🔧 Fix beta-release pushing to main instead of develop

[sergak01]

Summary

• 🔧 Fixes the "Beta Release" workflow trying (and failing) to push a version-bump commit directly to the protected main branch instead of develop

Root cause

The Beta Release workflow moved from on: push to on: workflow_run (workflows: [CI]) in 034e504 so releases only happen after CI passes. That introduced a regression: for a workflow_run event, GITHUB_REF is the ref of the workflow file (the repo's default branch, main) rather than the branch that triggered the run (develop) — even though the job's checkout step explicitly checks out develop's commit via github.event.workflow_run.head_sha.

semantic-release's CI-environment detection (env-ci's GitHub Actions provider) determines the release branch purely from GITHUB_REF:

const branch = parseBranch(env.GITHUB_REF);

So every run since 034e504 has silently believed it was releasing from main, computed a stable version instead of a develop beta prerelease, and tried to push straight to main:

[semantic-release] › ✔  Run automated release from branch main on repository ...
...
remote: error: GH006: Protected branch update failed for refs/heads/main.
remote: - Changes must be made through a pull request.

This stayed latent because there was no successful push-triggered CI run on develop between 034e504 (2026-08-08) and today — develop's own CI was blocked by the (now separately fixed) extract-zip audit gate. The first two times a develop CI run actually succeeded today, this surfaced.

The fix

Force GITHUB_REF (and GITHUB_REF_NAME) to develop in the "Release Beta" step's env:. The job's if: guard already restricts both trigger paths (workflow_run and workflow_dispatch) to develop, so this is always correct — it just corrects what env-ci sees.

Testing

• Confirmed via the failing run logs (Run automated release from branch main, git push --tags ... HEAD:main, GH006) that this is the exact failure mode.
• YAML validated to parse correctly.
• Can't fully dry-run semantic-release's git push locally against branch protection; recommend watching the next Beta Release run after this merges to confirm it now logs "Run automated release from branch develop" and pushes/tags against develop.

---

Merge Request: origin/fix/beta-release-branch-detection → origin/develop

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eb0a29f2-5090-4df4-bd01-a1e2f6d2709f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}