name: "Direct Push Warning" on: push: branches: - master - release-** permissions: contents: read jobs: build: permissions: contents: write # for peter-evans/commit-comment to comment on commit runs-on: ubuntu-latest if: github.repository_owner == 'NixOS' env: GITHUB_SHA: ${{ github.sha }} GITHUB_REPOSITORY: ${{ github.repository }} steps: - name: Check if commit is a merge commit id: ismerge run: | ISMERGE=$(curl -H 'Accept: application/vnd.github.groot-preview+json' -H "authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/${{ env.GITHUB_REPOSITORY }}/commits/${{ env.GITHUB_SHA }}/pulls | jq -r '.[] | select(.merge_commit_sha == "${{ env.GITHUB_SHA }}") | any') echo "::set-output name=ismerge::$ISMERGE" # github events are eventually consistent, so wait until changes propagate to thier DB - run: sleep 60 if: steps.ismerge.outputs.ismerge != 'true' - name: Warn if the commit was a direct push if: steps.ismerge.outputs.ismerge != 'true' uses: peter-evans/commit-comment@v2 with: body: | @${{ github.actor }}, you pushed a commit directly to master/release branch instead of going through a Pull Request. That's highly discouraged beyond the few exceptions listed on https://github.com/NixOS/nixpkgs/issues/118661