PRs now required for contributions

[StevenClontz]

@oscarlevin - I just screwed up and committed a hack to main. To avoid this happening again, I've made a PR required before merging into main. So even hotfixes need to go on a branch, then merged via PR. If this is obnoxious, let's discuss.

[oscarlevin]

I did this yesterday too. The problem is that our actions commit to main to update the version number. I don't know if there is a way to exclude those.

[StevenClontz]

https://cli.github.com/manual/gh_pr_create

https://cli.github.com/manual/gh_pr_merge

I think rather than pushing to main, we could use these commands with the GitHub CLI to make the actions bot go through the PR workflow. Since we're not requiring reviews this should be fine (and if we do later, there's an --admin flag that should override the requirement).

[oscarlevin]

I found a custom action that allows pushing to a protected branch. Seems to be working. So we are all good.

[oscarlevin]

I've updated the actions to use the gh pr commands. While at it, the deploy-stable action will create a "release" on github automatically whenever there is a non-patch update.