main-branch-guard.yml

---
name: Main Branch Source Guard

on:
  pull_request_target:
    branches: [main]
    types: [opened, reopened, synchronize, edited]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  guard:
    name: Guard main branch source
    runs-on: ubuntu-latest
    steps:
      - name: Verify pull request source branch
        env:
          HEAD_REF: ${{ github.head_ref }}
          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
          REPOSITORY: ${{ github.repository }}
        run: |
          if [[ "${HEAD_REPOSITORY}" != "${REPOSITORY}" ]]; then
            echo "::error::Pull requests into main must come from this repository (got '${HEAD_REPOSITORY}')."
            exit 1
          fi
          if [[ "${HEAD_REF}" == "next" || "${HEAD_REF}" == hotfix-* ]]; then
            echo "Head branch '${HEAD_REF}' is allowed to target main."
            exit 0
          fi
          echo "::error::Pull requests into main must come from 'next' or a 'hotfix-*' branch (got '${HEAD_REF}'). See ADR-0019 (z-shell/.github) for the branching model."
          exit 1