From 1335ebacd03654e9ce5f2b3e2777a42b7c0e2e7b Mon Sep 17 00:00:00 2001
From: Sam Arslan <hsa@smetools.io>
Date: Wed, 4 Mar 2026 15:05:22 +0000
Subject: [PATCH 1/3] Add branch protection workflow - only Abdelaziz can push
 to master

---
 .github/workflows/protect-master.yml | 43 ++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 .github/workflows/protect-master.yml

diff --git a/.github/workflows/protect-master.yml b/.github/workflows/protect-master.yml
new file mode 100644
index 0000000..9deff1a
--- /dev/null
+++ b/.github/workflows/protect-master.yml
@@ -0,0 +1,43 @@
+name: Protect Main Branch
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  enforce-policy:
+    runs-on: ubuntu-latest
+    if: github.actor != 'Abdelazizfarid'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Revert unauthorized push
+        run: |
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          
+          echo "❌ Unauthorized push to main by ${{ github.actor }}"
+          echo "Reverting commit ${{ github.sha }}..."
+          
+          git revert --no-commit ${{ github.sha }}
+          git commit -m "🚫 Auto-revert: Unauthorized push by ${{ github.actor }}
+          
+          Only @Abdelazizfarid is authorized to push to main.
+          Original commit: ${{ github.sha }}"
+          
+          git push origin main
+
+      - name: Create issue for violation
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: '🚫 Unauthorized push to main reverted',
+              body: `**Violation detected**\n\n- **User:** @${{ github.actor }}\n- **Commit:** ${{ github.sha }}\n- **Action:** Auto-reverted\n\nOnly @Abdelazizfarid is authorized to push directly to main.\n\nPlease use Pull Requests instead.`
+            });

From 3ca96f81f58260ff1575a8d4e55aae78151efabf Mon Sep 17 00:00:00 2001
From: Sam Arslan <hsa@smetools.io>
Date: Wed, 4 Mar 2026 15:10:43 +0000
Subject: [PATCH 2/3] Temporarily allow Shadysmetools for initial merge

---
 .github/workflows/protect-master.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/protect-master.yml b/.github/workflows/protect-master.yml
index 9deff1a..66709c5 100644
--- a/.github/workflows/protect-master.yml
+++ b/.github/workflows/protect-master.yml
@@ -7,7 +7,8 @@ on:
 jobs:
   enforce-policy:
     runs-on: ubuntu-latest
-    if: github.actor != 'Abdelazizfarid'
+    # Authorized users: Abdelazizfarid (permanent), Shadysmetools (temporary - remove after setup)
+    if: github.actor != 'Abdelazizfarid' && github.actor != 'Shadysmetools'
     steps:
       - name: Checkout
         uses: actions/checkout@v4

From 2fa4549af5f1ff23786007fe5edf76f260336a4f Mon Sep 17 00:00:00 2001
From: Sam Arslan <hsa@smetools.io>
Date: Wed, 4 Mar 2026 15:11:08 +0000
Subject: [PATCH 3/3] Only Abdelaziz can push to master

---
 .github/workflows/protect-master.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/protect-master.yml b/.github/workflows/protect-master.yml
index 66709c5..9deff1a 100644
--- a/.github/workflows/protect-master.yml
+++ b/.github/workflows/protect-master.yml
@@ -7,8 +7,7 @@ on:
 jobs:
   enforce-policy:
     runs-on: ubuntu-latest
-    # Authorized users: Abdelazizfarid (permanent), Shadysmetools (temporary - remove after setup)
-    if: github.actor != 'Abdelazizfarid' && github.actor != 'Shadysmetools'
+    if: github.actor != 'Abdelazizfarid'
     steps:
       - name: Checkout
         uses: actions/checkout@v4