ci(release): land releases on lightly-protected main (drop PAT)

.github/workflows/release.yml

@@ -22,14 +22,10 @@ jobs:
         with:
           # Full history + tags are required for conventional-changelog.
           fetch-depth: 0
-          # Check out the branch (not the detached tag) so we can commit CHANGELOG.md back.
-          ref: develop
-          # Push back to develop with a PAT, not the default GITHUB_TOKEN: the
-          # `protect-develop` ruleset blocks direct pushes, and the GitHub Actions
-          # bot cannot be a bypass actor on a user-owned repo. A PAT owned by an
-          # admin is attributed to that admin, whom the ruleset's admin bypass
-          # already covers. RELEASE_TOKEN: fine-grained PAT, Contents: read/write.
-          token: ${{ secrets.RELEASE_TOKEN }}
+          # Releases land on main: it is only lightly protected (no PR / status-check
+          # rules), so the default GITHUB_TOKEN can push the CHANGELOG commit directly
+          # — no PAT or bypass actor needed. The strict PR gate lives on develop.
+          ref: main
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
@@ -47,7 +43,7 @@ jobs:
         # Slice out just the newest version section for the GitHub Release body.
         run: awk '/^#{1,3} \[?v?[0-9]+\.[0-9]+/{c++} c==1' CHANGELOG.md > RELEASE_NOTES.md
 
-      - name: Commit CHANGELOG.md back to develop
+      - name: Commit CHANGELOG.md back to main
         run: |
           git config user.name 'github-actions[bot]'
           git config user.email 'github-actions[bot]@users.noreply.github.com'
@@ -56,7 +52,7 @@ jobs:
           else
             git add CHANGELOG.md
             git commit -m "docs: update CHANGELOG for ${{ github.event.inputs.tag || github.ref_name }} [skip ci]"
-            git push origin HEAD:develop
+            git push origin HEAD:main
           fi
 
       - name: Assemble release body

scripts/apply-develop-ruleset.sh

@@ -12,13 +12,9 @@ REPO="NoiXdev/s3Manager"
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 JSON="$DIR/develop-ruleset.json"
 
-# --- GitHub Actions bypass (manual, one-time) -------------------------------
-# The release workflow pushes CHANGELOG.md directly to develop, which the
-# `pull_request` rule blocks. The GitHub Actions bot cannot be added as a
-# bypass actor via the API on a user-owned (non-org) repo, so add it once in
-# the UI after running this script:
-#   Settings -> Rules -> Rulesets -> protect-develop -> Bypass list
-#     -> Add bypass -> GitHub Actions -> mode "Always" -> Save
+# develop is the strict integration branch: PRs + a passing `Lint & Test`
+# check are required. Nothing auto-pushes here — releases land on `main`
+# (see scripts/apply-main-ruleset.sh), so no bypass actor is needed.
 echo "Applying ruleset to $REPO from $JSON ..."
 
 # Create the ruleset (fails if one named 'protect-develop' already exists).

scripts/apply-main-ruleset.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#
+# Apply the branch ruleset that protects `main` (the release branch).
+#
+# main is only lightly protected: it blocks branch deletion and force-pushes
+# and enforces linear history, but does NOT require pull requests or status
+# checks. That lets the release workflow's default GITHUB_TOKEN push the
+# CHANGELOG commit directly (a normal linear fast-forward) with no PAT and no
+# bypass actor — the same model as NoiXdev/inventorix.
+#
+# Usage:  bash scripts/apply-main-ruleset.sh
+#
+set -euo pipefail
+
+REPO="NoiXdev/s3Manager"
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+JSON="$DIR/main-ruleset.json"
+
+echo "Applying ruleset to $REPO from $JSON ..."
+
+# Create the ruleset (fails if one named 'protect-main' already exists).
+gh api -X POST "repos/$REPO/rulesets" --input "$JSON"
+
+echo
+echo "Done. Verify with:"
+echo "  gh api repos/$REPO/rulesets --jq '.[] | {id, name, enforcement}'"

scripts/main-ruleset.json

@@ -0,0 +1,17 @@
+{
+  "name": "protect-main",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    { "type": "required_linear_history" }
+  ]
+}