---
name: Main Branch Source Guard

on:
  pull_request:
    branches: [main]
    types: [opened, reopened, synchronize, edited]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  guard:
    name: Guard main branch source
    runs-on: ubuntu-latest
    steps:
      - name: Verify pull request source branch
        env:
          HEAD_REF: ${{ github.head_ref }}
        run: |
          if [[ "${HEAD_REF}" == "next" || "${HEAD_REF}" == hotfix-* ]]; then
            echo "Head branch '${HEAD_REF}' is allowed to target main."
            exit 0
          fi
          echo "::error::Pull requests into main must come from 'next' or a 'hotfix-*' branch (got '${HEAD_REF}'). See ADR-0008 (z-shell/.github) for the branching model."
          exit 1