fix: restrict unapproved pull requests to bug fixes

2 files changed, 18 insertions, 3 deletions

diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
index c4b2852d..31839235 100644
--- a/.github/ISSUE_TEMPLATE/bug.yml
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -8,7 +8,7 @@ body:
 
         Issues are only for reproducible bugs and maintainer-created or maintainer-converted work items. Feature requests, ideas, questions, contribution proposals, and direction checks belong in [Discussions](https://github.com/ogulcancelik/herdr/discussions).
 
-        Unapproved contributors may open focused PRs when the patch changes no more than 20 files and 1,000 total added or deleted lines. Features and larger changes require maintainer approval first.
+        Unapproved contributors may open focused bug-fix PRs when the title uses `fix: ...` or `fix(scope): ...` and the patch changes no more than 20 files and 1,000 total added or deleted lines. Features and larger changes require maintainer approval first.
 
         Keep this short. If it does not fit on one screen, it is too long. Write in your own voice.
 
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index dd1f5193..192168ad 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -2,7 +2,7 @@ name: PR Gate
 
 on:
   pull_request_target:
-    types: [opened, reopened, synchronize]
+    types: [opened, edited, reopened, synchronize]
 
 jobs:
   check-contributor:
@@ -48,6 +48,13 @@ jobs:
             const prAuthor = pr.user.login;
             const changedLines = pr.additions + pr.deletions;
 
+            const eventPullRequestState = context.payload.pull_request.state;
+            if (action === 'edited' &&
+                (eventPullRequestState !== 'open' || pr.state !== 'open')) {
+              core.info(`Ignoring edits to closed PR #${pullNumber}`);
+              return;
+            }
+
             async function getPermission(username) {
               try {
                 const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
@@ -176,7 +183,7 @@ jobs:
               const message = [
                 `Hi @${prAuthor}, thanks for your interest in contributing!`,
                 '',
-                `Herdr automatically admits unapproved pull requests when the patch changes no more than ${MAX_UNAPPROVED_CHANGED_FILES} files and ${MAX_UNAPPROVED_CHANGED_LINES.toLocaleString('en-US')} total added or deleted lines.`,
+                `Herdr automatically admits focused bug fixes from unapproved contributors when the title uses \`fix: ...\` or \`fix(scope): ...\` and the patch changes no more than ${MAX_UNAPPROVED_CHANGED_FILES} files and ${MAX_UNAPPROVED_CHANGED_LINES.toLocaleString('en-US')} total added or deleted lines.`,
                 '',
                 reason,
                 '',
@@ -238,6 +245,14 @@ jobs:
               return;
             }
 
+            const hasFixTitle = /^fix(?:\([^)]+\))?:\s+\S/.test(pr.title);
+            if (!hasFixTitle) {
+              await closePullRequest(
+                'Unapproved contributors may submit only focused bug fixes. If this pull request fixes a bug, rename it to use a conventional `fix: ...` or `fix(scope): ...` title, then tag a maintainer to review and reopen it.',
+              );
+              return;
+            }
+
             const exceedsBudget = pr.changed_files > MAX_UNAPPROVED_CHANGED_FILES ||
               changedLines > MAX_UNAPPROVED_CHANGED_LINES;
             if (exceedsBudget) {