From 86b208a33db31afa171dca19a4b7afcfa9f768bb Mon Sep 17 00:00:00 2001
From: ic-builder <ic-builder@turnsys.com>
Date: Sun, 6 Sep 2026 09:54:24 -0500
Subject: [PATCH] cr-gate workflow: PR bodies must carry the GLPI CR deep link

Reference implementation of the CR-gating ruling 2026-09-06.
Grep-safe env indirection (no injection through ${{ }} in shell).
Standard: https://projects.knownelement.com/issues/820#note-1

Ticket: https://projects.knownelement.com/issues/820
---
 .gitea/workflows/cr-gate.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .gitea/workflows/cr-gate.yml

diff --git a/.gitea/workflows/cr-gate.yml b/.gitea/workflows/cr-gate.yml
new file mode 100644
index 0000000..b73642e
--- /dev/null
+++ b/.gitea/workflows/cr-gate.yml
@@ -0,0 +1,22 @@
+# CR gate [#820] — reference implementation of the 2026-09-06 founder ruling:
+# a PR touching production must reference its GLPI CR deep link.
+# Org repos copy this file verbatim; standard documented on Discourse t/339.
+name: cr-gate
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+jobs:
+  cr-link:
+    runs-on: ultix
+    container:
+      image: node:20-bookworm
+    steps:
+      - name: verify GLPI CR deep link in PR body
+        env:
+          PR_BODY: ${{ gitea.event.pull_request.body }}
+        run: |
+          echo "$PR_BODY" | grep -qE 'cmdb\.knownelement\.com/front/change\.form\.php\?id=[0-9]+' || {
+            echo "::error::PR body must reference the GLPI CR deep link (https://cmdb.knownelement.com/front/change.form.php?id=N) per the CR-gating ruling (Discourse t/339). Dev-only PRs: state 'no-CR (dev-only)' explicitly."
+            exit 1
+          }
+          echo "CR deep link present"
-- 
2.43.0