makefile-blocker.yml

# SPDX-License-Identifier: MPL-2.0
name: Makefile Blocker

on:
  push:
    paths:
      - '**/Makefile'
      - '**/Makefile.*'
      - '**/*.mk'
  pull_request:
    paths:
      - '**/Makefile'
      - '**/Makefile.*'
      - '**/*.mk'

# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
# updates do not pile up queued runs against the shared account-wide
# Actions concurrency pool. Applied only to read-only check workflows
# (no publish/mutation), so cancelling a superseded run is always safe.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  block-makefiles:
    timeout-minutes: 10
    name: Block Makefile Changes
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4

      - name: Fail on Makefile presence
        run: |
          echo "::error::Makefiles are not permitted in Hyperpolymath repositories."
          echo ""
          echo "Use the Mustfile/justfile system instead:"
          echo "  - Mustfile: Mandatory checks (see hyperpolymath/mustfile)"
          echo "  - justfile: Build recipes (https://just.systems)"
          echo "  - mustfile.toml: Configuration"
          echo ""
          echo "Found Makefiles:"
          find . -name "Makefile" -o -name "Makefile.*" -o -name "*.mk" | grep -v ".github"
          echo ""
          echo "To migrate, see: https://github.com/hyperpolymath/mustfile"
          exit 1