diff --git a/.github/workflows/create-release-pr.yml b/.github/workflows/create-release-pr.yml
index e015faa..7b27b0e 100644
--- a/.github/workflows/create-release-pr.yml
+++ b/.github/workflows/create-release-pr.yml
@@ -8,6 +8,10 @@ on:
         required: false
         default: ""
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   create-release-pr:
     runs-on: ubuntu-latest
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5e5f63e..4c01b52 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,6 +36,25 @@ This project uses [Conventional Commits](https://www.conventionalcommits.org/).
 
 Commits are enforced via commitlint + husky.
 
+## Git Workflow
+
+```
+feature branch → PR to dev → merge to dev
+                                  ↓
+                    (when ready to release)
+                                  ↓
+              dev → PR to main → merge to main
+                                  ↓
+                    semantic-release runs
+                    (version bump + npm publish)
+```
+
+### Branch Strategy
+
+- **`main`** - Production branch. Merges trigger releases.
+- **`dev`** - Development branch. All feature PRs target this branch.
+- **Feature branches** - Create from `dev`, name like `feat/my-feature` or `fix/my-fix`.
+
 ## Pull Request Process
 
 1. Fork the repo and create your branch from `dev`
@@ -44,6 +63,13 @@ Commits are enforced via commitlint + husky.
 4. Submit a PR to `dev` branch
 5. PRs are squash-merged to keep history clean
 
+### Creating a Release
+
+Maintainers can trigger a release by:
+1. Go to **Actions** → **Create Release PR**
+2. Click **Run workflow**
+3. Merge the generated PR from `dev` → `main`
+
 ## Code Style
 
 - TypeScript with strict mode