release: promote develop to main (#12)

Ships the pr-guard workflow to `main`.

Author: Jaro-c

.github/workflows/pr-guard.yml

@@ -0,0 +1,36 @@
+name: pr-guard
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions: {}
+
+jobs:
+  collaborators-only:
+    name: collaborators-only
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Close pull requests from non-collaborators
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ASSOC: ${{ github.event.pull_request.author_association }}
+          LOGIN: ${{ github.event.pull_request.user.login }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          if [ "$LOGIN" = "dependabot[bot]" ]; then
+            echo "Dependabot is allowed."
+            exit 0
+          fi
+          case "$ASSOC" in
+            OWNER|MEMBER|COLLABORATOR)
+              echo "Author is a collaborator."
+              ;;
+            *)
+              gh pr comment "$PR" --repo "$REPO" --body "Thanks for your interest. This project does not accept unsolicited pull requests — contributions are invitation-only (see CONTRIBUTING.md). If you found a bug, please open an issue instead: we genuinely appreciate bug reports."
+              gh pr close "$PR" --repo "$REPO"
+              ;;
+          esac