Repository navigation
Conversation
Adds a 'rc branch only' check that fails unless the PR's head is an rc-* branch of this repository. It runs via pull_request_target so the PR under review cannot alter it, and never checks out PR code.
prabod
force-pushed
the
chore/main-pr-source-guard
branch
from
October 26, 2026 12:42
4f037ec to
8591ddd
Compare
A dependabot/* branch passes only when the PR's author is dependabot[bot]; the branch name alone could be pushed by anyone with write access.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the new
mainguard (rulesets main: pull requests only and main: only main-maintainers merge are already active).Adds a
rc branch onlycheck that fails unless a PR intomaincomes from anrc-*branch of this repo (forks rejected). It runs onpull_request_target, so it usesmain's copy of the workflow and a PR can't edit its own check. It never checks out PR code and haspermissions: {}.Bootstrap note: this PR is the one exception to rc-only.
pull_request_targetonly runs workflows that are already onmain, so the check can't exist until this merges. After merge,rc branch onlygets added as a required check in the ruleset.Effect: hotfixes like #34 / #37 (
fix/*→main) now have to go through the current rc branch.