chore(dependabot): cap open pull requests per update block #111
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # This workflow is managed by gh actions-lock. | |
| # This workflow is managed by gh actions-lock. | |
| # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> | |
| # | |
| # placement-guard.yml — Coordination-repo content placement guard. | |
| # nextgen-databases is a COORDINATION repo: per-database implementation content belongs | |
| # in each database's own repo (see REGISTRY.adoc), not here. This gate FAILS a PR/push | |
| # that ADDS files outside the allowed coordination paths. | |
| name: Placement Guard | |
| on: | |
| pull_request: | |
| branches: ['**'] | |
| push: | |
| branches: [main, master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| placement: | |
| name: Content placement check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Determine added files | |
| id: diff | |
| run: | | |
| set -uo pipefail | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| git fetch --no-tags origin "${{ github.base_ref }}" || true | |
| BASE="origin/${{ github.base_ref }}" | |
| else | |
| BASE="${{ github.event.before }}" | |
| case "$BASE" in | |
| 0000000000000000000000000000000000000000|"") BASE="$(git rev-parse HEAD~1 2>/dev/null || echo origin/main)" ;; | |
| esac | |
| fi | |
| echo "Comparing against: $BASE" | |
| git diff --name-only --diff-filter=A "$BASE...HEAD" > /tmp/added.txt 2>/dev/null \ | |
| || git diff --name-only --diff-filter=A "$BASE" HEAD > /tmp/added.txt | |
| echo "Added files:"; cat /tmp/added.txt || true | |
| - name: Check placement | |
| run: | | |
| set -uo pipefail | |
| # Allowed coordination paths (regex, anchored at repo root). | |
| ALLOW='^(README|EXPLAINME|TOPOLOGY|ROADMAP|TOOLING-STATUS|REGISTRY|CONTRIBUTING|CODE_OF_CONDUCT|SECURITY|MAINTAINERS|NOTICE|LICENSE|PROOF-NEEDS|TEST-NEEDS|QUICKSTART-[A-Z]+|0-AI-MANIFEST|CLAUDE|AGENTS|llm-warmup-[a-z]+)\.[A-Za-z0-9]+$' | |
| # `.githooks` added 2026-07-27. It is repo infrastructure, not database | |
| # content — git resolves core.hooksPath relative to the worktree root, | |
| # so it must live there, exactly like .github/ and .claude/ which were | |
| # already allowed. | |
| # | |
| # This became load-bearing when #59 landed .githooks/validate-a2ml.sh and | |
| # validate-k9.sh: those files are tracked on main today, so the next PR | |
| # touching either one is flagged "Misplaced content" and fails the guard. | |
| # | |
| # rsr-template-repo's own root-allow.txt records the identical omission for | |
| # the identical directory — it "failed check-root-shape.sh on this repo | |
| # itself and on every repo instantiated from it". An oversight, not a policy. | |
| ALLOW="$ALLOW"'|^(docs|tests|scripts|\.github|\.githooks|\.claude|\.machine_readable|\.bot_directives|\.well-known|\.hypatia|LICENSES|contractiles)/' | |
| ALLOW="$ALLOW"'|^(flake\.nix|guix\.scm|Justfile|contractile\.just|stapeln\.toml|opsm\.toml|setup\.sh|\.gitignore|\.gitattributes|\.editorconfig|\.gitlab-ci\.yml|\.nojekyll)$' | |
| # Legacy per-database dirs (grandfathered: warn, do not fail — being extracted). | |
| # | |
| # `lithoglyph` was removed from this list on 2026-07-27, `verisimdb` on | |
| # 2026-08-03. Both extractions are complete and their files are gone from | |
| # this repo, so a new file under either is no longer "legacy content not | |
| # yet moved" — it is fresh duplication of a repo that already exists. | |
| # Warning would let exactly the defect each extraction fixed grow back. | |
| # Both now fail. | |
| # | |
| # Move a directory out of this list as each extraction completes. | |
| GRANDFATHER='^(quandledb|nqc|typeql-experimental|verisim-core|verisim-modular-experiment)/' | |
| FAIL=0 | |
| while IFS= read -r f; do | |
| [ -z "$f" ] && continue | |
| if echo "$f" | grep -Eq "$ALLOW"; then | |
| continue | |
| fi | |
| if echo "$f" | grep -Eq "$GRANDFATHER"; then | |
| echo "::warning file=${f}::Added inside a legacy database directory. This content should live in its own repo (see REGISTRY.adoc); these directories are being extracted." | |
| continue | |
| fi | |
| echo "::error file=${f}::Misplaced content. nextgen-databases is a coordination repo — this belongs in a database/language repo. See REGISTRY.adoc." | |
| FAIL=1 | |
| done < /tmp/added.txt | |
| { | |
| echo "## Placement Guard" | |
| echo "" | |
| if [ "$FAIL" -eq 0 ]; then | |
| echo ":white_check_mark: No misplaced new content detected." | |
| else | |
| echo ":x: New files were added outside the allowed coordination paths." | |
| echo "" | |
| echo "\`nextgen-databases\` is a **coordination repo**. Per-database code, schemas," | |
| echo "docs, and query languages belong in their own repos — see \`REGISTRY.adoc\`." | |
| fi | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| exit $FAIL |