chore: add dual-remote helper workflow

CONTRIBUTING.md

@@ -34,6 +34,30 @@ Rule:
 
 Do not let a customer deployment track `develop` directly.
 
+## Dual Remote Workflow
+This repository now has two different Git remotes with different purposes:
+- `origin`: the normal GitHub product remote
+- `tubco`: the TUBCO customer remote
+
+Use the helper command to avoid mixing them up:
+
+```bash
+./scripts/git_remote_target.sh status
+```
+
+Common commands:
+
+```bash
+./scripts/git_remote_target.sh push-origin
+./scripts/git_remote_target.sh push-tubco release/tubco-v1
+./scripts/git_remote_target.sh set-own-identity
+./scripts/git_remote_target.sh set-tubco-identity
+```
+
+Default rule:
+- normal product work goes to `origin`
+- TUBCO pushes happen only when explicitly requested
+
 ## Current Delivery Model
 - GitHub Actions is used for CI
 - the current test server is local/LAN-only

backend/workflows/templates/workflows/developer_handbook.html

@@ -94,6 +94,17 @@
         <li>promote <code>develop</code> into <code>main</code> when stable</li>
       </ol>
     </div>
+    <div class="box">
+      <h3>Dual remote rule</h3>
+      <ul>
+        <li><code>origin</code> is the normal product remote on GitHub.</li>
+        <li><code>tubco</code> is the customer remote for TUBCO only.</li>
+        <li>Normal day-to-day work continues on <code>origin</code>.</li>
+        <li>Push to <code>tubco</code> only when you explicitly want to update the customer branch.</li>
+      </ul>
+      <pre><code>./scripts/git_remote_target.sh status</code></pre>
+      <p>Use the helper above before pushing if there is any doubt about which remote should receive the change.</p>
+    </div>
     <div class="box">
       <h3>Customer release branches</h3>
       <p>Use a dedicated release branch when a customer should receive the current stable product line but not future features by default.</p>
@@ -657,6 +668,8 @@ lxc.mount.entry: /dev/null sys/module/apparmor/parameters/enabled none bind 0 0<
       <pre><code>docker compose restart web
 docker compose restart worker</code></pre>
       <p>Restart app services after code or template changes.</p>
+      <pre><code>./scripts/git_remote_target.sh status</code></pre>
+      <p>Show the current branch, active local identity, and both remotes before pushing.</p>
     </div>
     <div class="box">
       <h3>Validation</h3>
@@ -675,6 +688,15 @@ docker compose restart worker</code></pre>
       <pre><code>./scripts/deploy_prod_from_mac.sh</code></pre>
       <p>Sync the current <code>main</code> checkout to the production target and deploy it with production checks enabled.</p>
     </div>
+    <div class="box">
+      <h3>Remote targeting</h3>
+      <pre><code>./scripts/git_remote_target.sh push-origin
+./scripts/git_remote_target.sh push-tubco release/tubco-v1</code></pre>
+      <p>Push to the intended remote explicitly instead of relying on memory.</p>
+      <pre><code>./scripts/git_remote_target.sh set-own-identity
+./scripts/git_remote_target.sh set-tubco-identity</code></pre>
+      <p>Switch between the normal commit identity and the TUBCO customer identity when needed.</p>
+    </div>
     <div class="box">
       <h3>Direct server deployment</h3>
       <pre><code>cd /opt/workdock

scripts/git_remote_target.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+TUBCO_NAME="bostame"
+TUBCO_EMAIL="mdbayazid@tub.co"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  ./scripts/git_remote_target.sh status
+  ./scripts/git_remote_target.sh push-origin [ref]
+  ./scripts/git_remote_target.sh push-tubco [ref]
+  ./scripts/git_remote_target.sh set-own-identity
+  ./scripts/git_remote_target.sh set-tubco-identity
+
+Commands:
+  status
+      Show current branch, current commit, active local git identity, and configured remotes.
+
+  push-origin [ref]
+      Push a ref to the main product remote "origin".
+      Default ref: current branch
+
+  push-tubco [ref]
+      Push a ref to the TUBCO customer remote "tubco".
+      Default ref: release/tubco-v1
+
+  set-own-identity
+      Remove the repo-local git user.name and user.email so this repo falls back to your normal identity.
+
+  set-tubco-identity
+      Set the repo-local git identity to the TUBCO customer identity.
+EOF
+}
+
+require_remote() {
+  local remote="$1"
+  git remote get-url "$remote" >/dev/null 2>&1 || {
+    echo "Missing git remote: $remote" >&2
+    exit 1
+  }
+}
+
+current_branch() {
+  git branch --show-current
+}
+
+show_identity() {
+  local local_name local_email
+  local_name="$(git config --local --get user.name || true)"
+  local_email="$(git config --local --get user.email || true)"
+  if [[ -n "$local_name" || -n "$local_email" ]]; then
+    echo "Local repo identity: ${local_name:-<unset>} <${local_email:-unset}>"
+  else
+    echo "Local repo identity: not set in this repo (falls back to global/default git config)"
+  fi
+}
+
+case "${1:-}" in
+  status)
+    echo "Branch: $(current_branch)"
+    echo "Commit: $(git rev-parse --short HEAD)"
+    show_identity
+    echo
+    echo "Remotes:"
+    git remote -v
+    echo
+    echo "Recommended targets:"
+    echo "  develop/main/internal work -> origin"
+    echo "  release/tubco-v1 and approved customer backports -> tubco"
+    ;;
+
+  push-origin)
+    require_remote origin
+    ref="${2:-$(current_branch)}"
+    echo "Pushing '$ref' to origin..."
+    git push origin "$ref"
+    ;;
+
+  push-tubco)
+    require_remote tubco
+    ref="${2:-release/tubco-v1}"
+    echo "Pushing '$ref' to tubco..."
+    git push tubco "$ref"
+    ;;
+
+  set-own-identity)
+    git config --local --unset-all user.name >/dev/null 2>&1 || true
+    git config --local --unset-all user.email >/dev/null 2>&1 || true
+    echo "Cleared repo-local git identity. This repo will now use your normal git identity."
+    ;;
+
+  set-tubco-identity)
+    git config --local user.name "$TUBCO_NAME"
+    git config --local user.email "$TUBCO_EMAIL"
+    echo "Set repo-local git identity to: $TUBCO_NAME <$TUBCO_EMAIL>"
+    ;;
+
+  *)
+    usage
+    exit 1
+    ;;
+esac