Enforce brand new assets be tested before publishing to public registry #8

	name: Check new assets

	on:
	pull_request:
	branches:
	- main
	workflow_dispatch:

	defaults:
	run:
	shell: bash

	permissions:
	# Required to clone repo
	contents: read
	# Required for OIDC login to Azure
	id-token: write

	jobs:
	check-new-assets:
	name: Check new assets
	runs-on: ubuntu-latest

	steps:
	- name: Test step
	run: echo "hello world"

	- name: Clone branch
	uses: actions/checkout@v3

	- name: Get changed files
	id: changed-files
	uses: tj-actions/changed-files@v35

	- name: List all added files
	run: \|
	echo "${{ steps.changed-files.outputs.added_files }}"
	echo "continue=false" >> $GITHUB_ENV
	for file in ${{ steps.changed-files.outputs.added_files }}; do
	if [[ "$file" == .spec.yaml ]] \|\| [[ "$file" == .asset.yaml ]]; then
	echo "continue=true" >> $GITHUB_ENV
	echo "matched"
	break
	fi
	done

	- name: Check PR labels for "safe to publish" label
	if: fromJSON(env.continue) && !contains(github.event.pull_request.labels.*.name, 'safe to publish')
	run: \|
	echo "::error::This PR contains a brand new asset and requires the 'safe to publish' label to run this check. Assets must be properly tested before being added Github and the public registry."
	exit 1

Provide feedback