs outbound with the
@@ -1707,8 +1811,26 @@ pub async fn process_completed_job(
         #[cfg(all(feature = "enterprise", feature = "private"))]
         if job.kind == JobKind::DeploymentCallback {
             maybe_post_git_sync_check(db, &job_id, &workspace_id, true, result.get()).await;
+            maybe_reconcile_git_sync_auto_pull(db, &job_id, &workspace_id, true, result.get())
+                .await;
+            maybe_record_git_sync_pushed_head(db, &job_id, &workspace_id, result.get()).await;
             maybe_open_git_sync_deploy_pr(db, &job_id, &workspace_id, result.get()).await;
         }
+        // A CI test job just finished: advance any open "Windmill CI tests" PR check for
+        // its workspace. Detached, since concluding a check calls GitHub and this loop
+        // completes jobs serially; the evaluation is idempotent and the poller retries.
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        if job
+            .trigger_kind
+            .as_ref()
+            .is_some_and(|k| k.is(windmill_common::jobs::JobTriggerKind::CiTest))
+        {
+            let db = db.clone();
+            let w_id = workspace_id.clone();
+            tokio::spawn(async move {
+                windmill_git_sync::evaluate_and_conclude_ci_test_checks(&db, &w_id).await
+            });
+        }
 
         // Asset-trigger fan-out: best-effort, never propagates errors.
         // Internal eligibility checks gate to top-level Script/Preview runs;
@@ -1819,7 +1941,20 @@ pub async fn process_completed_job(
         #[cfg(all(feature = "enterprise", feature = "private"))]
         if job.kind == JobKind::DeploymentCallback {
             maybe_post_git_sync_check(db, &job.id, &job.workspace_id, false, result.get()).await;
-            maybe_reconcile_git_sync_auto_pull(db, &job.id, &job.workspace_id, false).await;
+            maybe_reconcile_git_sync_auto_pull(db, &job.id, &job.workspace_id, false, "").await;
+        }
+        // A failed CI test job also settles its check; same detached advance as on success.
+        #[cfg(all(feature = "enterprise", feature = "private"))]
+        if job
+            .trigger_kind
+            .as_ref()
+            .is_some_and(|k| k.is(windmill_common::jobs::JobTriggerKind::CiTest))
+        {
+            let db = db.clone();
+            let w_id = job.workspace_id.clone();
+            tokio::spawn(async move {
+                windmill_git_sync::evaluate_and_conclude_ci_test_checks(&db, &w_id).await
+            });
         }
         if job.is_flow_step() {
             if let Some(parent_job) = job.parent_job {
diff --git a/docs/git-sync-pull-design.md b/docs/git-sync-pull-design.md
index 8961b0f047..5f77a3f117 100644
--- a/docs/git-sync-pull-design.md
+++ b/docs/git-sync-pull-design.md
@@ -618,6 +618,93 @@ repo's **Environments** timeline ("Production → Deployed"). Needs
 opt-in / later. The check-run version is the cheap default and matches the visual
 Cloudflare parity without a new permission.
 
+### Phase 7 — CI test results check (WIN-2051) — implemented
+
+Surfaces Windmill's own CI tests (the `// test: script/...` annotation) as a
+**"Windmill CI tests"** check run on **any PR** against the tracked branch, so a customer
+can mark it a **required status check** and have Windmill CI results gate the PR —
+replacing the documented GitHub Action that polls `ci_test_results_batch`. GitHub App-backed
+only; reuses the Phase 4 `Checks: write` grant, so no new permission. Token repos keep the
+Action, and GitLab merge requests get no CI-test surface for the same reason the Phase 4
+preview lives in a note there (a commit status would fail the project's own pipeline).
+
+Driven by the **`pull_request` webhook** — the same event Phase 4 already reacts to —
+rather than the deploy push/pull, so it's uniform across how the PR's commit came to exist
+(a fork deploy that pushes `wm-fork/**` and opens the PR, or an external push that gets
+pulled in). CI tests run as separate async `ci_test` jobs in the **fork workspace** the PR
+corresponds to; the check reflects that fork's current results on the PR head.
+
+- **State** — `git_sync_ci_test_check(workspace_id, repo_resource_path, head_sha)` (new
+  table). `workspace_id` is the **fork** whose `ci_test` jobs the check reflects;
+  `repo_resource_path` the repository (a fork can sync several, and two can hold the same
+  commit); `poster_workspace_id` is the **parent** whose GitHub-App installation posts the
+  run (the workspace that received the webhook and owns the repo hook). Plus `repo_url`,
+  `head_ref`, `check_run_id` (NULL until the create succeeds, and reset to NULL by a re-fired event
+  for the same head: the row is written first so a create that never gets recorded cannot
+  strand an in-progress run, and the poller retries any row without an id), `created_at`,
+  `concluded`, `conclusion`, `concluded_at`, `github_posted`.
+  Partial index `(workspace_id) WHERE NOT concluded OR NOT github_posted` (the live set the
+  hook + poller scan).
+- **Open** — in the `pull_request` handler (opened/synchronize/reopened, or edited with a
+  base change, base = tracked): when the head lives in the base repo, resolve the fork
+  workspace from the head ref (reusing the fork-branch routing;
+  `resolve_pr_head_workspace`), persist the intent row with a null check-run id, then
+  `create_check_run` in_progress on `head_sha` via the parent's installation and adopt the
+  id (the poller retries the create from the row if it failed), then evaluate. An earlier head's open check is left to conclude on its
+  own (fork verdict or timeout): a late-delivered event for an old head must never touch
+  the current head's check.
+- **Conclude** — the verdict is the head's own suite. Once the fork reflects the head (below)
+  and its dependency jobs settled, every CI test the fork declares is dispatched once, one
+  run per `ci_test_reference` row the way a deploy of that item would (`trigger_all_ci_tests`,
+  as the fork's owner, the user who created it, with no more reach than they have; a
+  missing or disabled owner concludes the check as failure; and without the per-item
+  debounce so a deploy-triggered run of the same test cannot supersede a suite run), and the job ids are
+  recorded on the synced-head row (`ci_test_job_ids`; `tests_dispatched_at` claims the
+  dispatch so the per-job hook and the poller queue it once, and a claim that never recorded
+  ids is retaken after 5 min). The verdict is exactly those runs: fail-fast on any
+  failed/canceled; `success` once all settle ("No CI tests" when the fork declares none);
+  `skipped` ignored. Nothing older, newer or workspace-wide stands in
+  for a head's runs, so a re-fired event reads the same runs and gets the same answer, a
+  test-only change is run because the suite runs on every head, and a deploy in flight in
+  the fork cannot feed another head's check. Runs purged by job retention reset the row so
+  the head is re-tested.
+- **Readiness** — the suite is dispatched only once the fork reflects the head, so it does
+  not matter which webhook GitHub delivers first. The evidence is `git_sync_synced_head`: the
+  pull completion hook writes a row when a pull job succeeds (the pull script reports the
+  commit its clone checked out; the enqueue-time marker is the fallback), and the push
+  completion hook writes one from the deploy push script's `{pushed, sha, branch, rebased}`
+  result (a rebased push sits on unpulled commits and is not recorded). The head is ready
+  when the repository branch's newest row names it, so a branch reset to an older commit
+  waits for its re-pull; the prune keeps each repository branch's newest row so a PR reopened
+  at an unchanged head stays ready. This is a sync event log, deliberately apart from
+  `auto_pull.last_synced_sha`: that map decides whether the next poll pulls (a push must
+  never write it, or a commit someone else pushed under ours would be skipped) and it is
+  client-round-tripped settings. The check row stores `head_ref` for the lookup. Dispatch
+  also waits while a dependency job in the fork or a pull of the repository branch is queued
+  (a deploy push lands on whatever the remote held when it cloned, so a commit pushed there
+  from outside is in the workspace only once its pull ran), and the check fails outright if
+  a dependency job failed after the head's pull started (the item deployed nothing
+  runnable). A commit the fork never comes to reflect times out; a timeout on a repository
+  pinned to a sync script older than the one that reports pushed commits names that as the
+  reason. Needs the hub script versions that report the sha (`LATEST_GIT_SYNC_SCRIPT_PATH`,
+  `GIT_SYNC_PULL_SCRIPT_PATH`).
+- **Drivers** — a per-`ci_test`-job completion hook (low latency) and the git-sync poller
+  (the backstop: retries the GitHub create/deliver, times stuck checks out after 30 min,
+  prunes old rows; runs after the auto-pull advisory lock is released so its GitHub calls
+  never extend the tick). Both call one idempotent `evaluate_and_conclude`, which claims the
+  decision with a guarded `UPDATE ... WHERE NOT concluded RETURNING` (exactly-once) and
+  decouples GitHub delivery via `github_posted` so a failed PATCH is retried, not hung.
+
+Invariants: only a head in the base repo can map to a workspace (a contributor fork's
+branch names mean nothing here); the webhook's workspace posts through its own
+installation; the timeout stops a hung test job from blocking a required check forever;
+rows cascade away with either workspace. A plain feature-branch or
+contributor-fork PR resolves to no fork workspace and gets an already-concluded `skipped`
+check (branch protection counts `skipped` as passing, so requiring the check does not block
+those PRs). A timeout on a repository pinned to a sync script older than the one that reports
+pushed commits names that as the reason. Known limit (accepted for v1): the fork's status is workspace-wide (all its
+tested items), which for the one-fork-per-PR model equals the PR's scope.
+
 ## 16. Alternatives considered
 
 **Portal as webhook proxy (the rejected "option 2").** Subscribe the managed app
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index 515f57ea01..4b4bff2168 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -949,7 +949,7 @@
 										options={{
 											right: 'Automatically deploy changes from Git',
 											rightTooltip:
-												'Windmill deploys new commits from the tracked branch into this workspace. Repositories Windmill holds a credential for sync instantly via webhooks with a polling fallback; other token-based repositories are checked about every minute.'
+												'Windmill deploys new commits from the tracked branch into this workspace. Repositories Windmill holds a credential for sync instantly via webhooks with a polling fallback; other token-based repositories are checked about every minute. The webhook also delivers pull request events, which is what posts the diff check on pull requests and, for GitHub repositories, the Windmill CI tests check.'
 										}}
 										on:change={(e) => setAutoPullEnabled(e.detail)}
 									>
@@ -964,7 +964,7 @@
 											options={{
 												right: 'Automatically sync forks with git branches',
 												rightTooltip: repo.auto_pull?.enabled
-													? "When a fork's wm-fork/** branch changes in the repository (for example after merging the tracked branch into it), Windmill deploys those commits into the fork workspace. Configured once here, applied to every fork of this workspace."
+													? "When a fork's wm-fork/** branch changes in the repository (for example after merging the tracked branch into it), Windmill deploys those commits into the fork workspace. On GitHub, needed for the Windmill CI tests check on a fork pull request whose commits were pushed outside Windmill. Configured once here, applied to every fork of this workspace."
 													: 'Requires automatic deploy from Git to be enabled above.'
 											}}
 											on:change={(e) => setSyncForks(e.detail)}
diff --git a/frontend/src/lib/hubPaths.json b/frontend/src/lib/hubPaths.json
index 7439ad7ada..dfa0be57c1 100644
--- a/frontend/src/lib/hubPaths.json
+++ b/frontend/src/lib/hubPaths.json
@@ -1,6 +1,6 @@
 {
 	"gitSyncTest": "hub/28950/git-repo-test-read-write-windmill",
-	"gitInitRepo": "hub/28948/git-sync-init-repository-windmill",
+	"gitInitRepo": "hub/28957/git-sync-init-repository-windmill",
 	"slackErrorHandler": "hub/28794/workspace-or-schedule-error-handler-slack",
 	"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
 	"slackRecoveryHandler": "hub/28791/slack/schedule-recovery-handler-slack",