pr-gate.yml

name: pr-gate

# Server-side mirror of the local pre-commit hook's enforcement.
# Closes Web UI bypass paths for branch-scope and base-branch rules.
#
# Triggers on every pull_request event (no branch filter) so a PR with
# the wrong base — e.g. culture/germany -> main bypassing culture/release —
# is also caught here. The base-branch-check job decides if the head/base
# pair is even allowed.
#
# Adding a check: define a new job below and run a tests/validate_pr_*.py
# helper. Keep CI logic in Python (testable) and yaml as orchestration only.
#
# Note on the validation stamp: this workflow used to include a third job
# (stamp-tree-hash-check) that verified .validation-stamp equalled the
# tree hash of HEAD. That gate was dropped because API-driven PR pushes
# (via the GitHub MCP / web UI) cannot run the local pre-commit hook to
# refresh the stamp, which created persistent friction. The remaining
# protection is the cultures - Validation stamp gate in validate.yml
# (file existence check, regions-only) plus every actual validator job in
# validate.yml. Branch protection still requires those checks before merge.

on:
  pull_request:

jobs:
  base-branch-check:
    name: pr-gate - Allowed base for head
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Verify PR base matches head's allowed target
        run: |
          python3 tests/validate_pr_base.py \
            "${{ github.head_ref }}" \
            "${{ github.base_ref }}"

  branch-scope-check:
    name: pr-gate - Diff within branch scope
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # Need history back to the merge base so `base...HEAD` works.
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Verify diff stays inside head branch's allowed paths
        run: |
          python3 tests/validate_pr_scope.py \
            "${{ github.head_ref }}" \
            "origin/${{ github.base_ref }}"