ci(pr-flow): add PR base guard — block stacked PRs

[0xmariowu]

Why

Sister project lazie had stacked PRs (#108/#109/#110) desync under squash + auto-merge today. Adding the same guard repo-wide.

Topology-aware auto-merge wouldn't fix it: squash merge produces new SHAs that downstream PR base refs don't reflect, so the chain breaks even with correct ordering.

What

.github/workflows/assert-base-is-default-branch.yml — any PR whose base.ref != repository.default_branch fails. Branch from main, merge serially.

Test plan

• This PR's base = main → check passes
• After merge, intentional stacked PR is rejected

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added automated validation requiring all pull requests to target the default branch. Non-compliant PRs will fail the check. Stacked pull requests are not supported and will be rejected.

[coderabbitai]

Warning

Review limit reached

@0xmariowu, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 46 minutes and 14 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0b4cc017-db9a-4987-b148-b75a1e693e67

📥 Commits

Reviewing files that changed from the base of the PR and between 4fe427a and f58a6c0.

📒 Files selected for processing (1)

• .github/workflows/assert-base-is-default-branch.yml

📝 Walkthrough

Walkthrough

This PR adds a new GitHub Actions workflow that enforces pull requests to target the repository's default branch. The workflow validates on pull request open, reopen, edit, and synchronization events, failing with an error message and guidance about stacked PRs if the base branch differs from the default.

Changes

PR Base Branch Guard

Layer / File(s)	Summary
PR base branch validation workflow .github/workflows/assert-base-is-default-branch.yml	New workflow validates that PRs target the default branch. On mismatch, emits an error message and fails with guidance that stacked PRs are not supported. On match, prints OK and succeeds.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A guardian at the gate so keen,
Ensures your PR base stays clean,
No stacked branches shall pass through,
The default branch is the path for you! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding a CI guard workflow to block stacked PRs by enforcing that PR bases must be the default branch.
Description check	✅ Passed	The description covers Why and What sections with clear context. However, it lacks formal sections for Change type, Test checkboxes, and Security Impact as specified in the template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

@copilot please address the blocking signals on this PR and push a fix commit.

Trigger: ci-failure
Details: Workflow "Semgrep" failed on run 25420414188

Follow the PR's .github/copilot-instructions.md hard rules. Do not suppress lints, skip tests, or weaken CI.

[Copilot]

Pull request overview

Adds a lightweight GitHub Actions guardrail to prevent stacked PRs (PRs targeting another PR branch), avoiding desync scenarios under squash merges + auto-merge.

Changes:

• Introduces a new workflow that fails any pull_request whose base branch is not the repository default branch.
• Emits a clear failure annotation instructing contributors to branch from the default branch and merge serially.