ci: detect breaking-change commits in PRs #3

	name: PR Breaking Change Check

	on:
	pull_request:
	types: [opened, synchronize, reopened, labeled, unlabeled]
	branches:
	- main

	permissions:
	contents: read
	pull-requests: write

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	detect-breaking:
	name: Detect Breaking Commits
	runs-on:
	group: databricks-protected-runner-group
	labels: linux-ubuntu-latest
	steps:
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	with:
	fetch-depth: 0
	ref: ${{ github.event.pull_request.head.sha }}

	- name: Find breaking commits
	id: scan
	env:
	BASE_SHA: ${{ github.event.pull_request.base.sha }}
	HEAD_SHA: ${{ github.event.pull_request.head.sha }}
	run: bash .github/scripts/detect-breaking-commits.sh

	- name: Upsert sticky PR comment
	uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
	env:
	FOUND: ${{ steps.scan.outputs.found }}
	BREAKING_LIST: ${{ steps.scan.outputs.list }}
	ALLOWED: ${{ contains(github.event.pull_request.labels.*.name, 'allow-breaking-change') }}
	with:
	script: \|
	const upsert = require('./.github/scripts/upsert-breaking-change-comment.cjs');
	await upsert({ github, context });

	- name: Fail unless explicitly allowed
	if: steps.scan.outputs.found == 'true' && !contains(github.event.pull_request.labels.*.name, 'allow-breaking-change')
	run: \|
	echo "::error::Breaking-change commits detected in tracked packages. Add the 'allow-breaking-change' label to bypass, or rewrite the offending commits."
	exit 1

Provide feedback