validate_pr_source.yml

name: Validate main branch PR source

on:
  pull_request_target:
    branches: [main]
    types: [opened, reopened, synchronize]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  validate-pr-source:
    if: ${{ github.event.pull_request.head.ref != 'dev' || github.event.pull_request.head.repo.full_name != github.repository }}
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - name: Comment and close PR
        run: |
          HEAD_REF="${{ github.event.pull_request.head.ref }}"
          HEAD_REPO="${{ github.event.pull_request.head.repo.full_name }}"
          PR_NUMBER="${{ github.event.pull_request.number }}"

          echo "Closing PR #$PR_NUMBER from invalid source: $HEAD_REPO / $HEAD_REF"

          gh pr comment "$PR_NUMBER" \
            --body "This PR targets **main**, but only PRs from **dev** in this repository are allowed. Detected source: **$HEAD_REPO:$HEAD_REF**."

          gh pr close "$PR_NUMBER"