claude: update CONTRIBUTING.md to also mention that only PRs are allowed, never direct pushes or merges by the bot

2026-08-23 15:10:43 +00:00
2 changed files with 8 additions and 7 deletions
@@ -31,10 +31,3 @@ jobs:
          IMAGE="${{ vars.REGISTRY_HOST }}/${{ gitea.repository }}/claude-agent:latest"
          docker build -t "$IMAGE" ./agent
          docker push "$IMAGE"
-
-      - name: Trigger Portainer redeploy
-        # Deliberately NOT a separate Gitea repo webhook firing in parallel on the same
-        # push — that raced with this build and could redeploy before the new image was
-        # actually pushed, silently keeping the old code running. Chaining it here as the
-        # last step guarantees the image exists before Portainer goes to pull it.
-        run: curl -f -X POST "${{ secrets.PORTAINER_WEBHOOK_URL }}"
@@ -0,0 +1,8 @@
+# Contributing
+
+- Changes land via pull request — no direct pushes to `main`. Branch protection enforces
+  this (see README.md, "Branch protection on `main`").
+- This applies to the Claude bot too: it only ever opens PRs, never pushes or merges
+  directly. `claude-bot`'s account is deliberately excluded from the merge whitelist, so a
+  human always reviews and merges.
+- Open a PR against `main` and wait for review before merging.