Setting the file. One moment. 11.14
Plugin Marketplace
workflows/squad-main-guard.yml
workflows/squad-main-guard.yml
YAML·87 lines·3 KB
11
12jobs:
13 guard:
14 runs-on: ubuntu-latest
15 steps:
16 - uses: actions/checkout@v4
17
18 - name: Check for forbidden paths
19 uses: actions/github-script@v7
20 with:
21 script: |
22 // Fetch all files changed in this PR (paginated)
23 const files = [];
24 let page = 1;
25 while (true) {
26 const resp = await github.rest.pulls.listFiles({
27 owner: context.repo.owner,
28 repo: context.repo.repo,
29 pull_number: context.payload.pull_request.number,
30 per_page: 100,
31 page
32 });
33 files.push(...resp.data);
34 if (resp.data.length < 100) break;
35 page++;
36 }
37
38 // Check each file against forbidden path rules
39 // Allow removals — deleting forbidden files from protected branches is fine
40 const forbidden = files
41 .filter(f => f.status !== 'removed')
42 .map(f => f.filename)
43 .filter(f => {
44 // .ai-team/** — ALL team state files, zero exceptions
45 if (f === '.ai-team' || f.startsWith('.ai-team/')) return true;
46 // team-docs/** — ALL internal team docs, zero exceptions
47 if (f.startsWith('team-docs/')) return true;
48 return false;
49 });
50
51 if (forbidden.length === 0) {
52 core.info('✅ No forbidden paths found in PR — all clear.');
53 return;
54 }
55
56 // Build a clear, actionable error message
57 const lines = [
58 '## 🚫 Forbidden files detected in PR to main',
59 '',
60 'The following files must NOT be merged into `main`.',
61 '`.ai-team/` is runtime team state — it belongs on dev branches only.',
62 '`team-docs/` is internal team content — it belongs on dev branches only.',
63 '',
64 '### Forbidden files found:',
65 '',
66 ...forbidden.map(f => `- \`${f}\``),
67 '',
68 '### How to fix:',
69 '',
70 '```bash',
71 '# Remove tracked .ai-team/ files (keeps local copies):',
72 'git rm --cached -r .ai-team/',
73 '',
74 '# Remove tracked team-docs/ files:',
75 'git rm --cached -r team-docs/',
76 '',
77 '# Commit the removal and push:',
78 'git commit -m "chore: remove forbidden paths from PR"',
79 'git push',
80 '```',
81 '',
82 '> ⚠️ `.ai-team/` is committed on `dev` and feature branches by design.',
83 '> The guard workflow is the enforcement mechanism that keeps these files off `main` and `preview`.',
84 '> `git rm --cached` untracks them from this PR without deleting your local copies.',
85 ];
86
87 core.setFailed(lines.join('\n'));