From 609976bb66b6a573c53d456471a68b19081c1afe Mon Sep 17 00:00:00 2001
From: Tim Jenness <tjenness@lsst.org>
Date: Wed, 21 Aug 2024 14:41:42 -0700
Subject: [PATCH] Add protection against merging with DO NOT MERGE commits

---
 .github/workflows/do_not_merge.yaml | 41 +++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .github/workflows/do_not_merge.yaml

diff --git a/.github/workflows/do_not_merge.yaml b/.github/workflows/do_not_merge.yaml
new file mode 100644
index 0000000..85bc37e
--- /dev/null
+++ b/.github/workflows/do_not_merge.yaml
@@ -0,0 +1,41 @@
+name: "Check commits can be merged"
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  do-not-merge-checker:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check that there are no commits that should not be merged
+        uses: gsactions/commit-message-checker@v2
+        with:
+          excludeDescription: "true"  # optional: this excludes the description body of a pull request
+          excludeTitle: "true"  # optional: this excludes the title of a pull request
+          checkAllCommitMessages: "true"  # optional: this checks all commits associated with a pull request
+          accessToken: ${{ secrets.GITHUB_TOKEN }}  # github access token is only required if checkAllCommitMessages is true
+          # Check for message indicating that there is a commit that should
+          # not be merged.
+          pattern: ^(?!DO NOT MERGE)
+          flags: "i"
+          error: |
+            "This step failed because there is a commit containing the text
+            'DO NOT MERGE'. Remove this commit from the branch before merging
+            or change the commit summary."
+
+      - uses: actions/checkout@v4
+
+      - name: Check requirements.txt for branches
+        shell: bash
+        run: |
+          FILE="requirements.txt requirements/main.in requirements/test.in"
+          MATCH=tickets/DM-
+          if grep -q $MATCH $FILE
+          then
+            echo "Ticket branches found in $FILE:"
+            grep -n $MATCH $FILE
+            exit 1
+          fi