From b7cdad6360964089971463737464baed70c45591 Mon Sep 17 00:00:00 2001
From: Tianyi Cui <53024+tianyicui@users.noreply.github.com>
Date: Sun, 19 Jul 2026 21:24:42 +0800
Subject: [PATCH] ci: reject golden filenames on matching PRs

---
 .github/workflows/expected-filenames.yml | 21 +++++++++++++++++++
 scripts/check-expected-filenames.sh      | 26 ++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 .github/workflows/expected-filenames.yml
 create mode 100755 scripts/check-expected-filenames.sh

diff --git a/.github/workflows/expected-filenames.yml b/.github/workflows/expected-filenames.yml
new file mode 100644
index 0000000000..328da95529
--- /dev/null
+++ b/.github/workflows/expected-filenames.yml
@@ -0,0 +1,21 @@
+name: Expected filenames
+
+on:
+  pull_request:
+    paths:
+      - '*[gG][oO][lL][dD][eE][nN]*'
+      - '**/*[gG][oO][lL][dD][eE][nN]*'
+      - '!vendor/**'
+
+permissions:
+  contents: read
+
+jobs:
+  expected-filenames:
+    name: no golden filenames
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check tracked filenames
+        run: scripts/check-expected-filenames.sh
diff --git a/scripts/check-expected-filenames.sh b/scripts/check-expected-filenames.sh
new file mode 100755
index 0000000000..bf10e2e6b6
--- /dev/null
+++ b/scripts/check-expected-filenames.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Vendored upstream paths follow vendor/README.md instead of repository naming policy.
+root=$(git rev-parse --show-toplevel)
+candidate_file=$(mktemp)
+trap 'unlink "$candidate_file"' EXIT
+git -C "$root" ls-files -z -- \
+  ':(icase,glob)*golden*' \
+  ':(icase,glob)**/*golden*' \
+  ':(exclude,glob)vendor/**' > "$candidate_file"
+
+violations=()
+while IFS= read -r -d '' path; do
+  violations+=("$path")
+done < "$candidate_file"
+
+if (( ${#violations[@]} == 0 )); then
+  echo 'check-expected-filenames: no tracked non-vendor filename contains "golden".'
+  exit 0
+fi
+
+echo 'check-expected-filenames: tracked non-vendor filenames must not contain "golden":' >&2
+printf '  %s\n' "${violations[@]}" >&2
+echo 'Rename each file with an accurate term such as "expected".' >&2
+exit 1