Add action to enforce PR policy

.github/workflows/deploy-image.yml

@@ -19,7 +19,8 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout code
+        uses: actions/checkout@v3
       - name: Setup QEMU
         uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
@@ -38,11 +39,12 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             # Will publish image tagged `vX.Y.Z` on each release tag
-            # `latest` by default refers to image built on latest release
             type=semver,pattern={{version}}
             # Will publish image tagged `edge` on each push to `dev`
             type=edge,branch=dev
             # Will publish image tagged `main` on each push to `main`
+            # This will also generate tag `dev` on each push to `dev`,
+            # but `type=edge` is higher priority, so it will be used instead.
             type=ref,event=branch
 
       - name: Build and push Docker image

.github/workflows/enforce-pr-policy.yml

@@ -0,0 +1,22 @@
+name: "Enforce PR policy"
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+jobs:
+  check_pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Check PR
+        run: |
+        PR_BASE=$(gh pr view https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }} --json base -q ".base.ref")
+        PR_HEAD=$(gh pr.view https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }} --json.head -q ".head.ref")
+        if [[ "$PR_BASE" == "main" ]] && ! [[ "$PR_HEAD" =~ ^dev$|^fix/ ]]; then
+          echo 'PRs to branch `main` can only come from branch `dev` or any branch prefixed with `fix/`'
+          exit 1
+        fi