name: Enforce PR-only Workflow

on:
  push:
    branches: [main]

jobs:
  check-pr-merge:
    runs-on: ubuntu-latest
    steps:
      - name: Check if push is from PR merge
        uses: actions/github-script@v7
        with:
          script: |
            const { data: commits } = await github.rest.repos.listCommits({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: context.sha,
              per_page: 1
            });
            
            const commit = commits[0];
            const commitMessage = commit.commit.message;
            
            // Check if this is a merge commit from a PR
            const isMergeCommit = commit.parents.length > 1;
            const hasMergeMessage = commitMessage.includes('Merge pull request') || 
                                   commitMessage.includes('Merge branch');
            
            // Check for GitHub Actions bot (renovate, dependabot, etc)
            const isBot = commit.author?.type === 'Bot' || 
                         commit.committer?.type === 'Bot' ||
                         (commit.author?.login && ['dependabot[bot]', 'renovate[bot]'].includes(commit.author.login));
            
            if (!isMergeCommit && !hasMergeMessage && !isBot) {
              const errorMsg = "DIRECT PUSH TO MAIN DETECTED - This repository requires all changes to go through a Pull Request. See CONTRIBUTING.md for details.";
              core.setFailed(errorMsg);
            }
            
            console.log('✅ Push is from PR merge or authorized bot');
