From 86d63fbeb135e7a8e0065ed84a46212147fcfa35 Mon Sep 17 00:00:00 2001
From: Matthieu Houdebine <mat.houdebine@wanadoo.fr>
Date: Mon, 24 Aug 2026 12:21:19 +0200
Subject: [PATCH] Raise an error if config.yaml has been modified to avoid
 commiting user config

---
 .github/workflows/codeql.yml                  |  2 +-
 .../workflows/do-not-commit-config-yaml.yml   | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/do-not-commit-config-yaml.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8b53d5999..8bc7f913a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,7 +20,7 @@ on:
 
 jobs:
   analyze:
-    name: Analyze
+    name: Analyze code with CodeQL
     runs-on: ubuntu-latest
     permissions:
       actions: read
diff --git a/.github/workflows/do-not-commit-config-yaml.yml b/.github/workflows/do-not-commit-config-yaml.yml
new file mode 100644
index 000000000..7c097394f
--- /dev/null
+++ b/.github/workflows/do-not-commit-config-yaml.yml
@@ -0,0 +1,23 @@
+name: Do not commit user configuration
+
+on:
+  pull_request:
+    paths:
+      - 'config.yaml'
+
+jobs:
+  check-config:
+    name: Check config.yaml
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Verify config.yaml was not changed
+        run: |
+          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q '^config\.yaml$'; then
+            echo "::error file=config.yaml::config.yaml has been modified. Did you commit your configuration by mistake?"
+            exit 1
+          fi