name: Profile Artifact Boundary

# A reusable, unconditional guard for the incident class in #92457. Ignore
# files reduce accidental staging; this job is the enforcement boundary that
# still catches `git add -f` and generated files present during a build.

on:
  workflow_call:

permissions:
  contents: read

jobs:
  check-profile-artifacts:
    name: Reject profile archives
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Reject profile exports in the checkout
        run: python3 scripts/ci/check_profile_archive_boundary.py