From b4226ceb53bb8bf023df708d06bd2303ad9f42ed Mon Sep 17 00:00:00 2001
From: Maghuro <1546139+maghuro@users.noreply.github.com>
Date: Wed, 23 Sep 2026 23:47:43 +0100
Subject: [PATCH] Harden pull request source check

---
 .github/workflows/Check-PRsource.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/Check-PRsource.yml b/.github/workflows/Check-PRsource.yml
index 4f6babf8..fadb9e99 100644
--- a/.github/workflows/Check-PRsource.yml
+++ b/.github/workflows/Check-PRsource.yml
@@ -6,13 +6,15 @@ on:
       - reopened
       - synchronize
       - edited
+
+permissions: {}
+
 jobs:
   check-branches:
     runs-on: ubuntu-latest
     steps:
-      - name: Check branches
+      - name: Reject non-dev pull requests to main
+        if: github.base_ref == 'main' && github.head_ref != 'dev'
         run: |
-          if [ ${{ github.head_ref }} != "dev" ] && [ ${{ github.base_ref }} == "main" ]; then
-            echo "Merge requests to main branch are only allowed from dev branch."
-            exit 1
-          fi
+          echo "Merge requests to main branch are only allowed from dev branch."
+          exit 1