ci: make develop the integration branch instead of feature/rust

.github/workflows/CI.yml

@@ -2,9 +2,9 @@ name: CI Map2Check Rust
 
 on:
   push:
-    branches: [ "master", "feature/rust", "feat/update_rust" ]
+    branches: [ "master", "develop", "release/**" ]
   pull_request:
-    branches: [ "master", "feature/rust", "feat/update_rust" ]
+    branches: [ "master", "develop", "release/**" ]
 
 jobs:
   build_and_test:

CHANGELOG.md

@@ -24,6 +24,13 @@ the C ABI or the JSON report must update them.
   `scripts/package-release.sh` builds the release archive with the C
   header, both static libraries and the docs (#5).
 
+### Changed
+
+- `develop` replaces `feature/rust` as the integration branch: CI runs on
+  pushes and pull requests to `master`, `develop` and `release/**`, and
+  `scripts/branch-protection.sh` protects `develop` instead of
+  `feature/rust`.
+
 ## [1.0.0-rc1] - Unreleased
 
 First release candidate of the Rust rewrite (milestones M1–M3).

README.md

@@ -86,11 +86,11 @@ cargo deny check
 
 ### Proteção de branches
 
-`feature/rust` e `master` exigem o check `build_and_test` (workflow "CI Map2Check Rust") e commits assinados; `master` exige também 1 review. A configuração está em `scripts/branch-protection.sh`:
+Fluxo: `develop` é a branch padrão do repositório. Branches de trabalho `<tipo>/issue-<N>-<slug>` (`tipo` ∈ feat, fix, docs, test, build, ci, chore) abrem PR para `develop`; releases sobem de `develop` para `master` por PR. `develop` e `master` exigem o check `build_and_test` (workflow "CI Map2Check Rust") e commits assinados; `master` exige também 1 review. A configuração está em `scripts/branch-protection.sh`:
 
 ```sh
-scripts/branch-protection.sh check feature/rust   # compara com o GitHub (exit 0/1)
-scripts/branch-protection.sh apply master         # requer permissão de admin
+scripts/branch-protection.sh check develop   # compara com o GitHub (exit 0/1)
+scripts/branch-protection.sh apply master    # requer permissão de admin
 ```
 
 Se o job `build_and_test` for renomeado, atualize `CI_CHECK` no script na mesma mudança; caso contrário, todo PR fica bloqueado esperando um check que nunca chega.

docs/release.md

@@ -26,7 +26,7 @@ that symbol in the program, linking the `libfuzzer` library fails with
 
 ## Steps
 
-1. **Version.** On a branch off `feature/rust`, set `version` in
+1. **Version.** On a branch off `develop`, set `version` in
    `Cargo.toml` and the `org.opencontainers.image.version` label in
    `Dockerfile`. `tests/header_version.rs` fails if they disagree.
 2. **Changelog.** Move the `[Unreleased]` entries into a new
@@ -36,8 +36,9 @@ that symbol in the program, linking the `libfuzzer` library fails with
    `docs/semantic-deltas.md` reflect every ABI or behaviour change since
    the last release. `cargo test --all-features --test compat_docs` must
    pass.
-4. **Pull request.** Open a PR to `feature/rust` (or `master` after the
-   promotion) and merge it once `build_and_test` is green.
+4. **Pull request.** Open a PR to `develop` and merge it once
+   `build_and_test` is green, then open a PR from `develop` to `master`
+   (1 review required).
 5. **Package.** On the merged commit, run:
 
    ```sh

scripts/branch-protection.sh

@@ -11,15 +11,15 @@ REPO="${REPO:-hbgit/map2check-library}"
 CI_CHECK="${CI_CHECK:-build_and_test}"
 CI_APP_ID="${CI_APP_ID:-15368}"
 
-usage() { echo "uso: $0 {payload|check|apply|encode} {feature/rust|master}" >&2; exit 2; }
+usage() { echo "uso: $0 {payload|check|apply|encode} {develop|master}" >&2; exit 2; }
 need()  { command -v "$1" >/dev/null || { echo "erro: '$1' não encontrado" >&2; exit 2; }; }
 
 encode() { jq -rn --arg b "$1" '$b|@uri'; }
 
 payload() {
   local reviews
   case "$1" in
-    feature/rust) reviews='null' ;;
+    develop) reviews='null' ;;
     master)       reviews='{"dismiss_stale_reviews":false,"require_code_owner_reviews":false,"required_approving_review_count":1}' ;;
     *) echo "erro: branch sem proteção definida: $1" >&2; exit 2 ;;
   esac

scripts/test-branch-protection.sh

@@ -11,29 +11,44 @@ bad() { echo "FAIL - $1"; fail=1; }
 t()   { local name="$1"; shift; if "$@" >/dev/null 2>&1; then ok "$name"; else bad "$name"; fi; }
 
 # Codificação de nomes com barra (Review Focus 2)
-t "encode feature/rust"  test "$("$BP" encode feature/rust)" = "feature%2Frust"
-t "encode master"        test "$("$BP" encode master)" = "master"
-
-# feature/rust: check obrigatório, sem review, sem force push/deleção
-fr="$("$BP" payload feature/rust 2>/dev/null || true)"
-t "fr: check build_and_test (app 15368)" jq -e '.required_status_checks.checks == [{"context":"build_and_test","app_id":15368}]' <<<"$fr"
-t "fr: strict false"          jq -e '.required_status_checks.strict == false' <<<"$fr"
-t "fr: sem review"            jq -e '.required_pull_request_reviews == null' <<<"$fr"
-t "fr: enforce_admins false"  jq -e '.enforce_admins == false' <<<"$fr"
-t "fr: sem force push"        jq -e '.allow_force_pushes == false and .allow_deletions == false' <<<"$fr"
-t "fr: restrictions null"     jq -e 'has("restrictions") and .restrictions == null' <<<"$fr"
+t "encode release/1.0" test "$("$BP" encode release/1.0)" = "release%2F1.0"
+t "encode develop"     test "$("$BP" encode develop)" = "develop"
+t "encode master"      test "$("$BP" encode master)" = "master"
+
+# develop (integração): check obrigatório, sem review, sem force push/deleção
+dv="$("$BP" payload develop 2>/dev/null || true)"
+t "develop: check build_and_test (app 15368)" jq -e '.required_status_checks.checks == [{"context":"build_and_test","app_id":15368}]' <<<"$dv"
+t "develop: strict false"          jq -e '.required_status_checks.strict == false' <<<"$dv"
+t "develop: sem review"            jq -e '.required_pull_request_reviews == null' <<<"$dv"
+t "develop: enforce_admins false"  jq -e '.enforce_admins == false' <<<"$dv"
+t "develop: sem force push"        jq -e '.allow_force_pushes == false and .allow_deletions == false' <<<"$dv"
+t "develop: restrictions null"     jq -e 'has("restrictions") and .restrictions == null' <<<"$dv"
+
 
 # master: mesmo check e preserva 1 review (Review Focus 1)
 ms="$("$BP" payload master 2>/dev/null || true)"
 t "master: check build_and_test" jq -e '.required_status_checks.checks == [{"context":"build_and_test","app_id":15368}]' <<<"$ms"
 t "master: 1 review preservado"  jq -e '.required_pull_request_reviews.required_approving_review_count == 1' <<<"$ms"
 t "master: enforce_admins false" jq -e '.enforce_admins == false' <<<"$ms"
 
-# Branch desconhecida e subcomando inválido falham (Review Focus 5)
-t "branch desconhecida -> exit 2" bash -c '"$0" payload develop; test $? -eq 2' "$BP"
-t "subcomando inválido -> exit 2" bash -c '"$0" frobnicate master; test $? -eq 2' "$BP"
+# Branch desconhecida (inclui a antiga integração) e subcomando inválido falham (Review Focus 5)
+t "feature/rust aposentada -> exit 2" bash -c '"$0" payload feature/rust; test $? -eq 2' "$BP"
+t "branch desconhecida -> exit 2"     bash -c '"$0" payload feat/x; test $? -eq 2' "$BP"
+t "subcomando inválido -> exit 2"     bash -c '"$0" frobnicate master; test $? -eq 2' "$BP"
 
 # O check obrigatório existe como job no CI (Review Focus 3)
 t "CI.yml tem job build_and_test" grep -qE '^  build_and_test:' "$ROOT/.github/workflows/CI.yml"
 
+# CI dispara em push e PR para as branches protegidas; senão o check nunca chega
+for ev in push pull_request; do
+  t "CI.yml: $ev cobre develop e master" bash -c \
+    'sed -n "/^  $1:/,/branches:/p" "$0" | grep "branches:" | grep -q "\"develop\"" &&
+     sed -n "/^  $1:/,/branches:/p" "$0" | grep "branches:" | grep -q "\"master\""' \
+    "$ROOT/.github/workflows/CI.yml" "$ev"
+  t "CI.yml: $ev não cita feature/rust" bash -c \
+    '! sed -n "/^  $1:/,/branches:/p" "$0" | grep -q "feature/rust"' \
+    "$ROOT/.github/workflows/CI.yml" "$ev"
+done
+
+
 exit "$fail"