feat: add writeback-pr option for branch-protected repos

action.yml

@@ -27,6 +27,10 @@ inputs:
     description: 'If true, write board item IDs back into TASKS.md after sync'
     required: false
     default: 'true'
+  writeback-pr:
+    description: 'If true, open a PR for writeback changes instead of pushing directly (for repos with branch protection on main)'
+    required: false
+    default: 'false'
 
 outputs:
   created:
@@ -101,9 +105,29 @@ runs:
         git config user.name "tasksmd-sync[bot]"
         git config user.email "tasksmd-sync[bot]@users.noreply.github.com"
         git remote set-url origin "https://x-access-token:${{ inputs.github-token }}@github.com/${{ github.repository }}.git"
-        git add "${{ inputs.tasks-file }}"
-        git commit -m "chore: write back board item IDs to ${{ inputs.tasks-file }}"
-        git push
+
+        if [ "${{ inputs.writeback-pr }}" = "true" ]; then
+          BRANCH="chore/tasksmd-sync-writeback"
+          BASE="${{ github.ref_name }}"
+          git checkout -b "$BRANCH"
+          git add "${{ inputs.tasks-file }}"
+          git commit -m "chore: write back board item IDs to ${{ inputs.tasks-file }}"
+          git push origin "$BRANCH" --force
+          EXISTING=$(gh pr list --head "$BRANCH" --base "$BASE" --json number -q '.[0].number' 2>/dev/null || true)
+          if [ -z "$EXISTING" ]; then
+            gh pr create \
+              --head "$BRANCH" \
+              --base "$BASE" \
+              --title "chore: write back board item IDs to ${{ inputs.tasks-file }}" \
+              --body "Automated writeback of project board item IDs by tasksmd-sync. Merge this to keep TASKS.md in sync with the project board."
+          else
+            echo "PR #$EXISTING already exists for $BRANCH; updated with force push."
+          fi
+        else
+          git add "${{ inputs.tasks-file }}"
+          git commit -m "chore: write back board item IDs to ${{ inputs.tasks-file }}"
+          git push
+        fi
 
     - name: Comment on PR (dry-run)
       if: github.event_name == 'pull_request' && inputs.dry-run == 'true'