From f058d44361bf0b6d2b4f2e9393b7416d9d7f3efa Mon Sep 17 00:00:00 2001
From: acossta <nico@braingrid.ai>
Date: Fri, 25 Sep 2026 09:05:12 -0700
Subject: [PATCH] dev is the integration branch: dependabot and spec-sync
 target dev, CI runs on dev pushes, contributors open PRs against dev

---
 .github/dependabot.yml          |  2 ++
 .github/workflows/ci.yml        |  2 +-
 .github/workflows/spec-sync.yml |  3 +++
 CONTRIBUTING.md                 | 13 +++++++++----
 4 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e5eb5f7..120e06f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -2,6 +2,7 @@ version: 2
 updates:
   - package-ecosystem: npm
     directory: /
+    target-branch: dev
     schedule:
       interval: weekly
     groups:
@@ -9,5 +10,6 @@ updates:
         dependency-type: development
   - package-ecosystem: github-actions
     directory: /
+    target-branch: dev
     schedule:
       interval: monthly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8bbd31b..9af6968 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
   pull_request:
 
 permissions:
diff --git a/.github/workflows/spec-sync.yml b/.github/workflows/spec-sync.yml
index efbe8e1..1dbaffc 100644
--- a/.github/workflows/spec-sync.yml
+++ b/.github/workflows/spec-sync.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: dev
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -27,6 +29,7 @@ jobs:
       - run: pnpm typecheck && pnpm test
       - uses: peter-evans/create-pull-request@v7
         with:
+          base: dev
           branch: chore/sync-v3-spec
           commit-message: "Sync v3 catalog with Origami's published spec"
           title: "Sync v3 catalog with Origami's published spec"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4986a7f..3c55fed 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -13,6 +13,11 @@ pnpm dev -- send campaigns list --help    # run from source
 
 Node.js 18+ and pnpm 10 (`corepack enable` picks the pinned version).
 
+## Branches
+
+Open pull requests against **`dev`**. `main` holds released code only and is protected: it
+changes through a `dev` → `main` pull request at release time.
+
 ## Before you open a pull request
 
 ```bash
@@ -55,10 +60,10 @@ hand-written command next to the generated ones; keep those rare.
 
 ## Releasing (maintainers)
 
-1. Bump `version` in `package.json` and add a `CHANGELOG.md` entry.
-2. Merge to `main`.
-3. Publish a GitHub release tagged `vX.Y.Z`. The release workflow publishes to npm with
-   provenance.
+1. On `dev`: bump `version` in `package.json` and add a `CHANGELOG.md` entry.
+2. Open a `dev` → `main` pull request; merge it once CI is green.
+3. Publish a GitHub release tagged `vX.Y.Z` on `main`. The release workflow publishes to npm
+   with provenance.
 
 By contributing you agree that your contributions are licensed under the [MIT License](LICENSE)
 and that you'll follow the [Code of Conduct](CODE_OF_CONDUCT.md).