From 5ac788cc2679c825d1941e0068067786808e9b22 Mon Sep 17 00:00:00 2001
From: barrulus <b@rry.im>
Date: Tue, 9 Jun 2026 21:37:04 +0100
Subject: [PATCH] ci(bump-version): skip push on protected main instead of
 failing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bump-on-merge workflow only ever targets main (its sole trigger is
PRs into main), which is a protected branch — the github-actions bot
cannot push directly, so the 'Commit and push bump' step failed on every
merge. Gate the push: when the base branch is main, log a notice and exit
0 instead of attempting a rejected push. Pushes to unprotected branches
are unchanged. Also move base.ref into a quoted env var (BASE_REF).
---
 .github/workflows/bump-version.yml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index bd17c973b7..db5bd44a57 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -63,6 +63,8 @@ jobs:
             --base-version ${{ steps.base.outputs.version }}
 
       - name: Commit and push bump
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
         run: |
           NEW_VERSION=$(node -e "
             const m = require('fs')
@@ -78,10 +80,19 @@ jobs:
           git add public/versioning.js package.json package-lock.json src/index.html
           git add public/ 2>/dev/null || true
 
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: bump version to $NEW_VERSION"
-            git push origin HEAD:${{ github.event.pull_request.base.ref }}
-            echo "Pushed version bump → $NEW_VERSION"
-          else
+          if git diff --cached --quiet; then
             echo "Nothing changed, skipping commit."
+            exit 0
+          fi
+
+          # main is a protected branch: direct pushes are rejected (the bot
+          # cannot bypass required PRs/status checks). Skip the push instead of
+          # failing the job. Bumps to unprotected branches still push normally.
+          if [ "$BASE_REF" = "main" ]; then
+            echo "::notice::main is protected — skipping push of version bump → $NEW_VERSION"
+            exit 0
           fi
+
+          git commit -m "chore: bump version to $NEW_VERSION"
+          git push origin HEAD:"$BASE_REF"
+          echo "Pushed version bump → $NEW_VERSION"