From c704e531022238d3561666be43fa2745038402df Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Mon, 4 May 2026 19:34:45 -0500
Subject: [PATCH] =?UTF-8?q?enforce=20source=20branch=20in=20CI:=20stage?=
 =?UTF-8?q?=E2=86=90dev,=20main=E2=86=90stage?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ql/.gitea/workflows/ci-stage.yaml | 10 ++++++++++
 ql/.gitea/workflows/release.yaml  | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/ql/.gitea/workflows/ci-stage.yaml b/ql/.gitea/workflows/ci-stage.yaml
index 734a59a..4f822ab 100644
--- a/ql/.gitea/workflows/ci-stage.yaml
+++ b/ql/.gitea/workflows/ci-stage.yaml
@@ -19,6 +19,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Enforce source branch (stage ← dev only)
+        if: github.event_name == 'pull_request'
+        run: |
+          SOURCE="${GITHUB_HEAD_REF}"
+          if [ "${SOURCE}" != "dev" ]; then
+            echo "ERROR: Stage branch only accepts PRs from 'dev'. Source was: '${SOURCE}'"
+            exit 1
+          fi
+          echo "Source branch check passed: ${SOURCE} → stage"
+
       - name: Install build dependencies
         run: |
           apt-get update -qq
diff --git a/ql/.gitea/workflows/release.yaml b/ql/.gitea/workflows/release.yaml
index 30b9d45..3624ee8 100644
--- a/ql/.gitea/workflows/release.yaml
+++ b/ql/.gitea/workflows/release.yaml
@@ -21,6 +21,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Enforce source branch (main ← stage only)
+        if: github.event_name == 'pull_request'
+        run: |
+          SOURCE="${GITHUB_HEAD_REF}"
+          if [ "${SOURCE}" != "stage" ]; then
+            echo "ERROR: Main branch only accepts PRs from 'stage'. Source was: '${SOURCE}'"
+            exit 1
+          fi
+          echo "Source branch check passed: ${SOURCE} → main"
+
       - name: Install build dependencies
         run: |
           apt-get update -qq