job-pr-checks.yaml

name: PR Checks
# Authoritative CI enforcement of what the local hooks check (hooks are advisory
# and may not be installed): conventional PR title, no AI-tells/emoji in the
# diff, and a PR body that follows the template + references an issue.
on:
  pull_request:
    branches: [main]
    # edited is here so a title or body edit re-runs the title and body checks.
    types: [opened, synchronize, reopened, ready_for_review, edited]
# One run per PR per workflow: a new push cancels the older PR run.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions:
  contents: read
  pull-requests: read
jobs:
  pr-title:
    name: PR Title
    if: github.event.pull_request.draft != true
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50  # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  pr-hygiene:
    name: PR Hygiene
    if: github.event.pull_request.draft != true
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 0
      - name: Scan changed files
        env:
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          # Reuse the exact rules the local pre-commit hook uses.
          source .claude/hooks/lib.sh
          fail=0
          while IFS= read -r f; do
            [ -f "$f" ] || continue
            case "$f" in
              .git/*) continue ;;
              *.png|*.jpg|*.jpeg|*.gif|*.pdf|*.ico|*.svg|*.woff|*.woff2|*.ttf|*.eot|*.zip|*.gz) continue ;;
            esac
            # Emoji allowed in Markdown and .github; blocked elsewhere.
            case "$f" in
              .github/*|*.md|NOTES.txt|*/NOTES.txt) : ;;
              *) e="$(gov_find_emoji < "$f")"; [ -n "$e" ] && { echo "emoji not allowed in $f:"; echo "$e"; fail=1; } ;;
            esac
            # AI-tells blocked except in files that document the rule.
            case "$f" in
              CLAUDE.md|*/CLAUDE.md|.claude/*|*/.claude/*|.github/workflows/*|*forbidden-text.txt) : ;;
              *) t="$(gov_find_text_tells < "$f")"; [ -n "$t" ] && { echo "AI-tell not allowed in $f:"; echo "$t"; fail=1; } ;;
            esac
          done < <(git diff --name-only --diff-filter=ACM "$BASE" "$HEAD")
          [ "$fail" -eq 0 ] || { echo "pr-hygiene: remove the above before merging."; exit 1; }

  pr-body:
    name: PR Body
    if: github.event.pull_request.draft != true
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check body
        env:
          BODY: ${{ github.event.pull_request.body }}
        # An issue reference is a keyword (GitHub's closing keywords, or Refs),
        # an optional colon, then a reference GitHub links: #12, GH-12,
        # owner/repo#12, or https://github.com/owner/repo/issues/12. Casing is
        # free. A repo without its owner (repo#12) or a fragment on another
        # site does not count, because GitHub does not link those.
        run: |
          fail=0
          owner='[[:alnum:]][[:alnum:]-]*'
          repo='[[:alnum:]._-]+'
          target="(#|gh-|${owner}/${repo}#|https://github\\.com/${owner}/${repo}/issues/)[0-9]+"
          ref="(^|[^[:alnum:]_])(close[sd]?|fix(e[sd])?|resolve[sd]?|refs):?[[:space:]]+${target}([^[:alnum:]_]|\$)"
          printf '%s' "$BODY" | grep -qiE "$ref" \
            || { echo "PR body must reference an issue (e.g. 'Closes #12' or 'Refs owner/repo#12')."; fail=1; }
          printf '%s' "$BODY" | grep -qiE '##[[:space:]]*what' \
            || { echo "PR body must follow the template (a 'What and why' section)."; fail=1; }
          [ "$fail" -eq 0 ] || exit 1