From a5e4becefa51d8a6ccf8bf3987b4a546e49b3332 Mon Sep 17 00:00:00 2001
From: Chideraozigbo <chideraozigbo@gmail.com>
Date: Mon, 24 Aug 2026 07:07:55 +0100
Subject: [PATCH] ci: release via tags only (no push to main)

Stop pushing chore(release) commits to main so branch protection no longer blocks releases. Bump version in the runner, commit locally, and push only the annotated tag.
---
 .github/workflows/publish.yml | 5 +++--
 RELEASING.md                  | 4 +++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a53f03e..33162a1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,7 +1,7 @@
 name: Publish
 
 # On important source changes to main: auto-bump patch version + CHANGELOG,
-# commit chore(release), tag, and publish. Skip with [skip release].
+# bump version in-runner, tag (no push to main — branch protection), publish. Skip with [skip release].
 on:
   workflow_dispatch:
   push:
@@ -99,8 +99,9 @@ jobs:
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add pyproject.toml src/praxicraft/__init__.py CHANGELOG.md
           if ! git diff --cached --quiet; then
+            # Local commit only — do not push to main (rules require PRs).
+            # Pushing the annotated tag keeps this release commit reachable.
             git commit -m "chore(release): ${TAG}"
-            git push origin HEAD:main
           fi
           {
             echo "version=${VERSION}"
diff --git a/RELEASING.md b/RELEASING.md
index 45fd80e..930a6d5 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -53,6 +53,8 @@ You can run **Actions → Publish → Run workflow** manually (`workflow_dispatc
 
 ## Auto-bump
 
-Pushes to `main` that change package source auto-bump the patch version, update `CHANGELOG.md`, commit `chore(release): vX.Y.Z`, tag, create a **GitHub Release**, and publish to the language registry when credentials are configured.
+Pushes to `main` that change package source auto-bump the patch version and `CHANGELOG.md` in the runner, create a local `chore(release)` commit, and **push only the annotated tag** (not `main` — branch protection requires PRs). The tag retains the release commit. Then CI creates a **GitHub Release** and publishes to the language registry when credentials are configured.
+
+Version files on `main` may lag until a follow-up PR syncs them; published artifacts always use the tagged version.
 
 Skip with `[skip release]` in the commit message.