From 2e8a8f26baefb12eecffc50c8b15f0128a9eb726 Mon Sep 17 00:00:00 2001
From: Vector <vector@openclaw.local>
Date: Mon, 2 Mar 2026 06:34:58 -0500
Subject: [PATCH] chore(release): align docker namespace + add release notes
 draft

---
 .github/workflows/release.yml |  1 +
 RELEASE_NOTES.md              | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+)
 create mode 100644 RELEASE_NOTES.md

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 78e8166..a941308 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
 
 permissions:
   contents: write
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
new file mode 100644
index 0000000..2c17bcd
--- /dev/null
+++ b/RELEASE_NOTES.md
@@ -0,0 +1,25 @@
+# Release Notes (Draft)
+
+## Unreleased
+
+### Infrastructure & Publishing
+- Added GitHub Actions repository secrets required for Docker publishing:
+  - `DOCKERHUB_USERNAME`
+  - `DOCKERHUB_TOKEN`
+  - `DOCKERHUB_NAMESPACE`
+- Docker Hub org namespace is now `phoenixsecdev` with repository `phoenixsecdev/phoenix`.
+- Updated release workflow Docker image target from `phoenixsec/phoenix` to `phoenixsecdev/phoenix`.
+- Added `workflow_dispatch` trigger to `release.yml` so releases can be run manually for verification.
+
+### Repository Security
+- Enabled branch protection on `main`:
+  - Pull request required before merge
+  - 1 required approval
+  - Dismiss stale reviews on new commits
+  - Require conversation resolution
+  - Force-push disabled
+  - Branch deletion disabled
+  - Admins are enforced
+
+### Notes
+- Deploy keys are disabled by org/repo policy, so push auth was set up using a personal GitHub SSH key instead.