live-protection.yml

on: [pull_request]

permissions:
  contents: read

jobs:
  comment:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit

      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
        env:
          SHOULD_COMMENT: ${{ github.base_ref == 'refs/heads/live' && !(github.event.issue.user.login == 'cxwtool' || github.head_ref == 'refs/heads/main') }}
        with:
          script: |
            if (process.env.SHOULD_COMMENT == 'true') {
              github.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: 'It looks like this pull request may have been opened on the `live` branch by mistake. In general, PRs should target the `main` branch.'
              })
            }