name: Reject generated-only commits

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  generated-commit-guard:
    runs-on: ubuntu-latest
    steps:
      - name: Check every proposed commit
        env:
          PUSH_BEFORE: ${{ github.event.before }}
          PR_BASE: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.sha }}
        run: |
          set -eu
          apt-get update -qq >/dev/null
          apt-get install -y -qq git python3 >/dev/null
          WORK="$(mktemp -d)"
          trap 'rm -rf "$WORK"' EXIT
          git clone --quiet "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}.git" "$WORK/repo"
          cd "$WORK/repo"
          git fetch --quiet origin "$HEAD_SHA"
          git checkout --quiet --detach "$HEAD_SHA"
          BASE="${PR_BASE:-${PUSH_BEFORE:-}}"
          if [ -z "$BASE" ] || [ "$BASE" = 0000000000000000000000000000000000000000 ]; then
            BASE="$(git rev-parse HEAD^)"
          fi
          git fetch --quiet origin "$BASE"
          python3 scripts/check_generated_only_commit.py --range "$BASE..$HEAD_SHA"