From 5e301f2bb9d6e70c5aebb30b83217ac07b794025 Mon Sep 17 00:00:00 2001
From: Sal <59910950+ss-o@users.noreply.github.com>
Date: Fri, 24 Jul 2026 09:28:27 +0100
Subject: [PATCH] chore(next): promote fixes to main (#179)

Promotes next to main: #176's zi-identity/checksum fix and #178 (renovate.json baseBranches, main-branch-guard workflow).
---
 .github/workflows/main-branch-guard.yml | 30 +++++++++++++++++++++++++
 renovate.json                           |  3 ++-
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/main-branch-guard.yml

diff --git a/.github/workflows/main-branch-guard.yml b/.github/workflows/main-branch-guard.yml
new file mode 100644
index 0000000..4f1468e
--- /dev/null
+++ b/.github/workflows/main-branch-guard.yml
@@ -0,0 +1,30 @@
+---
+name: Main Branch Source Guard
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize, edited]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  guard:
+    name: Guard main branch source
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify pull request source branch
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [[ "${HEAD_REF}" == "next" || "${HEAD_REF}" == hotfix-* ]]; then
+            echo "Head branch '${HEAD_REF}' is allowed to target main."
+            exit 0
+          fi
+          echo "::error::Pull requests into main must come from 'next' or a 'hotfix-*' branch (got '${HEAD_REF}'). See ADR-0008 (z-shell/.github) for the branching model."
+          exit 1
diff --git a/renovate.json b/renovate.json
index fc1528e..c9dc506 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,5 +4,6 @@
     "local>z-shell/.github:renovate-config",
     ":dependencyDashboardApproval",
     ":disableVulnerabilityAlerts"
-  ]
+  ],
+  "baseBranches": ["next"]
 }