From 6b0f4453b828612247d02525e0b3aa989386f377 Mon Sep 17 00:00:00 2001 From: Hector Rodriguez Date: Sat, 12 Sep 2026 13:27:37 -0400 Subject: [PATCH] Document topic-branch PRs into develop (match pgwd/gghstats) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rulesets protect-develop and protect-main already require PRs; align AGENTS, CONTRIBUTING, and CHANGELOG with that flow and main→develop sync. Co-authored-by: Cursor --- AGENTS.md | 6 ++++++ CHANGELOG.md | 4 ++++ CONTRIBUTING.md | 6 +++--- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 69daad5..34f0d03 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -20,6 +20,12 @@ This repository is the **GROOT product**: CLI, collector engine, behavior contra For Helm, in-cluster CronJob, `docker run` with kubeconfig, and standalone scheduling, link to **[groot-selfhosted](https://github.com/hrodrig/groot-selfhosted)** (`run/README.md`). On-demand collect: **[groot-trigger](https://github.com/hrodrig/groot-trigger)**. VPS archive door: **[groot-share](https://github.com/hrodrig/groot-share)**; gfs deploy: **[groot-share-selfhosted](https://github.com/hrodrig/groot-share-selfhosted)**. +## Git flow + +- Work on **topic branches** opened from `develop`; merge via **PR into `develop`**. **Never** commit or push directly to `develop` or `main`. +- Release: **PR `develop` → `main`**, then annotated tag on `main` (GoReleaser). After every merge into `main`, sync **`main` → `develop`** (see `.cursor/rules/git-flow.mdc`). +- Do not merge to `main` or push a release tag without explicit operator approval in the current conversation. + ## Language English only for all project artifacts. diff --git a/CHANGELOG.md b/CHANGELOG.md index d0b3391..7d38a77 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- Branch policy matches pgwd / gghstats: topic branch → PR into `develop`; no direct push to `develop` or `main`. After `develop` → `main`, sync `main` into `develop` so the next release PR is not out-of-date. + ### Security - **Dependencies:** bump `google.golang.org/grpc` to **v1.83.2** (Dependabot [#7](https://github.com/hrodrig/groot/pull/7) / gRPC 1.83.x security fixes; transitive via GCS client — groot does not expose a gRPC server) and `golang.org/x/crypto` to **v0.56.0** (**GO-2026-6354** / **GO-2026-6355** — DoS in `crypto/ssh`; used by SFTP upload). diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 841231a..524c872 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,9 +10,9 @@ Thanks for helping improve GROOT. ## How to contribute - **Bugs and ideas:** Open an [issue](https://github.com/hrodrig/groot/issues). Describe what you expected, what happened, and how to reproduce (commands, config snippets, cluster context if relevant). -- **Code:** Open a pull request **against `develop`**. `main` is release-only; day-to-day work merges into `develop` first (see project git flow). - -Use focused branches, for example `fix/short-topic` or `feat/short-topic`. +- **Code:** From an up-to-date `develop`, create a **topic branch** (`feat/…`, `fix/…`, `chore/…`, `security/…`, `docs/…`), push it, and open a pull request **into `develop`**. Wait for green CI, then merge. +- **Branch policy:** `develop` is integration; `main` is stable releases. **No direct push** to `develop` or `main` (GitHub rulesets `protect-develop` / `protect-main` — same pattern as [pgwd](https://github.com/hrodrig/pgwd) / [gghstats](https://github.com/hrodrig/gghstats)). +- **Release:** PR **`develop` → `main`**, then annotated tag `vX.Y.Z` on `main`. After every merge into `main`, sync **`main` → `develop`** so the next release PR is not **"out-of-date with the base branch"**. ## Planning docs (SPEC, ROADMAP, CHANGELOG)