molecule-core/.gitea/workflows/pr-diff-guard.yml

name: PR Diff Guard

# core#2875: block stale PR branches that have drifted into massive,
# destructive diffs against current main (e.g., PR #1100: 481 files,
# ~55k deletions). Runs on every PR and fails when configured size or
# protected-path deletion thresholds are exceeded.

concurrency:
  # Auto-cancel a superseded run: a newer commit/event supersedes the old
  # one instead of leaving it queued forever (root fix for waiting-run pileup).
  # PR events group by PR number; push events group by ref.
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
on:
  # The override path needs trusted API credentials to verify who applied the
  # label. Run base-branch code only; never execute the PR's version of the
  # guard while the workflow token is in scope.
  pull_request_target:
    branches: [main, staging]
    types: [opened, synchronize, reopened, labeled, unlabeled]

permissions:
  contents: read
  issues: read
  pull-requests: read

jobs:
  # bp-required: yes
  # New gate; wiring into branch protection will follow once it has
  # green history and the thresholds are calibrated.
  diff-guard:
    name: PR diff guard
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          # Full history is required to compute the merge-base against origin/main.
          fetch-depth: 0

      - name: Fetch PR head without checking it out
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: git fetch --no-tags origin "refs/pull/${PR_NUMBER}/head"

      - name: Run PR diff guard
        env:
          PR_BASE_REF: ${{ github.base_ref }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          GITEA_SERVER_URL: ${{ github.server_url }}
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python3 .gitea/scripts/pr-diff-guard.py