feat: enforce owner-only pull requests

.github/workflows/enforce-owner-prs.yml

@@ -0,0 +1,36 @@
+name: Enforce Owner PRs
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  owner_gate:
+    if: ${{ github.event.pull_request.user.login != 'Mehdi-Bl' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close unauthorized PR
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          script: |
+            const number = context.payload.pull_request.number;
+            const author = context.payload.pull_request.user.login;
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: number,
+              body: `Closing PR from @${author}: this repository only accepts PRs from @Mehdi-Bl.`
+            });
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: number,
+              state: 'closed'
+            });