Security: Add auto-close workflow for external and bot PRs

Author: remrearas

.github/workflows/auto-close-pr.yml

@@ -0,0 +1,74 @@
+name: Auto Close External PRs
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  auto-close:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+
+    steps:
+      - name: Check if PR is from external contributor or bot
+        id: check
+        run: |
+          PR_AUTHOR="${{ github.event.pull_request.user.login }}"
+          PR_AUTHOR_TYPE="${{ github.event.pull_request.user.type }}"
+
+          ALLOWED_USERS="remrearas"
+          BLOCKED_BOTS="copilot-swe-agent copilot"
+
+          # Block known bots regardless
+          for bot in $BLOCKED_BOTS; do
+            if [ "$PR_AUTHOR" = "$bot" ]; then
+              echo "external=true" >> $GITHUB_OUTPUT
+              echo "reason=bot" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+          done
+
+          # Block any Bot-type account not in allowed list
+          if [ "$PR_AUTHOR_TYPE" = "Bot" ]; then
+            echo "external=true" >> $GITHUB_OUTPUT
+            echo "reason=bot" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          # Block external users
+          for user in $ALLOWED_USERS; do
+            if [ "$PR_AUTHOR" = "$user" ]; then
+              echo "external=false" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+          done
+
+          echo "external=true" >> $GITHUB_OUTPUT
+          echo "reason=external" >> $GITHUB_OUTPUT
+
+      - name: Close unauthorized PR
+        if: steps.check.outputs.external == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const reason = '${{ steps.check.outputs.reason }}';
+            const message = reason === 'bot'
+              ? '🚫 Bot-generated PRs are not accepted in this repository. This PR has been automatically closed.'
+              : '🚫 External contributions are not accepted in this repository. This PR has been automatically closed.';
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: message
+            });
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+              state: 'closed'
+            });