Continuous Integration with Github Actions and Azure Devops

.github/workflows/ci.yml

@@ -18,8 +18,9 @@ name: ci
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
+    branches: [develop]
 
 jobs:
   ci:

.pre-commit-config.yaml

@@ -39,11 +39,6 @@ repos:
     -   id: detect-private-key
     -   id: fix-byte-order-marker
     -   id: mixed-line-ending
-    -   id: no-commit-to-branch
-        # Block direct commits to the mainline; changes must go through a
-        # branch + PR. Protects `main` and `master` by default; both are
-        # listed explicitly so the policy is obvious and rename-proof.
-        args: [--branch, main, --branch, master]
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.1  # Specify the desired version of Gitleaks
     hooks:

README.md

@@ -75,9 +75,7 @@ Run `make help` (or just `make`) to list the available targets.
   large-file guard (blocks files over 500 kB by default), case-conflict
   detection (catches filename collisions on case-insensitive filesystems like
   macOS/Windows), illegal Windows names, merge-conflict markers, private-key
-  detection, byte-order-marker fix, mixed line endings, and a
-  **direct-commit guard** (`no-commit-to-branch`) that blocks committing
-  straight to `main`/`master` so changes go through a branch + PR.
+  detection, byte-order-marker fix, and mixed line endings.
 - **gitleaks**: scans for hardcoded secrets.
 - **commitizen** (`commit-msg` stage): validates commit messages follow the
   Conventional Commits format, e.g.:
@@ -88,24 +86,6 @@ Run `make help` (or just `make`) to list the available targets.
   ```
 - **sync-pre-commit-deps**: keeps hook dependency versions in sync.
 
-> **Note — the direct-commit guard is a local convenience, not enforcement.**
-> `no-commit-to-branch` only runs on machines where the hooks are installed
-> (`make setup`) and can be bypassed with `git commit --no-verify`. It does
-> nothing on the server. For real enforcement, pair it with a server-side
-> branch policy:
->
-> - **GitHub**: a [branch protection rule](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule)
->   (or ruleset) on `main` — require pull requests, block direct pushes, and
->   require the `ci` status check to pass. This can be configured directly in
->   the repository's **Settings → Branches**, and codified as a
->   [ruleset](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets).
-> - **Azure DevOps**: a [branch policy](https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops)
->   on `main` (require a PR, minimum reviewers, build validation). Azure Repos
->   branch policies are **not** stored in the repository — they are
->   project/repo settings applied through the Azure DevOps UI or REST API, so
->   they can't be committed as a file in this template the way a GitHub ruleset
->   can.
-
 ## CI/CD integration
 
 This template is designed so that wiring it into **any** CI/CD platform is
@@ -162,7 +142,13 @@ portable script:
   DevOps needs `azure-pipelines.yml`. The template ships both, pre-wired to
   `make ci`.
 - **Triggers** (which branches/events run CI) — expressed differently on each
-  platform.
+  platform. Both stubs ship pre-configured to run CI on:
+  - **pushes** to `main` and `develop`, and
+  - **pull requests** targeting `develop`.
+
+  Adjust the `on`/`trigger`/`pr` sections in
+  [`.github/workflows/ci.yml`](.github/workflows/ci.yml) and
+  [`azure-pipelines.yml`](azure-pipelines.yml) to change this.
 - **Secrets, service connections, OIDC, and permissions** — managed in each
   platform's settings/YAML, never in the repo.
 - **Runner/agent image** and **prerequisite installation** (Python,

azure-pipelines.yml

@@ -20,11 +20,12 @@ trigger:
   branches:
     include:
       - main
+      - develop
 
 pr:
   branches:
     include:
-      - "*"
+      - develop
 
 pool:
   vmImage: ubuntu-latest