claude: update CONTRIBUTING.md to also mention that only PRs are allowed, never direct pushes or merges by the bot

2026-08-23 15:10:43 +00:00
2 changed files with 8 additions and 7 deletions
@@ -31,10 +31,3 @@ jobs:
          IMAGE="${{ vars.REGISTRY_HOST }}/${{ gitea.repository }}/claude-agent:latest"
          docker build -t "$IMAGE" ./agent
          docker push "$IMAGE"
      - name: Trigger Portainer redeploy
        # Deliberately NOT a separate Gitea repo webhook firing in parallel on the same
        # push — that raced with this build and could redeploy before the new image was
        # actually pushed, silently keeping the old code running. Chaining it here as the
        # last step guarantees the image exists before Portainer goes to pull it.
        run: curl -f -X POST "${{ secrets.PORTAINER_WEBHOOK_URL }}"
@@ -0,0 +1,8 @@
 # Contributing
 - Changes land via pull request — no direct pushes to `main`. Branch protection enforces
  this (see README.md, "Branch protection on `main`").
 - This applies to the Claude bot too: it only ever opens PRs, never pushes or merges
  directly. `claude-bot`'s account is deliberately excluded from the merge whitelist, so a
  human always reviews and merges.
 - Open a PR against `main` and wait for review before merging.