I think that's orthogonal to testing/ci/hooks and depends on what you're building and what stage you're at. Personally I would not run anything with real users without PRs and branch protection.

My `codex` design session landed on opening GitHub PRs and labeling some with `automerge` that we're comfortable landing on main after GH also verifies the checks.