docs(readme): the version-bump PR-only gap is closed by the main branch ruleset

[dsnger]

README described invariant 12's PR-only scope as an open hole: "a commit pushed
straight to main is never version-bump checked." That stopped being true on
2026-07-19, when a branch ruleset started rejecting direct pushes to main.

The checker's scope is unchanged — it still runs on pull_request only. What
changed is that the bypass it left open is now unreachable, so the sentence
described a risk this repo no longer carries.

Verified before writing (AGENTS.md Don't #3 — never describe what a gate proves
without checking what it compares):

• ruleset protect-main. (id 19168350), enforcement: active, created
  2026-07-19T12:42+02:00, targets ~DEFAULT_BRANCH
• rules: pull_request, required_status_checks -> context quality,
  non_fast_forward
• bypass_actors: [], current_user_can_bypass: "never" — hence "admins included"
• .github/workflows/ci.yml:97 puts the version-bump step inside the quality
  job, so the required check actually carries invariant 12

Prose-only (README.md), so no Gate B per CLAUDE.md §5. The hook fired its
loose-direction STOP anyway — the redundant reminder invariant 2 accepts by name.

Not changed, deliberately — see the PR discussion: the same claim appears in
AGENTS.md, scripts/check-version-bump.sh, ci.yml and the plugin CHANGELOG,
where it is still literally true (it describes the checker, not the repo).

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

@dsnger, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e889a898-21ad-4fab-9aae-b005191f67dc

📥 Commits

Reviewing files that changed from the base of the PR and between 2c18d6a and 90f13ac.

📒 Files selected for processing (1)

• README.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR updates the Contributing section of README.md to reflect that the previously-documented bypass path — pushing directly to main and skipping the version-bump check — is no longer reachable. A GitHub branch ruleset (protect-main., active since 2026-07-19) now requires a PR and a green quality check to land anything on main, and the version-bump step lives inside that quality job.

• The old text accurately described the checker's PR-only scope but left an implied open hole; the new text replaces that with a concrete explanation of why the hole is closed.
• All factual claims in the updated prose are consistent with ci.yml (job named quality at line 19; version-bump step at line 97); the existing ci.yml comment at line 92 that says "a commit pushed straight to main bypasses this check" was deliberately left unchanged because it describes the checker's design, not the repo's overall protection.

Confidence Score: 5/5

Safe to merge — prose-only change with no executable code modified.

The update removes a sentence that described an open bypass and replaces it with an accurate explanation of the branch ruleset. The quality job name and the version-bump step location (line 97 of ci.yml) both match what the new text claims. The deliberate non-update of the ci.yml comment is well-reasoned and called out in the PR description.

No files require special attention.

Important Files Changed

Filename	Overview
README.md	Docs-only update: replaces the open-hole warning about direct pushes bypassing the version-bump check with an accurate explanation of the branch ruleset that closes that gap. All factual claims verified against ci.yml (quality job, version-bump step at line 97).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Developer change] --> B{How is it submitted?}
    B -->|Direct push to main| C[Branch ruleset: protect-main.]
    C --> D[REJECTED — no bypass actors]
    B -->|Pull Request| E[CI: quality job runs]
    E --> F[shellcheck, test suites, check-invariants.sh]
    E --> G[check-version-bump.sh — invariant 12]
    E --> H[claude plugin validate]
    F & G & H --> I{All checks green?}
    I -->|No| J[PR cannot merge]
    I -->|Yes| K[quality check required by ruleset]
    K --> L[PR merges to main]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Developer change] --> B{How is it submitted?}
    B -->|Direct push to main| C[Branch ruleset: protect-main.]
    C --> D[REJECTED — no bypass actors]
    B -->|Pull Request| E[CI: quality job runs]
    E --> F[shellcheck, test suites, check-invariants.sh]
    E --> G[check-version-bump.sh — invariant 12]
    E --> H[claude plugin validate]
    F & G & H --> I{All checks green?}
    I -->|No| J[PR cannot merge]
    I -->|Yes| K[quality check required by ruleset]
    K --> L[PR merges to main]

Loading

_{Reviews (1): Last reviewed commit: "docs(readme): the version-bump PR-only g..." | Re-trigger Greptile}