Merge pull request #236 from Gnathonic/fix/pr-target-guard-permissions

fix(ci): grant PR-guard write perms, run CI on develop

Author: Gnathonic

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 
 jobs:
   lint:
@@ -98,7 +98,8 @@ jobs:
   release-check:
     name: Release Check
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
+    # Only relevant for release PRs (develop -> main); skip on PRs into develop.
+    if: github.event_name == 'pull_request' && github.base_ref == 'main'
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/pr-target-guard.yml

@@ -4,11 +4,16 @@ on:
   pull_request_target:
     types: [opened, reopened, synchronize]
 
+permissions:
+  pull-requests: write
+  contents: read
+
 jobs:
-  # Block any PR to main that doesn't come from develop
+  # Block any PR to main that doesn't come from develop (non-fork branches only;
+  # forks are handled by redirect-forks below to avoid a duplicate message).
   require-develop-to-main:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.ref != 'develop'
+    if: github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.ref != 'develop' && !github.event.pull_request.head.repo.fork
     steps:
       - name: Block non-develop PRs to main
         run: |