ci: merge pull requests directly into main and retire dev

.devcontainer/Dockerfile

@@ -23,8 +23,6 @@ FROM moby/buildkit:v0.32.2@sha256:28a898719c18a33f4e8000685287fa36fd0dd9560c6440
 
 FROM mcr.microsoft.com/devcontainers/base:bookworm@sha256:bb7b81b6e5be17b5267f92f4ffda534fea37dab1df97b5e86c1f9b91da5c0b5d
 
-LABEL org.opencontainers.image.source="https://github.com/snapflowio/snapflow"
-
 ARG DEBIAN_FRONTEND=noninteractive
 ARG MOON_VERSION=2.4.6
 ARG CODEX_VERSION=0.145.0

.devcontainer/devcontainer.json

@@ -52,7 +52,6 @@
 		"3002": { "label": "React Email Preview" },
 		"3773": { "label": "T3 Code" },
 		"4321": { "label": "Marketing (Astro)" },
-		"5173": { "label": "Vite Development Server" },
 		"8082": { "label": "Snapflow Edge HTTP Ingress" },
 		"8444": { "label": "Snapflow Edge HTTPS Ingress" },
 		"23000-23031": { "label": "Snapflow Edge Public TCP/UDP Exposures" },

.devcontainer/docker-compose.yml

@@ -18,7 +18,6 @@ services:
     tmpfs:
       - /run:exec,size=256m
     ports:
-      - "127.0.0.1:5173:5173/tcp"
       - "3774:3773/tcp"
       - "127.0.0.1:4443:4443/tcp"
       - "127.0.0.1:4443:4443/udp"

.dockerignore

@@ -4,18 +4,12 @@ node_modules
 **/.pnpm-store
 
 **/dist
-!dist/
-dist/*
-!dist/libs/
-dist/libs/*
-!dist/libs/computer-use-amd64
 
 .vite
 **/.vite
 .svelte-kit
 **/.svelte-kit
 .moon/cache
-.moon/docker
 logs
 *.log
 
@@ -51,7 +45,6 @@ tmp
 *.tmp
 
 *.md
-docs
 assets
 
 **/*.test.ts

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,8 +13,8 @@
 
 ## Checklist
 
-- [ ] PR targets `dev` (`main` only takes promotions from `dev`)
-- [ ] Title follows [Conventional Commits](https://www.conventionalcommits.org/) (mostly lowercase)
+- [ ] PR targets `main`
+- [ ] Title follows [Conventional Commits](https://www.conventionalcommits.org/) (mostly lowercase); it becomes the squashed commit's subject
 - [ ] I can explain every change in this diff
 - [ ] Tests added or updated if needed
 - [ ] CI is passing

.github/filters/ci.yml

@@ -1,6 +1,6 @@
-# Which CI suites a pull request needs, by the files it changes. Pushes to dev
-# and main, manual runs and the main workflow always run every suite. A change
-# under .github/ runs every suite, because it can change how any of them run.
+# Which CI suites a pull request needs, by the files it changes. Pushes to
+# main and manual runs always run every suite. A change under .github/ runs
+# every suite, because it can change how any of them run.
 
 go:
   - ".github/**"

.github/filters/images.yml

@@ -34,6 +34,7 @@ api:
   - "libs/machine-proto/**"
   - "libs/toolbox-api-client/**"
   - "scripts/build-provenance.mts"
+  - "scripts/download-geoip-database.sh"
   - "docker-bake.hcl"
   - "deploy/scripts/image.sh"
   - ".moon/tasks/deployable.yml"

.github/renovate.json5

@@ -6,7 +6,7 @@
     "helpers:pinGitHubActionDigests",
     "docker:pinDigests",
   ],
-  baseBranchPatterns: ["dev"],
+  baseBranchPatterns: ["main"],
   schedule: ["before 6am on monday"],
   minimumReleaseAge: "7 days",
   prConcurrentLimit: 5,
@@ -25,7 +25,7 @@
       dependencyDashboardApproval: true,
     },
     {
-      description: "Every non-major update in one weekly pull request that squash-merges itself into dev once CI passes; promoting dev to main stays a manual step",
+      description: "Every non-major update in one weekly pull request that squash-merges itself into main once CI passes",
       groupName: "non-major dependencies",
       groupSlug: "non-major",
       matchUpdateTypes: ["minor", "patch", "digest", "pinDigest"],

.github/rulesets/main.json

@@ -19,7 +19,7 @@
 				"require_code_owner_review": false,
 				"require_last_push_approval": false,
 				"required_review_thread_resolution": false,
-				"allowed_merge_methods": ["merge"]
+				"allowed_merge_methods": ["squash"]
 			}
 		},
 		{
@@ -34,6 +34,11 @@
 		}
 	],
 	"bypass_actors": [
+		{
+			"actor_id": 5586776,
+			"actor_type": "Integration",
+			"bypass_mode": "always"
+		},
 		{
 			"actor_id": 5,
 			"actor_type": "RepositoryRole",

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   workflow_call:
   # Re-runs CI on a branch by hand.
   workflow_dispatch:
@@ -107,8 +107,6 @@ jobs:
           --concurrency=4
       - name: Build the API
         run: pnpm exec moon run api:build-production
-      - name: Verify the generated environment documentation is current
-        run: pnpm exec moon run api:env-docs-check
       - name: Build the dashboard
         run: pnpm exec moon run dashboard:build
       - name: Build the marketing website
@@ -272,21 +270,6 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      # main is the default branch, so new pull requests open against it. Only
-      # dev promotions, the release-please pull request and hotfixes may merge
-      # there; sync-dev.yml carries the last two back into dev.
-      - name: Require pull requests into main to come from dev
-        if: github.event_name == 'pull_request' && github.base_ref == 'main'
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: |
-          case "$HEAD_REF" in
-            dev | release-please--* | hotfix/*) ;;
-            *)
-              echo "::error::pull requests into main come only from dev (or hotfix/*); retarget this one to dev"
-              exit 1
-              ;;
-          esac
       # A suite the changes job skipped counts; a failed or cancelled one does not.
       - name: Require every CI job to succeed or be skipped
         env:

.github/workflows/codeql.yml

@@ -2,7 +2,7 @@ name: CodeQL
 
 on:
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   push:
     branches: [main]
   schedule:

.github/workflows/images.yml

@@ -50,7 +50,7 @@ jobs:
     name: Publish ${{ matrix.application }} image
     needs: changes
     if: >-
-      github.ref == 'refs/heads/dev' &&
+      github.ref == 'refs/heads/main' &&
       needs.changes.outputs.applications != '[]'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
@@ -138,5 +138,5 @@ jobs:
             echo "- Image: \`${IMAGE}\`"
             echo "- Tag: \`${IMAGE_TAG}\`"
             echo "- Digest: \`${DIGEST}\`"
-            echo "- Flux pins this digest on dev; promoting dev to main deploys it."
+            echo "- Flux pins this digest on main and deploys it."
           } >>"$GITHUB_STEP_SUMMARY"

.github/workflows/isolation.yml

@@ -5,7 +5,7 @@ name: Isolation
 # suite runs after merge (push) or on demand instead.
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
     paths:
       - libs/microvm-go/**
       - apps/snapflow/**

.github/workflows/main.yml

@@ -1,8 +1,16 @@
 name: Main
 
+# Images are built once, here, from the commit that passed CI on main. Flux
+# image automation then pins their digests in deploy/apps/production on main
+# and deploys exactly those images.
+
 on:
   push:
     branches: [main]
+    # Flux's digest pins change only these manifests and are never release
+    # relevant, so they neither rerun CI nor rebuild images, which would loop.
+    paths-ignore:
+      - "deploy/apps/production/**"
 
 permissions: {}
 
@@ -15,6 +23,16 @@ jobs:
       # ci.yml's suite selection reads pull request files; on push it runs everything.
       pull-requests: read
 
+  images:
+    name: Images
+    needs: ci
+    uses: ./.github/workflows/images.yml
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
   release-please:
     name: Release PR
     needs: ci

.github/workflows/release.yml

@@ -71,7 +71,7 @@ jobs:
             exit 1
           fi
           if ! jq --exit-status '.signed._type == "root"' apps/snapflow/internal/tuf/trust/root.json >/dev/null; then
-            echo "::error::apps/snapflow/internal/tuf/trust/root.json must hold the production TUF root (see docs/releases.md)"
+            echo "::error::apps/snapflow/internal/tuf/trust/root.json must hold the production TUF root (see apps/snapflow/internal/tuf/trust/README.md)"
             exit 1
           fi
           epoch="$(git show -s --format=%ct HEAD)"

.github/workflows/security-audit.yml

@@ -4,7 +4,7 @@ on:
   schedule:
     - cron: "0 6 * * 1"
   pull_request:
-    branches: [main, dev]
+    branches: [main]
     paths:
       - "go.work"
       - "go.work.sum"