contributor-pr-limit.yml

name: Enforce contributor pull request limit

on:
  pull_request_target:
    types: [opened, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  enforce-limit:
    name: Enforce contributor pull request limit
    runs-on: ubuntu-latest
    concurrency:
      group: contributor-pr-limit
      cancel-in-progress: false
    steps:
      # pull_request_target grants write access for fork PRs. Always load the
      # enforcement code from the trusted default branch, never from the PR.
      - name: Check out trusted enforcement code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false

      - name: Enforce open pull request limit
        uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
        env:
          MAX_OPEN_PRS_PER_CONTRIBUTOR: ${{ vars.MAX_OPEN_PRS_PER_CONTRIBUTOR }}
          MAX_OPEN_PRS_PER_CONTRIBUTOR_OVERRIDES: ${{ vars.MAX_OPEN_PRS_PER_CONTRIBUTOR_OVERRIDES }}
        with:
          script: |
            const { enforcePullRequestLimits } = require('./scripts/ci/enforce-pr-limit.js');
            await enforcePullRequestLimits({
              context,
              core,
              github,
              rawLimit: process.env.MAX_OPEN_PRS_PER_CONTRIBUTOR,
              rawOverrides: process.env.MAX_OPEN_PRS_PER_CONTRIBUTOR_OVERRIDES,
            });