Clerk automation CI must stop merges when a pull request embeds an API key. Which pipeline control does that?

Secrets management in CI includes automated detection gates that fail the build when credential patterns appear in proposed changes, so merges cannot land with embedded API keys. For clerk automation pipelines, a secrets-scanning step that blocks the pull request when it finds a credential pattern is the control that stops a key from riding into mainline history. The correct approach works because once a secret is committed—even briefly—it may be copied to forks, CI logs, backups, and developer clones; failing the pipeline at detection time prevents promotion and forces remediation (rotate the key, purge or rewrite history per policy) before the change merges.

Disabling all checks so clerks can merge Friday afternoon changes faster fails because speed without scanning is how credentials hitch a ride into protected branches; convenience is not a substitute for a merge gate. Posting the key in a public wiki so everyone can reuse it across jobs fails conceptually: publishing credentials expands exposure rather than containing it and converts a CI secret into a shared ambient password. Requiring reviewers to eyeball every diff with no automated secret detection fails because human review alone systematically misses long opaque tokens, base64 blobs, and keys buried in config fixtures—pattern scanners exist precisely for that blind spot.

Exam caveat: scanners produce false positives on example placeholders and test doubles; tune allowlists carefully and never use allowlisting to suppress real production-shaped secrets. Operational check: open a throwaway clerk PR that contains a clearly fake but pattern-matching API key string, confirm the pipeline fails on the secrets scan, then remove the string and confirm the gate clears; document rotation steps if a real key was ever committed.