|
| 1 | +name: PR Branch Check |
| 2 | + |
| 3 | +on: |
| 4 | + # Using pull_request_target instead of pull_request for secure handling of fork PRs |
| 5 | + pull_request_target: |
| 6 | + # Only run on these PR events |
| 7 | + types: [opened, synchronize, reopened] |
| 8 | + # Only check PRs targeting these branches |
| 9 | + branches: |
| 10 | + - main |
| 11 | + - master |
| 12 | + |
| 13 | +permissions: |
| 14 | + pull-requests: write |
| 15 | + issues: write |
| 16 | + |
| 17 | +jobs: |
| 18 | + check-branch: |
| 19 | + runs-on: ubuntu-latest |
| 20 | + steps: |
| 21 | + - name: Check and Comment on PR |
| 22 | + # Only process fork PRs with specific branch conditions |
| 23 | + # Must be a fork AND (source is main/master OR target is main/master) |
| 24 | + if: | |
| 25 | + github.event.pull_request.head.repo.fork == true && |
| 26 | + ((github.event.pull_request.head.ref == 'main' || github.event.pull_request.head.ref == 'master') || |
| 27 | + (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'master')) |
| 28 | + uses: actions/github-script@v7 |
| 29 | + with: |
| 30 | + github-token: ${{ secrets.GITHUB_TOKEN }} |
| 31 | + script: | |
| 32 | + let message = ''; |
| 33 | +
|
| 34 | + message += '🔄 If you are attempting to update your CIPP repo please follow the instructions at: https://docs.cipp.app/setup/self-hosting-guide/updating '; |
| 35 | + message += '\n\n'; |
| 36 | +
|
| 37 | + // Check if PR is targeting main/master |
| 38 | + if (context.payload.pull_request.base.ref === 'main' || context.payload.pull_request.base.ref === 'master') { |
| 39 | + message += '⚠️ PRs cannot target the main branch directly. If you are attempting to contribute code please PR to the dev branch.\n\n'; |
| 40 | + } |
| 41 | +
|
| 42 | + // Check if PR is from a fork's main/master branch |
| 43 | + if (context.payload.pull_request.head.repo.fork && |
| 44 | + (context.payload.pull_request.head.ref === 'main' || context.payload.pull_request.head.ref === 'master')) { |
| 45 | + message += '⚠️ This PR cannot be merged because it originates from your fork\'s main/master branch. If you are attempting to contribute code please PR from your dev branch or another non-main/master branch.\n\n'; |
| 46 | + } |
| 47 | +
|
| 48 | + message += '🔒 This PR will now be automatically closed due to the above violation(s).'; |
| 49 | + |
| 50 | + // Post the comment |
| 51 | + await github.rest.issues.createComment({ |
| 52 | + ...context.repo, |
| 53 | + issue_number: context.issue.number, |
| 54 | + body: message |
| 55 | + }); |
| 56 | + |
| 57 | + // Close the PR |
| 58 | + await github.rest.pulls.update({ |
| 59 | + ...context.repo, |
| 60 | + pull_number: context.issue.number, |
| 61 | + state: 'closed' |
| 62 | + }); |
0 commit comments