From c182bff5b6f38fe7cef2a7b323e4ba350be512f7 Mon Sep 17 00:00:00 2001
From: berfinyuksel <99557970+berfinyuksel@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:02:41 +0200
Subject: [PATCH 1/2] Add PR Guardrails trigger workflow (platform-version#226)

---
 .github/workflows/pr-guardrails.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/pr-guardrails.yml

diff --git a/.github/workflows/pr-guardrails.yml b/.github/workflows/pr-guardrails.yml
new file mode 100644
index 0000000..fcfce60
--- /dev/null
+++ b/.github/workflows/pr-guardrails.yml
@@ -0,0 +1,27 @@
+name: PR Guardrails
+
+# Thin, generic trigger. All guardrail logic lives in the central collection
+# pimcore/workflows-collection-public. This file names no guardrails and no
+# secrets (secrets: inherit), so it is identical across every repo and never
+# needs editing when a guardrail or token is added/removed there.
+
+on:
+  pull_request_target:
+    types: [opened, reopened, ready_for_review, converted_to_draft, edited, synchronize]
+  check_suite:
+    types: [completed]
+
+concurrency:
+  # One lock per PR. On pull_request_target → PR number. On check_suite there is
+  # no PR number, so use the PR from the check_suite payload (present for
+  # same-repo PRs) to share the same lock; fall back to the commit SHA for fork
+  # PRs, then to run_id so the key is never empty.
+  # A guardrail can convert the PR to draft, which fires converted_to_draft;
+  # give that its own group so it does not cancel the run still acting on the PR.
+  group: pr-guardrails-${{ github.event.action == 'converted_to_draft' && 'retract-' || '' }}${{ github.event.pull_request.number || github.event.check_suite.pull_requests[0].number || github.event.check_suite.head_sha || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  guardrails:
+    uses: pimcore/workflows-collection-public/.github/workflows/parent-pr-guardrails.yml@main
+    secrets: inherit

From daedae8ac4273a49418980b676f94ca3da914f81 Mon Sep 17 00:00:00 2001
From: berfinyuksel <99557970+berfinyuksel@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:45:32 +0200
Subject: [PATCH 2/2] Pass only the three guardrail tokens instead of secrets:
 inherit

---
 .github/workflows/pr-guardrails.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-guardrails.yml b/.github/workflows/pr-guardrails.yml
index fcfce60..ad315d6 100644
--- a/.github/workflows/pr-guardrails.yml
+++ b/.github/workflows/pr-guardrails.yml
@@ -24,4 +24,7 @@ concurrency:
 jobs:
   guardrails:
     uses: pimcore/workflows-collection-public/.github/workflows/parent-pr-guardrails.yml@main
-    secrets: inherit
+    secrets:
+      MEMBERSHIP_GUARD_TOKEN: ${{ secrets.MEMBERSHIP_GUARD_TOKEN }}
+      ISSUE_LINK_GUARD_TOKEN: ${{ secrets.ISSUE_LINK_GUARD_TOKEN }}
+      CI_GUARD_TOKEN: ${{ secrets.CI_GUARD_TOKEN }}