From 1114eac892cb5eac4dc1003945f960c5913a93a6 Mon Sep 17 00:00:00 2001
From: Sall <ss-o@users.noreply.github.com>
Date: Fri, 24 Jul 2026 09:09:16 +0100
Subject: [PATCH] chore: point renovate.json at next, add main-branch guard

Same root cause found and fixed in z-shell/zsh-eza this session:
renovate.json had no baseBranches override, so Renovate defaulted to
main, bypassing next the same way several past PRs (#171, #150-156)
did. dependabot.yml was already fixed for this in #172; this brings
Renovate in line with it and ADR-0008 (z-shell/.github).

Also adds a required-status-check workflow that fails a PR targeting
main unless its head branch is next or matches hotfix-*.

Closes #177
---
 .github/workflows/main-branch-guard.yml | 30 +++++++++++++++++++++++++
 renovate.json                           |  3 ++-
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/main-branch-guard.yml

diff --git a/.github/workflows/main-branch-guard.yml b/.github/workflows/main-branch-guard.yml
new file mode 100644
index 0000000..4f1468e
--- /dev/null
+++ b/.github/workflows/main-branch-guard.yml
@@ -0,0 +1,30 @@
+---
+name: Main Branch Source Guard
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize, edited]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  guard:
+    name: Guard main branch source
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify pull request source branch
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [[ "${HEAD_REF}" == "next" || "${HEAD_REF}" == hotfix-* ]]; then
+            echo "Head branch '${HEAD_REF}' is allowed to target main."
+            exit 0
+          fi
+          echo "::error::Pull requests into main must come from 'next' or a 'hotfix-*' branch (got '${HEAD_REF}'). See ADR-0008 (z-shell/.github) for the branching model."
+          exit 1
diff --git a/renovate.json b/renovate.json
index fc1528e..c9dc506 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,5 +4,6 @@
     "local>z-shell/.github:renovate-config",
     ":dependencyDashboardApproval",
     ":disableVulnerabilityAlerts"
-  ]
+  ],
+  "baseBranches": ["next"]
 }