From f0459ffc0d1e73a8467b6c1eb3df7185968c02e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kuty=C5=82a?= <daniel.kutyla@example.com>
Date: Tue, 7 Jul 2026 21:11:16 +0200
Subject: [PATCH 1/2] ci(publish): target release PR at develop, never main

Version bumps land on develop via the release PR and reach main only
through the manual develop -> main promotion. BASE_BRANCH env
(default develop) controls the PR base.
---
 .github/scripts/open-release-pr.mjs | 13 ++++++++++---
 .github/workflows/publish.yml       |  9 ++++++---
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/open-release-pr.mjs b/.github/scripts/open-release-pr.mjs
index 1527653..72cabac 100644
--- a/.github/scripts/open-release-pr.mjs
+++ b/.github/scripts/open-release-pr.mjs
@@ -1,14 +1,20 @@
 #!/usr/bin/env node
-// Open a release PR to main and enable auto-merge — without the gh CLI, which is not
+// Open a release PR and enable auto-merge — without the gh CLI, which is not
 // installed on the self-hosted runner. Uses the REST API to create the PR and the GraphQL
 // API to enable auto-merge. Relies only on Node's global fetch (Node >= 22).
 //
+// The PR targets BASE_BRANCH (default: develop) — the version bump lands on develop
+// first and reaches main through the normal develop -> main promotion, never by a
+// direct push or PR to main.
+//
 // Required env: GH_TOKEN, GITHUB_REPOSITORY (owner/repo), VERSION, RELEASE_BRANCH.
+// Optional env: BASE_BRANCH (default "develop").
 
 const token = process.env.GH_TOKEN;
 const repo = process.env.GITHUB_REPOSITORY;
 const version = process.env.VERSION;
 const branch = process.env.RELEASE_BRANCH;
+const baseBranch = process.env.BASE_BRANCH || 'develop';
 
 for (const [k, v] of Object.entries({ GH_TOKEN: token, GITHUB_REPOSITORY: repo, VERSION: version, RELEASE_BRANCH: branch })) {
   if (!v) {
@@ -45,12 +51,13 @@ async function graphql(query, variables) {
 
 const prBody =
   `Automated version bump for v${version}. Tag \`v${version}\` and the npm publish already ` +
-  `completed; merging this lands the bumped package.json on main.`;
+  `completed; merging this lands the bumped package.json on \`${baseBranch}\`, from where it ` +
+  `is promoted to main through the regular ${baseBranch} -> main merge.`;
 
 // Create the PR — or reuse an existing one for this branch (idempotent on re-run).
 let { status, body } = await rest(`/repos/${owner}/${name}/pulls`, {
   method: 'POST',
-  body: JSON.stringify({ title: `release: v${version}`, head: branch, base: 'main', body: prBody }),
+  body: JSON.stringify({ title: `release: v${version}`, head: branch, base: baseBranch, body: prBody }),
 });
 
 let pr;
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e6cb5de..b35ca80 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -55,7 +55,8 @@ jobs:
           VERSION=$(node -p "require('./package.json').version")
           echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           echo "RELEASE_BRANCH=release/v${VERSION}" >> "$GITHUB_ENV"
-          # main is protected (requires a PR), so commit to a release branch and merge via PR.
+          # Never touch main directly: commit the bump to a release branch; a PR
+          # into develop is opened below, and develop is promoted to main manually.
           git switch -c "release/v${VERSION}"
           git add package.json
           git commit -m "release: v${VERSION}"
@@ -71,13 +72,15 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: Push release branch and tag, open auto-merge PR
+      - name: Push release branch and tag, open auto-merge PR into develop
         if: ${{ inputs.dry-run != true }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BASE_BRANCH: develop
         run: |
           git push origin "${RELEASE_BRANCH}"
           git push origin --tags
           # gh CLI is not installed on the self-hosted runner — open the PR + enable
-          # auto-merge via the GitHub API (Node global fetch) instead.
+          # auto-merge via the GitHub API (Node global fetch) instead. The PR targets
+          # develop; main only receives the bump via the manual develop -> main merge.
           node .github/scripts/open-release-pr.mjs

From 72dd31b5f90b3c2c9d451573a82e6bff517370bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Kuty=C5=82a?= <daniel.kutyla@example.com>
Date: Tue, 7 Jul 2026 21:11:32 +0200
Subject: [PATCH 2/2] release: v0.2.35

Reconcile the repository with npm: 0.2.35 was published by a release
run whose version-bump push to protected main was rejected, leaving
the bump and tag unrecorded.
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 7e8dfdb..ff7eb6e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "devglide",
-  "version": "0.2.18",
+  "version": "0.2.35",
   "description": "AI workflow toolkit with MCP servers for kanban, shell, testing, workflows, and more — built for Claude Code",
   "license": "MIT",
   "author": "Daniel Kutyla",