npm-bun-blocker.yml

# SPDX-License-Identifier: MPL-2.0
name: NPM/Bun Blocker
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches (PR fires once, not
# push+PR) and cancel superseded runs. Safe — read-only PR check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Block npm/bun
        run: |
          if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then
            echo "❌ npm/bun artifacts detected. Use Deno instead."
            exit 1
          fi
          echo "✅ No npm/bun violations"