chore: protect main, document trunk-based branch model - #12
Merged
Conversation
main is now protected by a repository ruleset: no direct pushes, no force-pushes, no deletion, and every change lands through a pull request with green CI. Release-preparation commits go through a PR too, replacing the previous direct-to-main release convention. Store both ruleset payloads under .github/rulesets/ so the protection is reviewable and re-appliable; GitHub does not sync them from the repository automatically. The companion tag ruleset makes published v* tags immutable, since publish-packages.yml builds registry artifacts from the release a tag produces. Drop the unused develop branch from the CI triggers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enforces "no direct push to main" and writes down the branch model.
What changed
.github/rulesets/main-protection.json— PR required (0 approvals, squash/merge), 8 required status checks, blocks deletion and force-push. Already applied as ruleset20996245..github/rulesets/release-tags.json—refs/tags/v*immutable. Already applied as ruleset20996247.CONTRIBUTING.md— branch model, change flow, release-via-PR flow, ruleset apply commands.AGENTS.md— "Branches and pull requests" section.ci.yml— dropped the deleteddevelopbranch from both triggers.Branch model
mainis the only long-lived branch; releases are selected byvX.Y.Ztags, not by branches. Nodevelop/preprod/production— those model a continuously-deployed service, whereas this repo publishes versioned artifacts to crates.io, PyPI, npm, and GitHub Releases, where the tag is the release selector. The staledevelopbranch (0 ahead of main, 18 behind) has been deleted.This supersedes the previous convention of pushing release commits directly to
main.Required status checks
Required:
lint,test,node-api (Node 22),node-api (Node 24),coverage, and the threegolden-cross-platformmatrix legs.Three jobs are deliberately excluded because they cannot gate a PR:
bench-smokeif: github.event_name == 'push'— never runs on a PR, so requiring it would block every PR permanentlysecuritycontinue-on-erroron PRs — always reports success therefidelity-smokecontinue-on-erroron PRs — always reports success thereKnown gap, not addressed here: the existing "advisory on PR, blocking on push to
main" policy now fires only after a merge, since nothing else pushes tomain. Closing it means dropping thosecontinue-on-errorconditions.