Direct push to main detected

[github-actions]

Actor: jeremy
Branch: main
Commit: 4bfb50ab3ebf18da84926ae8563c8a8d11830988
Time: 2026-08-03T09:39:24Z

This commit was pushed directly to the default branch without going through a pull request.

[github-actions]

Actor: jeremy
Branch: main
Commit: cea1475080932a2d5ef0a96f14029eae3956dc6f
Time: 2026-08-03T22:24:39Z

This commit was pushed directly to the default branch without going through a pull request.

[jeremy]

Both pushes recorded here were expected release-prep, and this issue should
stay open as the audit log rather than being closed.

• 4bfb50ab — version/plugin stamping for v0.8.0
• cea14750 — nix flake and plugin version for v0.8.1

The alert is working exactly as designed: it deduped both into a single issue
instead of opening one per push. Closing it would just make the next release
open a fresh one, which loses the running record and costs a triage cycle every
release.

Not adding a subject-based exemption

The obvious fix — teach direct-push-alert.yml to skip commits whose message
matches the release-prep wording — is one I'm deliberately declining. The commit
subject is attacker-controlled: any direct pusher could copy the release-prep
message verbatim and silence the alert. That trades a real detection for
cosmetic quiet on two commits a release.

Worth revisiting only if a provenance-based exemption becomes available upstream
— something that attests the release workflow pushed the commit, rather than
trusting what the commit says about itself.

[jeremy]

Bot notice about a direct push to main. The commit is in, main has no branch protection, and there's no remediation left to do. Closing as informational.

[jeremy]

Reopening — I closed this without reading the thread, and the comment above already settled it: this stays open as the running audit log for expected release-prep pushes. Closing it just makes the next release open a fresh issue and lose the record.

The v0.9.0 stamping push will land here too, which is the point.