From e6b811e2576b23e018fe6b752e76d4d2d4975ac7 Mon Sep 17 00:00:00 2001
From: hootandy321 <133196559+hootandy321@users.noreply.github.com>
Date: Tue, 29 Sep 2026 03:19:49 -0400
Subject: [PATCH] ci: reject branches built on unrelated history

The repository has a single root commit. Fail pull requests and main pushes
whose history contains any other root, so a branch derived from a different
repository's history cannot be merged by accident; such a branch has to be
rebuilt on main, for example by cherry-picking.

To make it blocking, add "Single root commit" as a required status check for
main, alongside the Commit policy check.

Signed-off-by: hootandy321 <133196559+hootandy321@users.noreply.github.com>
---
 .github/workflows/history-guard.yml | 33 +++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/history-guard.yml

diff --git a/.github/workflows/history-guard.yml b/.github/workflows/history-guard.yml
new file mode 100644
index 0000000..705ca32
--- /dev/null
+++ b/.github/workflows/history-guard.yml
@@ -0,0 +1,33 @@
+name: History guard
+
+# The repository has a single root commit. A branch whose history contains any
+# other root was built on unrelated history and must not be merged; rebuild it
+# on main instead.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  single-root:
+    name: Single root commit
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Reject unrelated history
+        run: |
+          expected="7b6a2f555a6bc2659fb06a10469384413baa1b1e"
+          foreign="$(git rev-list --max-parents=0 HEAD | grep -vx "$expected" || true)"
+          if [ -n "$foreign" ]; then
+            echo "::error::History contains root commits other than $expected: $foreign. Rebuild the branch on main (cherry-pick) instead."
+            exit 1
+          fi
+          echo "Single root commit: $expected"