ts-blocker.yml

# SPDX-License-Identifier: MPL-2.0
name: TypeScript/JavaScript Blocker
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches so a PR fires once (not
# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Block new TypeScript/JavaScript
        run: |
          NEW_TS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(ts|tsx)$' | grep -v '\.gen\.' || true)
          NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)

          if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
            echo "❌ New TS/JS files detected. Use ReScript instead."
            [ -n "$NEW_TS" ] && echo "$NEW_TS"
            [ -n "$NEW_JS" ] && echo "$NEW_JS"
            exit 1
          fi
          echo "✅ ReScript policy enforced"