From 749f2026ff0866915cf3170f840be37d5db48af6 Mon Sep 17 00:00:00 2001
From: bartzbeielstein <32470350+bartzbeielstein@users.noreply.github.com>
Date: Sun, 7 Jun 2026 19:49:30 +0200
Subject: [PATCH] ci(release): back-merge main into develop after each release

Ports the back-merge job from the spotforecast2/spotforecast2-safe
release workflows. develop silently fell behind main after every
release (0.12.9 lived only on main until a manual fast-forward on
2026-06-07); subsequent PRs from develop would have conflicted on
CHANGELOG.md/pyproject.toml.

Tracked in tbb-skills4agents work item #3 (release-train sync protocol).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 37 +++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d9db2265..e888ef42 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -95,6 +95,43 @@ jobs:
           packages-dir: dist/
           skip-existing: true
 
+  # ── Back-merge main into develop ──────────────────────────────────────
+  # After a release on main, merge main back into develop so that
+  # CHANGELOG.md and pyproject.toml stay in sync (same job as in
+  # spotforecast2/spotforecast2-safe release.yml). Without it, develop
+  # silently falls behind after every release (e.g. 0.12.9 lived only on
+  # main until a manual fast-forward on 2026-06-07).
+  back-merge:
+    name: Sync main into develop
+    runs-on: ubuntu-latest
+    needs: release
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          # Same deploy-key auth as the release job: develop is unprotected,
+          # but the key guarantees push rights independent of token policy.
+          ssh-key: ${{ secrets.DEPLOY_KEY }}
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Merge main into develop
+        run: |
+          git fetch origin
+          git checkout develop
+          # -X theirs: when CHANGELOG.md / pyproject.toml conflict (both were
+          # updated from the same base), keep main's final release version.
+          git merge origin/main -X theirs --no-ff \
+            -m "chore: sync main into develop [skip ci]"
+          git push origin develop
+
   # ── Documentation (reusable workflow, shared with docs.yml) ───────────
   # Builds from `main` rather than the triggering commit: by the time this
   # job starts, semantic-release has already pushed its "chore(release)"