ci(pr-flow): add PR base guard — block stacked PRs

[0xmariowu]

Why

Sister project lazie had stacked PRs (#108/#109/#110) desync under squash + auto-merge today. Adding the same guard repo-wide.

Topology-aware auto-merge wouldn't fix it: squash merge produces new SHAs that downstream PR base refs don't reflect, so the chain breaks even with correct ordering.

What

.github/workflows/assert-base-is-default-branch.yml — any PR whose base.ref != repository.default_branch fails. Branch from main, merge serially.

Test plan

• This PR's base = main → check passes
• After merge, intentional stacked PR is rejected

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added automated validation to ensure pull requests use the repository's default branch as their base, strengthening development process controls.

[coderabbitai]

Warning

Review limit reached

@0xmariowu, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 3 minutes and 59 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 663b8fbc-212e-4efe-bd2d-b8029cf7bf1c

📥 Commits

Reviewing files that changed from the base of the PR and between e20e73f and fd19776.

📒 Files selected for processing (1)

• .github/workflows/assert-base-is-default-branch.yml

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow is introduced to validate that pull requests target the repository's default branch, rejecting PRs with incorrect base branch selection before proceeding.

Changes

PR Base Guard Workflow

Layer / File(s)	Summary
Workflow Configuration .github/workflows/assert-base-is-default-branch.yml	New workflow "PR base guard" triggers on PR events, runs a job that compares the PR's base branch to the repository's default branch, failing the workflow if they do not match.

Estimated Code Review Effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰✨ A new guardian hops into place,
Watching branches with graceful grace,
"Default only!" it firmly cries,
No stray PRs shall catch surprise!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically identifies the main change: adding a PR base guard workflow to block stacked PRs, matching the changeset.
Description check	✅ Passed	The description covers key sections (Why, What, Test plan) with clear rationale and implementation details, though it omits some template sections like Scope checkbox and Security Impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds a GitHub Actions guard to prevent “stacked PR” workflows by enforcing that every pull request targets the repository’s default branch, avoiding downstream base desync under squash + auto-merge.

Changes:

• Introduces a new pull_request workflow that fails when pull_request.base.ref is not repository.default_branch.
• Emits a clear error annotation explaining the policy and how to resolve it (rebase/retarget onto the default branch).