openhuman/.github/workflows/pr-protection.yml

name: PR Protection - Main Branch

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  pull-requests: write
  contents: read

jobs:
  check-pr-protection:
    runs-on: ubuntu-latest

    steps:
      - name: Check PR target branch
        id: check-target
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const pr = context.payload.pull_request;
            const baseBranch = pr.base.ref;
            const headBranch = pr.head.ref;
            const prAuthor = pr.user.login;
            const prTitle = pr.title;
            const prBody = pr.body || '';

            // Check if PR is targeting main
            const isTargetingMain = baseBranch === 'main';

            if (!isTargetingMain) {
              console.log(`PR is targeting ${baseBranch}, not main. Skipping protection check.`);
              core.setOutput('needs_check', 'false');
              return;
            }

            console.log(`PR #${pr.number} is targeting ${baseBranch}`);
            console.log(`PR author: ${prAuthor}`);
            console.log(`PR title: ${prTitle}`);
            console.log(`Head branch: ${headBranch}`);

            // Check if PR title follows conventional commit format
            // Allowed prefixes: feat, fix, chore, refactor, docs, test, style, perf, revert
            const conventionalCommitPattern = /^(feat|fix|chore|refactor|docs|test|style|perf|revert)(\(.+\))?: .+/;
            const followsConventionalFormat = conventionalCommitPattern.test(prTitle);

            console.log(`Conventional commit format check: ${followsConventionalFormat ? 'PASSED' : 'FAILED'}`);
            if (!followsConventionalFormat) {
              console.log(`PR title must follow conventional commit format: <type>: <description>`);
              console.log(`Allowed types: feat, fix, chore, refactor, docs, test, style, perf, revert`);
            }

            // Check if this is the automated PR from create-develop-to-main-pr workflow
            // The automated PR has these characteristics:
            // 1. Created by github-actions[bot]
            // 2. From develop branch to main
            // 3. Title matches pattern: "chore: merge develop into main (vX.Y.Z)"
            // 4. Body contains "This PR automatically merges changes from develop into main"

            // Validate PR title matches expected pattern: "chore: merge develop into main" followed by optional version
            const expectedTitlePattern = /^chore: merge develop into main( \(v\d+\.\d+\.\d+\))?$/;
            const titleMatches = expectedTitlePattern.test(prTitle);

            console.log(`Automated PR title validation: ${titleMatches ? 'PASSED' : 'FAILED'}`);
            console.log(`Expected pattern: "chore: merge develop into main" or "chore: merge develop into main (vX.Y.Z)"`);

            const isAutomatedPR =
              prAuthor === 'github-actions[bot]' &&
              headBranch === 'develop' &&
              titleMatches &&
              prBody.includes('This PR automatically merges changes from develop into main');

            if (isAutomatedPR) {
              console.log('This PR is from the automated workflow. Allowing it.');
              core.setOutput('needs_check', 'false');
              core.setOutput('is_allowed', 'true');
            } else {
              console.log('This PR is NOT from the automated workflow.');

              // Even if not automated, check if title follows conventional commit format
              if (!followsConventionalFormat) {
                console.log('PR title does not follow conventional commit format. Blocking it.');
                core.setOutput('needs_check', 'true');
                core.setOutput('is_allowed', 'false');
                core.setOutput('conventional_format_failed', 'true');
              } else {
                console.log('PR title follows conventional commit format, but PR is not from automated workflow. Blocking it.');
                core.setOutput('needs_check', 'true');
                core.setOutput('is_allowed', 'false');
                core.setOutput('conventional_format_failed', 'false');
              }
            }

            // Store the conventional format check result
            core.setOutput('conventional_format', followsConventionalFormat ? 'true' : 'false');

      - name: Block unauthorized PR to main
        if: steps.check-target.outputs.needs_check == 'true' && steps.check-target.outputs.is_allowed == 'false'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const pr = context.payload.pull_request;
            const baseBranch = pr.base.ref;
            const prAuthor = pr.user.login;
            const prTitle = pr.title;
            const headBranch = pr.head.ref;
            const prBody = pr.body || '';

            // Check which validation criteria failed
            const conventionalCommitPattern = /^(feat|fix|chore|refactor|docs|test|style|perf|revert)(\(.+\))?: .+/;
            const followsConventionalFormat = conventionalCommitPattern.test(prTitle);

            const checks = {
              author: prAuthor === 'github-actions[bot]',
              branch: headBranch === 'develop',
              automatedTitle: /^chore: merge develop into main( \(v\d+\.\d+\.\d+\))?$/.test(prTitle),
              body: prBody.includes('This PR automatically merges changes from develop into main'),
              conventionalFormat: followsConventionalFormat
            };

            const failedChecks = Object.entries(checks)
              .filter(([_, passed]) => !passed)
              .map(([check]) => check);

            console.log('Validation checks:', JSON.stringify(checks, null, 2));
            console.log('Failed checks:', failedChecks.join(', '));

            // Build detailed error message
            let errorDetails = '';
            if (failedChecks.length > 0) {
              errorDetails = `\n\n**Failed validation checks:**\n`;
              if (!checks.author) errorDetails += `- ❌ Author must be \`github-actions[bot]\` (found: \`${prAuthor}\`)\n`;
              if (!checks.branch) errorDetails += `- ❌ Head branch must be \`develop\` (found: \`${headBranch}\`)\n`;
              if (!checks.automatedTitle) errorDetails += `- ❌ Title must match pattern: \`chore: merge develop into main\` or \`chore: merge develop into main (vX.Y.Z)\` (found: \`${prTitle}\`)\n`;
              if (!checks.body) errorDetails += `- ❌ Body must contain: "This PR automatically merges changes from develop into main"\n`;
              if (!checks.conventionalFormat) errorDetails += `- ❌ PR title must follow conventional commit format: \`<type>: <description>\`\n`;
              if (!checks.conventionalFormat) errorDetails += `  Allowed types: \`feat\`, \`fix\`, \`chore\`, \`refactor\`, \`docs\`, \`test\`, \`style\`, \`perf\`, \`revert\`\n`;
              if (!checks.conventionalFormat) errorDetails += `  Example: \`feat: add new authentication endpoint\`\n`;
            }

            // Comment on the PR explaining why it was blocked
            const codeBlock = '`';
            const commentBody = [
              '## PR Protection Rule Violation',
              '',
              `This PR targets the ${codeBlock}${baseBranch}${codeBlock} branch, which is protected.`,
              '',
              `**Only automated PRs from the ${codeBlock}create-develop-to-main-pr.yml${codeBlock} workflow are allowed to target ${codeBlock}${baseBranch}${codeBlock}.**${errorDetails}`,
              '',
              `**To merge changes into ${codeBlock}${baseBranch}${codeBlock}:**`,
              `1. Create your PR targeting the ${codeBlock}develop${codeBlock} branch instead`,
              `2. Once merged to ${codeBlock}develop${codeBlock}, the automated workflow will create a PR from ${codeBlock}develop${codeBlock} to ${codeBlock}${baseBranch}${codeBlock}`,
              '',
              `Please update this PR to target ${codeBlock}develop${codeBlock} instead, or close it and create a new PR targeting ${codeBlock}develop${codeBlock}.`
            ].join('\n');

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: pr.number,
              body: commentBody
            });

            // Fail the workflow to block the PR
            let failureMessage = `PR #${pr.number} cannot target ${baseBranch} branch. `;

            if (!checks.conventionalFormat) {
              failureMessage += `PR title does not follow conventional commit format. `;
            }

            failureMessage += `Failed checks: ${failedChecks.join(', ')}. `;
            failureMessage += `Only automated PRs from create-develop-to-main-pr.yml workflow are allowed.`;

            core.setFailed(failureMessage);