From a0eaad9df3612023d20a250ffa2953a0c92ab851 Mon Sep 17 00:00:00 2001
From: Lev Gelfenbuim <hi@lev.engineer>
Date: Sun, 25 Oct 2026 11:50:29 +0200
Subject: [PATCH] ci: retarget non-release PRs from main to develop, test PRs
 into develop

main should only receive release PRs from develop. Add a
pull_request_target workflow that retargets any other PR opened
against main to develop and leaves a comment. It never checks out
PR code, so it is safe for fork PRs.

Also run the test workflow on PRs into develop, which until now got
no CI at all (Renovate PRs, and contributor PRs once retargeted).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-base-guard.yml | 27 +++++++++++++++++++++++++++
 .github/workflows/test.yml          |  2 +-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/pr-base-guard.yml

diff --git a/.github/workflows/pr-base-guard.yml b/.github/workflows/pr-base-guard.yml
new file mode 100644
index 00000000..53eaef56
--- /dev/null
+++ b/.github/workflows/pr-base-guard.yml
@@ -0,0 +1,27 @@
+name: PR Base Guard
+
+# main only receives release PRs from develop. Any other PR opened
+# against main is retargeted to develop. Uses pull_request_target so
+# it can edit fork PRs; it never checks out or runs PR code.
+on:
+  pull_request_target:
+    types: [opened, reopened, edited]
+    branches: [main]
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  retarget:
+    if: github.event.pull_request.head.repo.full_name != github.repository || github.event.pull_request.head.ref != 'develop'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Retarget PR to develop
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          gh api -X PATCH "repos/$REPO/pulls/$PR" -f base=develop > /dev/null
+          gh api "repos/$REPO/issues/$PR/comments" -f body="Thanks for the PR! \`main\` only receives releases from \`develop\`, so I've retargeted this to \`develop\`. If GitHub reports conflicts, please rebase onto \`develop\`." > /dev/null
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b5d46fea..b49dfe51 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 
 jobs:
   test: