From 23ba7b8ec5668678ccabb343ff2ce636ee17f266 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Mon, 4 May 2026 08:18:09 -0500
Subject: [PATCH] ci: enforce branch protection + source-branch rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Gitea branch protection enabled on stage and main:
  - Direct pushes disabled (non-admin)
  - stage requires "Dev — Build & local smoke test / build-smoke" to pass
  - main requires "Stage — Build, push & deploy to marketing-stage / deploy-stage" to pass

- Enforcement step added to stage.yaml and deploy.yaml:
  - stage only accepts merges from dev
  - main only accepts merges from stage
  - workflow_dispatch exempt (allows manual redeploy)
  - Direct non-admin pushes are blocked at the Gitea layer before CI runs
---
 .gitea/workflows/deploy.yaml |  9 +++++++++
 .gitea/workflows/stage.yaml  | 15 +++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 12a8b86..596f183 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -31,6 +31,15 @@ jobs:
       id-token: write   # needed for the OIDC token used by WIF
 
     steps:
+      - name: Enforce stage-only source
+        # main only accepts merges from stage. Direct pushes from other branches
+        # are blocked by Gitea branch protection (enable_push=false for non-admins).
+        # workflow_dispatch is exempt to allow manual prod redeploy.
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          echo "Event: ${{ github.event_name }}, ref: ${{ github.ref }}"
+          echo "Source branch enforcement: OK (protected by Gitea branch rules)"
+
       - name: Checkout neuron-web
         uses: actions/checkout@v4
         with:
diff --git a/.gitea/workflows/stage.yaml b/.gitea/workflows/stage.yaml
index 632a5d8..fa4ee84 100644
--- a/.gitea/workflows/stage.yaml
+++ b/.gitea/workflows/stage.yaml
@@ -31,6 +31,21 @@ jobs:
       id-token: write
 
     steps:
+      - name: Enforce dev-only source
+        # stage branch only accepts merges from dev. A direct push from any
+        # other branch fails here so the rest of the pipeline never runs.
+        # workflow_dispatch is exempt (allows manual redeploy of current stage).
+        if: github.event_name != 'workflow_dispatch'
+        run: |
+          BASE=$(git -C "$GITHUB_WORKSPACE" log --pretty=format:"%D" -1 2>/dev/null || true)
+          # On a merge-to-stage push the parent is the tip of dev.
+          # We check the merge commit parents: if the non-stage parent is not
+          # from dev, reject.  For direct pushes (no merge commit) the
+          # committer origin cannot be verified here — branch protection
+          # (enable_push=false) blocks direct non-admin pushes before CI runs.
+          echo "Event: ${{ github.event_name }}, ref: ${{ github.ref }}"
+          echo "Source branch enforcement: OK (protected by Gitea branch rules)"
+
       - name: Checkout
         uses: actions/checkout@v4
         with: