Fix GitHub App detection logic to use bot API instead of fallback #187
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Protect Main Branch | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| protect-main: | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Check if push is from PR merge or direct push | |
| run: | | |
| # Check if this is a merge commit (from PR) or direct push | |
| if echo "${{ github.event.head_commit.message }}" | grep -q "Merge pull request"; then | |
| echo "✅ PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| elif echo "${{ github.event.head_commit.message }}" | grep -q "Self-approved merge"; then | |
| echo "✅ Self-approved PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| elif echo "${{ github.event.head_commit.message }}" | grep -q "Admin-approved merge"; then | |
| echo "✅ Admin-approved PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| elif echo "${{ github.event.head_commit.message }}" | grep -q "\(#[0-9]\+\)"; then | |
| echo "✅ GitHub CLI PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| else | |
| echo "❌ DIRECT PUSH TO MAIN DETECTED!" | |
| echo "🚫 This repository enforces a feature branch workflow." | |
| echo "📋 Please follow these steps:" | |
| echo " 1. Create a feature branch: git checkout -b feature/your-feature-name" | |
| echo " 2. Make your changes and commit them" | |
| echo " 3. Push the feature branch: git push origin feature/your-feature-name" | |
| echo " 4. Create a Pull Request to merge into main" | |
| echo "" | |
| echo "🔒 Direct pushes to main are not allowed to maintain code quality and review process." | |
| echo "💡 This workflow will fail to prevent accidental direct commits." | |
| exit 1 | |
| fi | |
| validate-pr: | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Check PR title format | |
| run: | | |
| PR_TITLE="${{ github.event.pull_request.title }}" | |
| echo "PR Title: $PR_TITLE" | |
| # Simple check for conventional commit format | |
| if echo "$PR_TITLE" | grep -qE "^(feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert):"; then | |
| echo "✅ PR title follows conventional commit format" | |
| else | |
| echo "⚠️ PR title should follow conventional commit format:" | |
| echo " feat: add new feature" | |
| echo " fix: resolve bug" | |
| echo " docs: update documentation" | |
| echo " refactor: restructure code" | |
| echo " etc." | |
| echo "" | |
| echo "Current title: $PR_TITLE" | |
| echo "✅ This is just a warning, not a blocking error." | |
| fi | |
| echo "✅ PR title validation completed (non-blocking)" | |
| - name: Check for large files | |
| run: | | |
| echo "🔍 Checking for large files in PR..." | |
| # This is a basic check - in a real scenario you might want more sophisticated checks | |
| echo "✅ Large file check completed" | |
| - name: Validate HTML files | |
| run: | | |
| echo "🔍 Validating HTML files..." | |
| # Basic HTML validation could be added here | |
| echo "✅ HTML validation completed" | |
| enforce-workflow: | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Check if push is from PR merge or direct push | |
| run: | | |
| # Check if this is a merge commit (from PR) or direct push | |
| if echo "${{ github.event.head_commit.message }}" | grep -q "Merge pull request"; then | |
| echo "✅ PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| elif echo "${{ github.event.head_commit.message }}" | grep -q "Self-approved merge"; then | |
| echo "✅ Self-approved PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| elif echo "${{ github.event.head_commit.message }}" | grep -q "Admin-approved merge"; then | |
| echo "✅ Admin-approved PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| elif echo "${{ github.event.head_commit.message }}" | grep -q "\(#[0-9]\+\)"; then | |
| echo "✅ GitHub CLI PR merge detected - allowing push to main" | |
| echo "This is a legitimate merge from a Pull Request" | |
| exit 0 | |
| else | |
| echo "🚨 SECURITY CHECK: Direct push to main branch detected!" | |
| echo "" | |
| echo "This repository uses a protected main branch workflow:" | |
| echo "• All changes must go through Pull Requests" | |
| echo "• Feature branches must be created for new work" | |
| echo "• Code review is required before merging" | |
| echo "" | |
| echo "To fix this:" | |
| echo "1. Revert this push: git reset --hard HEAD~1" | |
| echo "2. Create a feature branch: git checkout -b feature/your-feature-name" | |
| echo "3. Cherry-pick your changes: git cherry-pick <commit-hash>" | |
| echo "4. Push feature branch: git push origin feature/your-feature-name" | |
| echo "5. Create a Pull Request" | |
| echo "" | |
| echo "❌ This workflow will fail to prevent the push from being accepted." | |
| exit 1 | |
| fi |