name: Refs guard

on:
  # Body edits are load-bearing: #200 gained its accidental closing keyword
  # after the PR opened, with no new commit to wake ordinary CI (#218).
  pull_request:
    types: [opened, edited, reopened, synchronize]

permissions:
  contents: read
  pull-requests: read

jobs:
  refs-not-closing:
    # The action is gh-only until #199: its whole gather is a GraphQL query,
    # and Forgejo serves no GraphQL at all. The ACTION refuses by name on a
    # backend it cannot speak (that is its contract, and its contract test);
    # scheduling it where it can only refuse is this workflow's decision, and
    # a permanently red required check would block every merge on this forge
    # for a gap #199 already owns. So the job does not run there — a skipped
    # check is a green head, an invented verdict is not.
    #
    # The condition mirrors lib/forge.sh's forge_detect positively: only
    # github.com is accepted, and anything else — Forgejo, or a host this
    # file has not met — is not run. "Never 'probably github'."
    if: ${{ github.server_url == 'https://github.com' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./actions/refs-not-closing