makefile-blocker.yml

# SPDX-License-Identifier: MPL-2.0
name: Makefile Blocker
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches (PR fires once, not
# push+PR) and cancel superseded runs. Safe — read-only PR check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Block Makefiles
        run: |
          MAKEFILES=$(find . -maxdepth 3 -type f \( -name "Makefile" -o -name "makefile" -o -name "GNUmakefile" \) 2>/dev/null || true)

          if [ -n "$MAKEFILES" ]; then
            echo "Makefiles detected. Use justfile instead."
            echo "$MAKEFILES"
            echo ""
            echo "Per Hyperpolymath policy, Makefiles are not permitted."
            echo "See: https://github.com/hyperpolymath/mustfile"
            exit 1
          fi
          echo "No Makefile found (justfile policy enforced)"

      - name: Verify justfile exists
        run: |
          if [ ! -f "justfile" ] && [ ! -f "Justfile" ]; then
            echo "Warning: justfile/Justfile not found at repository root"
            echo "A justfile or Justfile is recommended for task orchestration"
          else
            echo "justfile policy file found"
          fi