Update github action file

2025-11-24 15:12:19 +02:00 · 2025-11-24 15:12:19 +02:00 · 43c343e62c
parent 32a50d1b96
commit 43c343e62c
1 changed files with 152 additions and 0 deletions
--- a/.github/workflows/block_reserved_branches.yml
+++ b/.github/workflows/block_reserved_branches.yml
@ -0,0 +1,152 @@
+name: Block Reserved Branches
+
+on:
+  create:
+    branches:
+      - '**'
+
+jobs:
+  block-reserved-branches:
+    runs-on: app-sever-project-runner
+
+    steps:
+      - name: Validate branch creator + reserved names
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH_NAME: ${{ github.ref_name }}
+          CREATOR: ${{ github.actor }}
+        run: |
+          echo "Branch: $BRANCH_NAME"
+          echo "Creator: $CREATOR"
+
+          #######################################################
+          # 🟦 1) Allowed Users List
+          #######################################################
+          ALLOWED_USERS=(
+            "expsa"
+            "moutazmuhammad"
+            "ronozoro"
+            "Abubaker-Altaib"
+            "altexp"
+            "the5abir"
+            "ahmadaking"
+            "kchyounes19"
+            "abdurrahman-saber"
+            "maltayyar2"
+          )
+
+          IS_ALLOWED="false"
+          for user in "${ALLOWED_USERS[@]}"; do
+            if [[ "$CREATOR" == "$user" ]]; then
+              IS_ALLOWED="true"
+              break
+            fi
+          done
+
+          if [[ "$IS_ALLOWED" == "false" ]]; then
+            echo "❌ User '$CREATOR' is NOT allowed to create branches. Deleting..."
+            curl -s -X DELETE \
+              -H "Authorization: token $GH_TOKEN" \
+              https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME
+            exit 1
+          fi
+
+          echo "✔ User '$CREATOR' is allowed."
+
+          #######################################################
+          # 🟦 2) Reserved Branch Names (Your Existing List)
+          #######################################################
+          RESERVED_NAMES=(
+            master
+            dev_odex25_accounting
+            dev_odex25_base
+            dev_odex25_dms
+            dev_odex25_donation
+            dev_odex25_fleet
+            dev_odex25_helpdesk
+            dev_odex25_hr
+            dev_odex25_inventory
+            dev_odex25_maintenance
+            dev_odex25_mobile
+            dev_odex25_pos
+            dev_odex25_project
+            dev_odex25_purchase
+            dev_odex25_realstate
+            dev_odex25_sales
+            dev_odex25_survey
+            dev_odex25_transactions
+            dev_odex25_website
+            dev_odex-event
+            dev_openeducat_erp-14.0.1.0
+            dev_odex25_benefit
+            dev_odex25_takaful
+            master_odex25_accounting
+            master_odex25_base
+            master_odex25_dms
+            master_odex25_donation
+            master_odex25_fleet
+            master_odex25_helpdesk
+            master_odex25_hr
+            master_odex25_inventory
+            master_odex25_maintenance
+            master_odex25_mobile
+            master_odex25_pos
+            master_odex25_project
+            master_odex25_purchase
+            master_odex25_realstate
+            master_odex25_sales
+            master_odex25_survey
+            master_odex25_transactions
+            master_odex25_website
+            master_odex-event
+            master_openeducat_erp-14.0.1.0
+            master_odex25_benefit
+            master_odex25_takaful
+            preprod_odex25_accounting
+            preprod_odex25_base
+            preprod_odex25_dms
+            preprod_odex25_donation
+            preprod_odex25_fleet
+            preprod_odex25_helpdesk
+            preprod_odex25_hr
+            preprod_odex25_inventory
+            preprod_odex25_maintenance
+            preprod_odex25_mobile
+            preprod_odex25_pos
+            preprod_odex25_project
+            preprod_odex25_purchase
+            preprod_odex25_realstate
+            preprod_odex25_sales
+            preprod_odex25_survey
+            preprod_odex25_transactions
+            preprod_odex25_website
+            preprod_odex-event
+            preprod_openeducat_erp-14.0.1.0
+            preprod_odex25_benefit
+            preprod_odex25_takaful
+          )
+
+          # Exact match
+          for reserved in "${RESERVED_NAMES[@]}"; do
+            if [[ "$BRANCH_NAME" == "$reserved" ]]; then
+              echo "❌ Branch name '$BRANCH_NAME' is reserved. Deleting..."
+              curl -s -X DELETE \
+                -H "Authorization: token $GH_TOKEN" \
+                https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME
+              exit 1
+            fi
+          done
+
+          #######################################################
+          # 🟦 3) Pattern-based Restriction
+          #######################################################
+          if [[ "$BRANCH_NAME" == master_* || "$BRANCH_NAME" == preprod_* || "$BRANCH_NAME" == dev_* ]]; then
+            echo "❌ Branch name '$BRANCH_NAME' matches restricted pattern. Deleting..."
+            curl -s -X DELETE \
+              -H "Authorization: token $GH_TOKEN" \
+              https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME
+            exit 1
+          fi
+
+          echo "✅ Branch '$BRANCH_NAME' is allowed."