TanTan
fa9c73363d
Dev Build / cleanup (push) Waiting to run
Dev Build / typecheck (push) Waiting to run
Publish MCP to npm / Build, test, and publish MCP (push) Waiting to run
Publish SDK to npm / Build, test, and publish SDK (push) Waiting to run
Sync action catalog to docs / sync (push) Waiting to run
Publish UI to npm / Build and publish UI (push) Waiting to run
Build and Release / preflight (push) Waiting to run
37 lines
1.0 KiB
YAML
37 lines
1.0 KiB
YAML
name: PR policy guard
|
|
|
|
# pull_request_target uses the default branch's trusted workflow and script.
|
|
# This policy becomes active after it reaches main through Promote.
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, reopened, edited, synchronize, ready_for_review]
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: pr-policy-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
guard:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Read the trusted policy script
|
|
uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ github.workflow_sha }}
|
|
persist-credentials: false
|
|
sparse-checkout: .github/scripts/pr-policy-guard.cjs
|
|
sparse-checkout-cone-mode: false
|
|
|
|
- name: Enforce target branch and linked issue
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const guard = require('./.github/scripts/pr-policy-guard.cjs');
|
|
await guard({ github, context, core });
|