From d82242273d8a01f577245ac8d8ee462c84183ad4 Mon Sep 17 00:00:00 2001
From: BREW <81044362+b-re-w@users.noreply.github.com>
Date: Sat, 3 Oct 2026 20:31:11 +0900
Subject: [PATCH] Chore: Remove protect-main.sh; main protection is the
 maintainer's settings (#126)

---
 tools/release/README.md       | 14 +++++---------
 tools/release/protect-main.sh | 35 -----------------------------------
 2 files changed, 5 insertions(+), 44 deletions(-)
 delete mode 100755 tools/release/protect-main.sh

diff --git a/tools/release/README.md b/tools/release/README.md
index 37abf63bc..a4f6302d9 100644
--- a/tools/release/README.md
+++ b/tools/release/README.md
@@ -16,10 +16,9 @@ ignored and overwritten.
    `GITHUB_TOKEN`. This needs the repository setting *Actions -> General -> Allow GitHub
    Actions to create and approve pull requests*. No PAT is needed; an optional
    `RELEASE_PR_TOKEN` secret is used for the PR step when present.
-3. Merging that PR is the only way to change `main`. Branch protection (below) makes `main`
-   PR-only and lets only administrators merge; the maintainer merges the `release` PR and
-   checks that its head is `release` (maintainer decision 2026-10-03: no source-branch
-   workflow, settings only).
+3. Merging that PR is the only way to change `main`. The maintainer protects `main` in the
+   repository settings (locked) and merges the `release` PR after checking that its head is
+   `release` (maintainer decision 2026-10-03: settings only, no scripts or workflows for it).
 4. On push to `main`, `pages.yml` deploys `docs/guide/` to GitHub Pages.
 
 ## What is dropped on release
@@ -42,8 +41,5 @@ It refuses to run while `release` is checked out.
 
 ## Protecting main
 
-    tools/release/protect-main.sh               # print what would be applied
-    tools/release/protect-main.sh --apply       # apply via gh api (needs admin)
-
-This requires a pull request (no approving review needed), blocks direct push, force-push and
-deletion, leaves the branch unlocked, and restricts merging to administrators.
+`main`'s protection is set by the maintainer in the repository settings (the branch is locked;
+the maintainer merges the `release` pull request). Agents do not script or change it.
diff --git a/tools/release/protect-main.sh b/tools/release/protect-main.sh
deleted file mode 100755
index 4bc6514db..000000000
--- a/tools/release/protect-main.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-# Print (default) or apply (--apply) branch protection for main.
-# Usage: protect-main.sh [--apply] [--repo OWNER/NAME] [--branch main]
-set -eu
-APPLY=0; REPO=""; BRANCH=main
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --apply) APPLY=1; shift ;;
-    --repo) REPO="$2"; shift 2 ;;
-    --branch) BRANCH="$2"; shift 2 ;;
-    *) echo "unknown argument: $1" >&2; exit 2 ;;
-  esac
-done
-[ -n "$REPO" ] || REPO="{owner}/{repo}"   # gh expands these placeholders from the current repo
-
-BODY='{
-  "required_status_checks": null,
-  "enforce_admins": false,
-  "required_pull_request_reviews": {"required_approving_review_count": 0},
-  "restrictions": {"users": [], "teams": [], "apps": []},
-  "allow_force_pushes": false,
-  "allow_deletions": false,
-  "lock_branch": false
-}'
-CMD="gh api --method PUT repos/$REPO/branches/$BRANCH/protection --input -"
-
-if [ "$APPLY" -eq 1 ]; then
-  printf '%s' "$BODY" | gh api --method PUT "repos/$REPO/branches/$BRANCH/protection" --input -
-  echo "applied protection to $BRANCH"
-else
-  echo "[dry run] would run: $CMD"
-  echo "$BODY"
-  echo "Re-run with --apply to apply (needs admin). 'restrictions' with empty lists means only"
-  echo "administrators may merge; it is accepted for organisation repositories only."
-fi