pr-enforce-patch-only.yml

# Enforces changes merged to main to be of patch only. Activated during code-freeze.
name: Enforce Patch Only

on:
  workflow_call:
    secrets:
      github-token:
        required: true
        description: A GitHub token with access to the issues of the calling repo

jobs:
  enforce-patch-label:
    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5
        with:
          mode: exactly
          count: 0
          labels: "calver: monthly, calver: breaking, semver: major, semver: minor"
          add_comment: true
          token: ${{ secrets.github-token }}
          message: "Currently, only patch changes are allowed on main. Your PR labels ({{ applied }}) indicate that it cannot be merged into the main at this time."