release_block_manual_pr.yml

# Blocks PRs targeting the release branch that are not created by the release GHA workflow.
#
# This works because workflows cannot trigger other workflows unless they call them directly.
# As a result, this workflow will only run with a PR targeting release is manually created.
#
# https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow

name: Block Manual PR to Release

on:
  pull_request:
    branches:
      - release

permissions:
  pull-requests: write

jobs:
  check:
    name: Block Manual PR to Release
    runs-on: ubuntu-latest

    steps:      
      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b

      - name: Close PR
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          gh pr close $PR_NUMBER --comment "Invalid PR!  PRs targeting the release branch must be created by the GHA release workflow."