Enforce single commit PRs

Change: single-commit-pr

Author: christian-schilling

.github/workflows/convert-pr-to-draft-on-fail.yml

@@ -0,0 +1,48 @@
+# .github/workflows/convert-pr-to-draft-on-fail.yml
+name: Convert PR to draft on failure (single commit check)
+
+on:
+  workflow_run:
+    workflows: ["Enforce single commit & up-to-date"]
+    types: [completed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  convert:
+    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'pull_request' }}
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Convert associated PR to draft
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+            const prs = run.pull_requests || [];
+            if (prs.length === 0) {
+              core.info('No pull request associated with this run.');
+              return;
+            }
+            const prNumber = prs[0].number;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const { data: pr } = await github.request('GET /repos/{owner}/{repo}/pulls/{pull_number}', {
+              owner,
+              repo,
+              pull_number: prNumber,
+              headers: { 'X-GitHub-Api-Version': '2022-11-28' }
+            });
+            if (pr.draft) {
+              core.info(`PR #${prNumber} is already draft.`);
+              return;
+            }
+            await github.request('POST /repos/{owner}/{repo}/pulls/{pull_number}/convert-to-draft', {
+              owner,
+              repo,
+              pull_number: prNumber,
+              headers: { 'X-GitHub-Api-Version': '2022-11-28' }
+            });
+            core.info(`Converted PR #${prNumber} to draft.`);
+

.github/workflows/pr-single-commit-up-to-date.yml

@@ -0,0 +1,55 @@
+# .github/workflows/pr-single-commit-up-to-date.yml
+name: Enforce single commit & up-to-date
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  check-ahead-behind:
+    if: ${{ !github.event.pull_request.draft }}
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout PR HEAD (full history)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Fetch base branch
+        run: |
+          git fetch origin ${{ github.event.pull_request.base.ref }}
+
+      - name: Compute ahead/behind
+        id: ab
+        shell: bash
+        run: |
+          BASE_SHA=${{ github.event.pull_request.base.sha }}
+          read BEHIND AHEAD < <(git rev-list --left-right --count ${BASE_SHA}...HEAD)
+          echo "head=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+          echo "base=${BASE_SHA}" >> $GITHUB_OUTPUT
+          echo "behind=$BEHIND" >> $GITHUB_OUTPUT
+          echo "ahead=$AHEAD"   >> $GITHUB_OUTPUT
+          echo "Behind: $BEHIND, Ahead: $AHEAD"
+
+      - name: Enforce rule
+        shell: bash
+        run: |
+          BASE=${{ steps.ab.outputs.base }}
+          HEAD=${{ steps.ab.outputs.head}}
+          BEHIND=${{ steps.ab.outputs.behind }}
+          AHEAD=${{ steps.ab.outputs.ahead }}
+          if [[ "$BEHIND" -ne 0 || "$AHEAD" -ne 1 ]]; then
+            echo "PR must be exactly 1 commit ahead and 0 behind the base branch."
+            echo "base=$BASE, HEAD=$HEAD"
+            echo "Ahead=$AHEAD, Behind=$BEHIND"
+            echo "Rebase and squash to fix."
+            exit 1
+          fi
+          echo "OK: PR is exactly 1 ahead and 0 behind."
+
+      # Draft conversion is handled by a separate workflow via workflow_run

Cargo.lock

@@ -21,3 +21,4 @@ clap = { workspace = true }
 rs_tracing = { workspace = true }
 juniper = { workspace = true }
 git2 = { workspace = true }
+toml = { workspace = true }