Add sync-label check: PRs need the maintainer-applied 'sync' label #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This repository is a read-only mirror; the only PRs that should | |
| # merge are the release sync PRs from the internal source of truth. | |
| # This check fails unless the PR carries the `sync` label, which only | |
| # maintainers can apply — making every merge a deliberate act. | |
| # Temporary guard until release automation takes over merging. | |
| name: Sync label | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, labeled, unlabeled] | |
| jobs: | |
| sync-label: | |
| name: sync-label | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require the `sync` label | |
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'sync') }} | |
| run: | | |
| echo "::error::This PR does not carry the 'sync' label. This repository is a read-only mirror — only release sync PRs merge here. If this IS a release sync PR, a maintainer must apply the 'sync' label; community contributions are re-applied in the internal repository instead (see CONTRIBUTING.md)." | |
| exit 1 | |
| - name: Label present | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'sync') }} | |
| run: echo "sync label present — this is a release sync PR." |