assert-base-is-default-branch.yml

name: PR base guard

# Reject PRs whose base is not the repo's default branch.
# Stacked PRs (PR-on-PR) are not supported here: under squash merge the
# downstream PR's base ref still points at the pre-squash commits, so the
# chain silently desyncs. Branch from the default branch and merge serially.

on:
  pull_request:
    types: [opened, reopened, edited, synchronize]

permissions: {}

jobs:
  base-must-be-default:
    runs-on: ubuntu-latest
    steps:
      - name: Reject if base is not the default branch
        env:
          BASE_REF: ${{ github.event.pull_request.base.ref }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          if [ "$BASE_REF" != "$DEFAULT_BRANCH" ]; then
            echo "::error::PR #${PR_NUMBER} base is '${BASE_REF}', must be '${DEFAULT_BRANCH}'."
            echo "Stacked PRs are not supported. Branch from '${DEFAULT_BRANCH}' and merge serially."
            exit 1
          fi
          echo "OK: base '${BASE_REF}' matches default branch."