container-policy.yml

# SPDX-License-Identifier: MPL-2.0
permissions:
  contents: read

name: Container Policy
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches so a PR fires once (not
# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Enforce container policy
        run: |
          # Block new Dockerfiles
          NEW_DOCKER=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -iE 'dockerfile' || true)
          if [ -n "$NEW_DOCKER" ]; then
            echo "❌ New Dockerfile detected. Use Containerfile instead."
            exit 1
          fi
          
          # Check for docker command usage in scripts
          DOCKER_CMD=$(grep -r "docker build\|docker run\|docker push" --include="*.sh" --include="*.yml" --include="*.yaml" . 2>/dev/null | grep -v "nerdctl\|podman" | head -5 || true)
          if [ -n "$DOCKER_CMD" ]; then
            echo "⚠️ docker command found. Prefer nerdctl or podman:"
            echo "$DOCKER_CMD"
          fi
          
          echo "✅ Container policy check passed"