chore: Sync post-release maintenance to main

.github/workflows/ci.yml

@@ -37,81 +37,37 @@ jobs:
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Check, package, and verify plugin
         run: ./gradlew check koverXmlReport buildPlugin verifyPlugin
 
       - name: Upload plugin artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: intellij-codexp-plugin
           path: build/distributions/*.zip
           if-no-files-found: error
 
       - name: Upload test report
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-report
           path: build/reports/tests
           if-no-files-found: ignore
 
       - name: Upload plugin verifier report
         if: ${{ always() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: plugin-verifier-report
           path: build/reports/pluginVerifier
           if-no-files-found: ignore
 
       - name: Upload coverage
         if: ${{ env.CODECOV_TOKEN != '' }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           files: build/reports/kover/report.xml
           token: ${{ env.CODECOV_TOKEN }}
-
-  release-draft:
-    name: Release draft
-    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-    needs: [build]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Fetch sources
-        uses: actions/checkout@v6
-
-      - name: Setup Java
-        uses: actions/setup-java@v5
-        with:
-          distribution: zulu
-          java-version: 21
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
-        with:
-          cache-read-only: true
-
-      - name: Create release draft
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          VERSION="$(./gradlew properties --property version --quiet --console=plain | tail -n 1 | cut -f2- -d ' ')"
-          RELEASE_NOTE="./build/tmp/release_note.txt"
-          ./gradlew getChangelog --unreleased --no-header --quiet --console=plain --output-file="$RELEASE_NOTE"
-
-          if gh release view "v${VERSION}" >/dev/null 2>&1; then
-            IS_DRAFT="$(gh release view "v${VERSION}" --json isDraft --jq '.isDraft')"
-            if [ "$IS_DRAFT" != "true" ]; then
-              echo "Release v${VERSION} already exists and is not a draft."
-              exit 1
-            fi
-            gh release delete "v${VERSION}" --cleanup-tag --yes
-          fi
-
-          gh release create "v${VERSION}" \
-            --draft \
-            --title "v${VERSION}" \
-            --notes-file "$RELEASE_NOTE"

.github/workflows/release-draft.yml

@@ -0,0 +1,61 @@
+name: Release Draft
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to create the release draft from
+        required: true
+        default: main
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-draft-${{ inputs.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release-draft:
+    name: Create release draft
+    if: ${{ github.repository == 'ByteAurora/intellij-codexp' && github.actor == 'ByteAurora' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch sources
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Setup Java
+        uses: actions/setup-java@v5
+        with:
+          distribution: zulu
+          java-version: 21
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-read-only: true
+
+      - name: Create release draft
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="$(./gradlew properties --property version --quiet --console=plain | tail -n 1 | cut -f2- -d ' ')"
+          RELEASE_NOTE="./build/tmp/release_note.txt"
+          ./gradlew getChangelog --unreleased --no-header --quiet --console=plain --output-file="$RELEASE_NOTE"
+
+          if gh release view "v${VERSION}" >/dev/null 2>&1; then
+            IS_DRAFT="$(gh release view "v${VERSION}" --json isDraft --jq '.isDraft')"
+            if [ "$IS_DRAFT" != "true" ]; then
+              echo "Release v${VERSION} already exists and is not a draft."
+              exit 1
+            fi
+            gh release delete "v${VERSION}" --cleanup-tag --yes
+          fi
+
+          gh release create "v${VERSION}" \
+            --draft \
+            --target "${{ inputs.ref }}" \
+            --title "v${VERSION}" \
+            --notes-file "$RELEASE_NOTE"

.github/workflows/release.yml

@@ -27,7 +27,7 @@ jobs:
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@v6
 
       - name: Export release notes
         id: release-notes

CONTRIBUTING.md

@@ -29,9 +29,18 @@ Before opening a pull request:
 - Update `CHANGELOG.md` when the change affects users, compatibility, build, or release behavior.
 - Do not include private certificates, Marketplace tokens, or local signing files.
 
+## Branch Workflow
+
+- Use `develop` as the integration branch for normal work.
+- Open feature, fix, documentation, and maintenance pull requests against `develop`.
+- Use `main` as the stable release branch.
+- Merge `develop` into `main` only when preparing a release.
+- For urgent production fixes, branch from `main`, merge back into `main`, then merge the fix back into `develop`.
+
 ## Release Policy
 
 CodeXP is open source, but publishing to JetBrains Marketplace is restricted to the maintainer.
 
 Contributors should not run or request release publishing. Marketplace credentials are stored only in GitHub Secrets or protected GitHub Environments.
 
+Release drafts are created manually from the `Release Draft` workflow after the release changes have been merged into `main`. Publishing the GitHub Release triggers the protected Marketplace deployment workflow.