guard-sample-catalog.yml

name: Guard Generated Catalog

# samples/hosted-agent/sample-catalog.json is GENERATED by the "Sync Sample
# Catalog" workflow and must never be edited or committed by hand. This check
# fails any PR that modifies it unless the PR originates from a sync-workflow
# branch (ci/sync-sample-catalog-*).
#
# For this to ENFORCE (not merely report), the protected branch must also:
#   - mark the "guard-catalog" check as a REQUIRED status check, and
#   - disallow direct pushes (PRs only) — a pull_request guard cannot catch a
#     direct push.
#
# A pull_request workflow only guards PRs targeting the branch it lives on, so
# this file must exist on every protected branch you want covered.

on:
  pull_request:

permissions:
  contents: read

jobs:
  guard-catalog:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Reject manual edits to sample-catalog.json
        env:
          HEAD_REF: ${{ github.head_ref }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        shell: bash
        run: |
          set -euo pipefail
          CATALOG="samples/hosted-agent/sample-catalog.json"

          # Did this PR change the generated catalog at all?
          if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- "$CATALOG"; then
            echo "PR does not touch $CATALOG — OK."
            exit 0
          fi

          # It did. Only the Sync Sample Catalog workflow (which opens PRs from
          # ci/sync-sample-catalog-* branches) is allowed to change it.
          if [[ "$HEAD_REF" == ci/sync-sample-catalog-* ]]; then
            echo "Change to $CATALOG came from sync branch '$HEAD_REF' — OK."
            exit 0
          fi

          echo "::error file=$CATALOG::$CATALOG is generated by the 'Sync Sample Catalog' workflow and must not be edited or committed manually. Revert your changes to this file; CI will regenerate it."
          exit 1