protected-files.yaml

name: Protected Files

on:
  pull_request:
    types:
      # default
      - opened
      - synchronize
      - reopened
      # re-run if base branch is changed, since previous merge commit may generate incorrect diff
      - edited

permissions:
  contents: read

env:
  # Users allowed to edit protected files without failing check
  user-allowed: ${{ github.event.pull_request.user.login == 'azure-sdk' }}

jobs:
  protected-files:
    name: Protected Files

    runs-on: ubuntu-slim

    steps:
      # Since check is required, the job must pass instead of being skipped
      - name: User allowed
        if: ${{ env.user-allowed == 'true' }}
        run: echo "Account '${{ github.event.pull_request.user.login }}' is allowed to update protected files"

      - uses: actions/checkout@v6
        if: ${{ env.user-allowed != 'true' }}
        with:
          # Required since "HEAD^" is passed to Get-ChangedFiles
          fetch-depth: 2

      - name: Detect changes to protected files
        if: ${{ env.user-allowed != 'true' }}
        run: |
          . eng/scripts/ChangedFiles-Functions.ps1

          # powershell glob syntax
          $protectedFiles = @(".gitignore", "cspell.json", "cspell.yaml", "package.json", "package-lock.json", ".github/*", ".github/azsdk-common-*", ".vscode/*", "eng/*")
          # regex syntax, to support protected paths within larger excluded paths
          $excludedFiles = @('.github/CODEOWNERS', '.github/skills/(?!azsdk-common-).+')
          $changedFiles = @(Get-ChangedFiles -baseCommitish HEAD^ -headCommitish HEAD -diffFilter "")

          $matchedFiles = @(
            $changedFiles | Where-Object {
              $changedFile = $_;
              ($protectedFiles | Where-Object { $changedFile -like $_ }) -and
              -not ($excludedFiles | Where-Object { $changedFile -match $_ })
            }
          )

          if ($matchedFiles.Count -gt 0) {
            foreach ($file in $matchedFiles) {
              Write-Output "::error file=$file::File '$file' should only be updated by the Azure SDK team.  If intentional, the PR may be merged by the Azure SDK team via bypassing the branch protections."
            }
            exit 1
          }
          else {
            Write-Output "No changes to protected files: [$($protectedFiles -join ', ')]"
          }
        shell: pwsh