name: Guard generated files

on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: guard-generated-files-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  check:
    name: Generated files must not be hand-edited
    runs-on: ubuntu-latest
    # release-please owns CHANGELOG.md and .release-please-manifest.json; its PR
    # is the one legitimate place those files change, so we exempt its author.
    if: >-
      github.event.pull_request.user.login != 'github-actions[bot]' &&
      github.event.pull_request.user.login != 'release-please[bot]'
    steps:
      - uses: actions/checkout@v6
        with:
          # Need history on both sides of the merge-base so `git diff base...head`
          # reflects exactly what GitHub shows as "Files changed".
          fetch-depth: 0

      - name: Check PR does not modify release-please-generated files
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -eu
          files=$(git diff --name-only "${BASE_SHA}...${HEAD_SHA}")

          violated=""
          for path in CHANGELOG.md .release-please-manifest.json; do
            if printf '%s\n' "$files" | grep -qxF -- "$path"; then
              violated="${violated} ${path}"
            fi
          done

          if [ -n "$violated" ]; then
            {
              echo "::error::This PR modifies release-please-generated files:${violated}"
              echo
              echo "CHANGELOG.md and .release-please-manifest.json are auto-generated by"
              echo "release-please from conventional commits on main. Do not hand-edit them."
              echo
              echo "If you want your change to appear in the next release notes, use a"
              echo "conventional commit message (feat/fix/docs/...). release-please will"
              echo "update these files in the next release PR automatically."
              echo
              echo "See CONTRIBUTING.md for the full contributor workflow."
            } >&2
            exit 1
          fi

          echo "No release-please-generated files modified. OK."