ci: rollback dual release line scheme

.github/workflows/auto-merge-release.yml

@@ -40,12 +40,11 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           REPO_OWNER: ${{ github.repository_owner }}
-          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
           PR_JSON=$(gh api "repos/${{ github.repository }}/pulls" \
             -X GET \
             -f state=open \
-            -f "head=${REPO_OWNER}:release-please--branches--${HEAD_BRANCH}" \
+            -f "head=${REPO_OWNER}:release-please--branches--main" \
             --jq '.[0] // empty')
 
           if [ -z "$PR_JSON" ]; then

.github/workflows/commitlint.yml

@@ -2,115 +2,14 @@ name: Commitlint
 
 on:
   pull_request:
-    branches: [ main, 6.x ]
+    branches: [ main ]
     types: [opened, synchronize, reopened]
 
 jobs:
   branch-name:
     if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }}
     uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main
-    with:
-      pattern: '^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert|package)/.+$'
 
   commitlint:
     if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }}
     uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main
-
-  base-branch-check:
-    name: Validate base branch for branch type
-    if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }}
-    runs-on: ubuntu-24.04
-    steps:
-      - name: Check base branch matches branch type
-        env:
-          HEAD_BRANCH: ${{ github.head_ref }}
-          BASE_BRANCH: ${{ github.base_ref }}
-        run: |
-          # ci/* queda exceptuada: los cambios de infraestructura de CI no
-          # están atados a una línea de versión, se propagan a mano entre
-          # main y 6.x cuando hace falta (ver Tarea 14 del plan de este cambio).
-          if [[ "$HEAD_BRANCH" == ci/* ]]; then
-            echo "Branch '$HEAD_BRANCH' is a CI/infra branch — base branch rule not enforced."
-            exit 0
-          fi
-
-          if [[ "$HEAD_BRANCH" == package/* ]]; then
-            if [[ "$BASE_BRANCH" != "main" ]]; then
-              echo "::error::package/* branches must target 'main', not '$BASE_BRANCH'."
-              exit 1
-            fi
-          else
-            if [[ "$BASE_BRANCH" != "6.x" ]]; then
-              echo "::error::Only package/* branches may target 'main'. '$HEAD_BRANCH' must target '6.x', not '$BASE_BRANCH'."
-              exit 1
-            fi
-          fi
-
-          echo "Base branch '$BASE_BRANCH' is correct for '$HEAD_BRANCH'."
-
-  fork-point-check:
-    name: Validate branch actually forked from the correct line
-    if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }}
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout head commit with full history
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-
-      - name: Check head diverges from its declared base, not from the other line
-        env:
-          HEAD_BRANCH: ${{ github.head_ref }}
-          BASE_BRANCH: ${{ github.base_ref }}
-        run: |
-          # base-branch-check only validates that the branch NAME is paired
-          # with the right base — it can't see where the branch actually
-          # forked from. A feat/* branch created from main (instead of 6.x)
-          # would still pass that check, but merging it would smuggle every
-          # main-only change (including the breaking change 6.x is meant to
-          # be free of) into 6.x. This job checks the real git ancestry.
-          # OTHER_BRANCH is derived from BASE_BRANCH (not from HEAD_BRANCH's
-          # name) so this check stays sound on ci/* branches too, which
-          # base-branch-check deliberately doesn't gate (it may target
-          # either line).
-          if [[ "$BASE_BRANCH" == "main" ]]; then
-            OTHER_BRANCH="6.x"
-          else
-            OTHER_BRANCH="main"
-          fi
-
-          MB_BASE=$(git merge-base HEAD "origin/${BASE_BRANCH}")
-          MB_OTHER=$(git merge-base HEAD "origin/${OTHER_BRANCH}")
-
-          if git merge-base --is-ancestor "$MB_OTHER" "$MB_BASE"; then
-            echo "OK: '$HEAD_BRANCH' diverges from '$BASE_BRANCH', not from '$OTHER_BRANCH'."
-          else
-            echo "::error::'$HEAD_BRANCH' (targeting '$BASE_BRANCH') contains commits from '$OTHER_BRANCH' that are not in '$BASE_BRANCH' — either it was created from '$OTHER_BRANCH' instead of '$BASE_BRANCH', or '$OTHER_BRANCH' was merged into it deliberately. Either way, merging this PR as-is would pull those changes (including any breaking changes '$OTHER_BRANCH' has that '$BASE_BRANCH' doesn't) into '$BASE_BRANCH'. Fix: rebase onto 'origin/$BASE_BRANCH' from this branch's real fork point — git rebase --onto origin/$BASE_BRANCH $MB_OTHER $HEAD_BRANCH — or, if '$OTHER_BRANCH' was merged in on purpose, drop that merge first."
-            exit 1
-          fi
-
-  no-breaking-changes:
-    name: Block breaking changes (temporary policy)
-    if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.head_ref, 'dependabot/') }}
-    runs-on: ubuntu-24.04
-    permissions:
-      pull-requests: read
-    steps:
-      - name: Scan PR commits and title for breaking-change markers
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          gh api --paginate "repos/${{ github.repository }}/pulls/$PR_NUMBER/commits" --jq '.[].commit.message' > commit_messages.txt
-          echo "$PR_TITLE" >> commit_messages.txt
-
-          if grep -qE '^[a-zA-Z]+(\([^)]*\))?!:' commit_messages.txt || grep -qE 'BREAKING[ -]CHANGE:' commit_messages.txt; then
-            echo "::error::Breaking changes are temporarily blocked on this repository (no '!:' headers or 'BREAKING CHANGE:'/'BREAKING-CHANGE:' footers allowed on any branch, in commit messages OR in the PR title — this repo squash-merges using the PR title as the final commit message)."
-            exit 1
-          fi
-
-          echo "No breaking-change markers found."

.github/workflows/linter.yml

@@ -2,7 +2,7 @@ name: OpenTofu
 
 on:
   pull_request:
-    branches: [ main, 6.x ]
+    branches: [ main ]
     types: [opened, synchronize, reopened]
 
 jobs:

.github/workflows/release.yml

@@ -4,31 +4,19 @@ on:
   push:
     branches:
       - main
-      - 6.x
 
 concurrency:
-  group: release-${{ github.ref_name }}
+  group: main-branch-push
   cancel-in-progress: false
 
 jobs:
   release:
-    name: Release Please
-    runs-on: ubuntu-24.04
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
     permissions:
       contents: write
       pull-requests: write
-    env:
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Release
-        id: release
-        uses: googleapis/release-please-action@v5
-        with:
-          release-type: terraform-module
-          target-branch: ${{ github.ref_name }}
+    with:
+      update_readme_versions: false
 
   generate-readmes:
     name: Generate READMEs for Release PR
@@ -42,11 +30,10 @@ jobs:
         id: check_pr
         env:
           GH_TOKEN: ${{ github.token }}
-          REF_NAME: ${{ github.ref_name }}
         run: |
           PR_NUMBER=$(gh pr list \
             --repo ${{ github.repository }} \
-            --head "release-please--branches--${REF_NAME}" \
+            --head release-please--branches--main \
             --state open \
             --json number \
             --jq '.[0].number // empty')
@@ -64,7 +51,7 @@ jobs:
         if: steps.check_pr.outputs.pr_exists == 'true'
         uses: actions/checkout@v6
         with:
-          ref: release-please--branches--${{ github.ref_name }}
+          ref: release-please--branches--main
           fetch-depth: 0
 
       - name: Detect changed modules
@@ -165,9 +152,6 @@ jobs:
 
       - name: Commit and push
         if: steps.check_pr.outputs.pr_exists == 'true'
-        env:
-          HUSKY: 0
-          REF_NAME: ${{ github.ref_name }}
         run: |
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git config user.name "github-actions[bot]"
@@ -182,6 +166,8 @@ jobs:
             else
               git commit -m "docs: update version references in READMEs"
             fi
-            git push origin "release-please--branches--${REF_NAME}"
+            git push origin release-please--branches--main
             echo "READMEs updated in Release PR #${{ steps.check_pr.outputs.pr_number }}"
           fi
+        env:
+          HUSKY: 0

.github/workflows/tflint-unused.yml

@@ -2,7 +2,7 @@ name: tflint-unused-declarations
 
 on:
   pull_request:
-    branches: [ main, 6.x ]
+    branches: [ main ]
     types: [opened, synchronize, reopened]
 
 jobs:

.github/workflows/tofu-test.yml

@@ -2,7 +2,7 @@ name: Tofu Unit Tests
 
 on:
   pull_request:
-    branches: [ main, 6.x ]
+    branches: [ main ]
     types: [opened, synchronize, reopened]
 
 jobs:

.github/workflows/trivy.yml

@@ -4,11 +4,9 @@ on:
   pull_request:
     branches:
       - main
-      - 6.x
   push:
     branches:
       - main
-      - 6.x
     paths:
       - '**/*.tf'
 

.husky/pre-commit

@@ -22,14 +22,14 @@ fi
 
 # Validate branch name
 BRANCH=$(git rev-parse --abbrev-ref HEAD)
-PATTERN="^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert|package)/.+$"
+PATTERN="^(feat|feature|fix|docs|style|refactor|perf|test|build|ci|chore|revert)/.+$"
 
-if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "6.x" ] && ! echo "$BRANCH" | grep -Eq "$PATTERN"; then
+if [ "$BRANCH" != "main" ] && ! echo "$BRANCH" | grep -Eq "$PATTERN"; then
   echo "Invalid branch name: $BRANCH"
   echo ""
   echo "Branch name must follow the pattern: type/description"
-  echo "  Examples: feat/add-login, fix/bug-123, docs/readme, package/add-lambda"
+  echo "  Examples: feat/add-login, fix/bug-123, docs/readme"
   echo ""
-  echo "Valid types: feat, feature, fix, docs, style, refactor, perf, test, build, ci, chore, revert, package"
+  echo "Valid types: feat, feature, fix, docs, style, refactor, perf, test, build, ci, chore, revert"
   exit 1
 fi