From fe50dc107003334137c9009d8e82a329e0d4539b Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sun, 28 Jun 2026 02:45:46 +0000 Subject: [PATCH 1/2] build(ci): consolidate PR guardrails and block draft files We consolidate PR guardrails into a single basic-checks workflow to prevent accidental merges of draft content. The workflow now blocks files in agent draft directories from being merged, and also rejects PRs with 'DO NOT SUBMIT' or 'DO NOT MERGE' in their labels or descriptions. --- .github/workflows/basic-checks.yml | 52 +++++++++++++++++++ .../workflows/check_do_not_merge_label.yml | 20 ------- 2 files changed, 52 insertions(+), 20 deletions(-) create mode 100644 .github/workflows/basic-checks.yml delete mode 100644 .github/workflows/check_do_not_merge_label.yml diff --git a/.github/workflows/basic-checks.yml b/.github/workflows/basic-checks.yml new file mode 100644 index 0000000000..0d82bfd994 --- /dev/null +++ b/.github/workflows/basic-checks.yml @@ -0,0 +1,52 @@ +name: "Basic Checks" + +on: + pull_request_target: + types: + - opened + - synchronize + - reopened + - labeled + - unlabeled + +jobs: + basic-checks: + runs-on: ubuntu-latest + permissions: + pull-requests: read + steps: + - name: Check for "do not merge" label + if: "contains(github.event.pull_request.labels.*.name, 'do not merge')" + run: | + echo "::error::This PR has the 'do not merge' label and cannot be merged." + exit 1 + + - name: Check PR description for DO NOT SUBMIT/MERGE + env: + PR_BODY: ${{ github.event.pull_request.body }} + run: | + echo "Checking PR description for 'DO NOT SUBMIT' or 'DO NOT MERGE'..." + if echo "$PR_BODY" | grep -Ei "DO NOT SUBMIT|DO NOT MERGE"; then + echo "::error::This PR description contains 'DO NOT SUBMIT' or 'DO NOT MERGE' and cannot be merged." + exit 1 + fi + echo "PR description is clean." + + - name: Check for blocked files + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + echo "Checking for blocked files in .agents/plans/ and .agents/scratch/..." + changed_files=$(gh pr diff "$PR_NUMBER" --name-only) + blocked_files=$(echo "$changed_files" | grep -E '^.agents/(plans|scratch)(/|$)' || true) + if [ -n "$blocked_files" ]; then + MSG="::error::Files in .agents/plans and .agents/scratch are " + MSG="${MSG}permitted in PRs to facilitate discussion, " + MSG="${MSG}but are not allowed to be merged. " + MSG="${MSG}Please remove them before merging:" + echo "$MSG" + echo "$blocked_files" + exit 1 + fi + echo "No blocked files found." diff --git a/.github/workflows/check_do_not_merge_label.yml b/.github/workflows/check_do_not_merge_label.yml deleted file mode 100644 index 97b91b156a..0000000000 --- a/.github/workflows/check_do_not_merge_label.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: "Check 'do not merge' label" - -on: - pull_request_target: - types: - - opened - - synchronize - - reopened - - labeled - - unlabeled - -jobs: - block-do-not-merge: - runs-on: ubuntu-latest - steps: - - name: Check for "do not merge" label - if: "contains(github.event.pull_request.labels.*.name, 'do not merge')" - run: | - echo "This PR has the 'do not merge' label and cannot be merged." - exit 1 From 4a65596070cb8326c84aa1aa2cf3682c6d93e2d5 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Sun, 28 Jun 2026 06:44:05 +0000 Subject: [PATCH 2/2] build(ci): rename workflow and split jobs We rename the basic-checks workflow to pr-metadata-checks and split it into two separate jobs. This allows us to run the 'do not merge' and 'blocked files' checks independently and restrict permissions to only the jobs that need them. --- ...sic-checks.yml => pr-metadata-checks.yaml} | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) rename .github/workflows/{basic-checks.yml => pr-metadata-checks.yaml} (61%) diff --git a/.github/workflows/basic-checks.yml b/.github/workflows/pr-metadata-checks.yaml similarity index 61% rename from .github/workflows/basic-checks.yml rename to .github/workflows/pr-metadata-checks.yaml index 0d82bfd994..003b4d99a5 100644 --- a/.github/workflows/basic-checks.yml +++ b/.github/workflows/pr-metadata-checks.yaml @@ -1,4 +1,4 @@ -name: "Basic Checks" +name: "PR Metadata Checks" on: pull_request_target: @@ -10,42 +10,47 @@ on: - unlabeled jobs: - basic-checks: + blocks-do-not-merge: runs-on: ubuntu-latest - permissions: - pull-requests: read steps: - name: Check for "do not merge" label if: "contains(github.event.pull_request.labels.*.name, 'do not merge')" run: | - echo "::error::This PR has the 'do not merge' label and cannot be merged." + echo "::error::This PR has the 'do not merge' label" \ + "and cannot be merged." exit 1 - name: Check PR description for DO NOT SUBMIT/MERGE env: PR_BODY: ${{ github.event.pull_request.body }} run: | - echo "Checking PR description for 'DO NOT SUBMIT' or 'DO NOT MERGE'..." + echo "Checking PR description..." if echo "$PR_BODY" | grep -Ei "DO NOT SUBMIT|DO NOT MERGE"; then - echo "::error::This PR description contains 'DO NOT SUBMIT' or 'DO NOT MERGE' and cannot be merged." + echo "::error::This PR description contains" \ + "'DO NOT SUBMIT' or 'DO NOT MERGE'" \ + "and cannot be merged." exit 1 fi echo "PR description is clean." + block-transient-agent-files: + runs-on: ubuntu-latest + permissions: + pull-requests: read + steps: - name: Check for blocked files env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_NUMBER: ${{ github.event.pull_request.number }} run: | - echo "Checking for blocked files in .agents/plans/ and .agents/scratch/..." + echo "Checking for blocked files..." changed_files=$(gh pr diff "$PR_NUMBER" --name-only) blocked_files=$(echo "$changed_files" | grep -E '^.agents/(plans|scratch)(/|$)' || true) if [ -n "$blocked_files" ]; then - MSG="::error::Files in .agents/plans and .agents/scratch are " - MSG="${MSG}permitted in PRs to facilitate discussion, " - MSG="${MSG}but are not allowed to be merged. " - MSG="${MSG}Please remove them before merging:" - echo "$MSG" + echo "::error::Files in .agents/plans and" \ + ".agents/scratch are permitted in PRs to" \ + "facilitate discussion, but are not allowed" \ + "to be merged. Please remove them before merging:" echo "$blocked_files" exit 1 fi