release: develop to main — landing page & visualizer UI/UX makeover #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: pr-source-enforcer | |
| # Runs when a PR targets `main` | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, edited] | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| enforce_pr_source: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| allowed: ${{ steps.check.outputs.allowed }} | |
| steps: | |
| - name: Set up shell | |
| run: echo "starting pr-source-enforcer" | |
| - name: Read inputs | |
| id: check | |
| env: | |
| ALLOWED: ${{ secrets.ALLOWED_MERGERS }} | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| TARGET_BRANCH: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| # Allowed mergers come from a repo secret, comma-separated. | |
| # Set this secret in your repo settings: Settings -> Secrets -> Actions -> New repository secret | |
| # Example value: ayoub,my-org-release-bot | |
| echo "HEAD_REF=$HEAD_REF" | |
| echo "PR_AUTHOR=$PR_AUTHOR" | |
| echo "TARGET_BRANCH=$TARGET_BRANCH" | |
| # Normalize values (lowercase) for comparison | |
| head_lc="$(echo "$HEAD_REF" | tr '[:upper:]' '[:lower:]')" | |
| author_lc="$(echo "$PR_AUTHOR" | tr '[:upper:]' '[:lower:]')" | |
| allowed_lc="$(echo "$ALLOWED" | tr '[:upper:]' '[:lower:]')" | |
| # Default to empty allowed list if secret missing | |
| if [ -z "$allowed_lc" ]; then | |
| echo "Warning: ALLOWED_MERGERS secret is empty or missing. No users will be allowed as bypassers." | |
| fi | |
| # Check conditions: allowed if head is 'develop' OR author is in allowed list | |
| allowed="false" | |
| if [ "$head_lc" = "develop" ]; then | |
| allowed="true" | |
| else | |
| # iterate allowed list | |
| IFS=',' read -ra arr <<< "$allowed_lc" | |
| for u in "${arr[@]}"; do | |
| u_trim="$(echo "$u" | xargs)" # trim spaces | |
| if [ -n "$u_trim" ] && [ "$u_trim" = "$author_lc" ]; then | |
| allowed="true" | |
| break | |
| fi | |
| done | |
| fi | |
| echo "allowed=$allowed" | |
| echo "allowed=$allowed" >> "$GITHUB_OUTPUT" | |
| - name: Fail if not allowed | |
| if: steps.check.outputs.allowed != 'true' | |
| env: | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| PR_AUTHOR: ${{ github.event.pull_request.user.login }} | |
| run: | | |
| echo "ERROR: PR targeting 'main' is not allowed. Head branch is '$HEAD_REF' and PR author is '$PR_AUTHOR'." | |
| echo "Only PRs whose head branch is 'develop' or PRs authored by an allowed merger (repo secret ALLOWED_MERGERS) may target 'main'." | |
| exit 1 | |
| - name: Success note | |
| if: steps.check.outputs.allowed == 'true' | |
| run: | | |
| echo "OK: PR allowed to target main (head branch is develop or author is allowed)." |