name: Refs guard

on:
  # Body edits are load-bearing: #200 gained its accidental closing keyword
  # after the PR opened, with no new commit to wake ordinary CI (#218).
  pull_request:
    types: [opened, edited, reopened, synchronize]

permissions:
  contents: read
  pull-requests: read

jobs:
  refs-not-closing:
    # The action is portable (#199): its gather is two REST reads through the
    # shim plus this repo's own closing-keyword parser, so it produces a real
    # verdict on either forge. It still refuses by name when it cannot read —
    # that is its contract, and its contract test.
    #
    # #199 removed the forge gate that used to sit here. While the action's
    # only gather was GraphQL it could do nothing but refuse on Forgejo, and
    # scheduling a permanently red required check would have blocked every
    # merge on this forge; a skipped check is a green head, an invented
    # verdict is not. The gather is REST now, so the job RUNS here and
    # produces verdicts again.
    #
    # Deleting the action's client declaration without deleting this gate
    # would have left it portable and never scheduled — a guard that passes
    # by never running, which is this repo's blind-sweep shape wearing a
    # different hat (@kimi-reviewer-andresmgsl, #198).
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./actions/refs-not-closing