feat(action): trust-check/validate-source-branch - Validate PR source branch
@aRustyDev is already working on this.
Since Jan 27, 2026.
Assessment
This issue has not been assessed yet.
Description
Parent Epic
Part of #22 (Atomic Release Pipeline Actions)
Priority
P2 - Security validation for W5
Description
Create a composite action that validates a PR's source branch matches an expected pattern.
Used to enforce that PRs to protected branches come from expected source branches.
Inputs
| Input | Required | Default | Description |
|---|---|---|---|
source-branch |
Yes | - | The source branch of the PR |
allowed-pattern |
Yes | - | Allowed branch pattern (glob supported) |
Outputs
| Output | Description |
|---|---|
valid |
"true" if branch matches pattern |
pattern-matched |
The pattern that matched (for multiple patterns) |
Usage Example
# Single pattern
- uses: arustydev/gha/actions/trust-check/validate-source-branch@v1
with:
source-branch: ${{ github.head_ref }}
allowed-pattern: "charts/*"
# Multiple patterns (comma-separated)
- uses: arustydev/gha/actions/trust-check/validate-source-branch@v1
with:
source-branch: ${{ github.head_ref }}
allowed-pattern: "charts/*,hotfix/*,release/*"
Source Reference
helm-charts/.github/scripts/attestation-lib.sh:
validate_source_branch()(lines 296-314)
Implementation Notes
- Support glob patterns (e.g.,
charts/*) - Support multiple patterns (comma-separated)
- Fail with clear error message on mismatch
- Dominant language
- Shell
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aRustyDev/gh
-
dependencies github-actions
Difficulty 1/5 Under an hour Newbie friendliness 10/100
-
dependencies github-actions
Difficulty 1/5 Under an hour Newbie friendliness 15/100
-
dependencies github-actions
Difficulty 1/5 Under an hour Newbie friendliness 50/100
-
dependencies github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 20/100
-
dependencies github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 10/100
Similar issues
-
align on terminology Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
CycloneDX/transparency-exchange-api#393 · 1 comment ·
-
module/agent platform/macos type/bug/regression
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
CachyOS/cachyos-aur-derived#754 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
CrowdStrike/falcon-scripts#528 ·
-
bug(cli): hapi doctor inline-media prints a fabricated B:\ helper-script path in packaged installs Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100