From 866899593e5ed50158e73ff59ff9576dcafcb8d7 Mon Sep 17 00:00:00 2001
From: Tunglies <77394545+Tunglies@users.noreply.github.com>
Date: Wed, 30 Sep 2026 14:25:03 +0800
Subject: [PATCH] ci(backend): add architecture ban gates

---
 .github/workflows/backend-guardrails.yml | 26 ++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/backend-guardrails.yml

diff --git a/.github/workflows/backend-guardrails.yml b/.github/workflows/backend-guardrails.yml
new file mode 100644
index 000000000..f97174982
--- /dev/null
+++ b/.github/workflows/backend-guardrails.yml
@@ -0,0 +1,26 @@
+name: Backend Guardrails
+
+on:
+  pull_request:
+    paths:
+      - "src-tauri/**"
+      - ".github/workflows/backend-guardrails.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  banned-patterns:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: No Handle::refresh calls in feat
+        run: '! grep -rn "Handle::refresh" src-tauri/src/feat'
+
+      - name: No notice_message outside core/notify
+        run: '! grep -rn "notice_message(" src-tauri/src --include="*.rs" | grep -v "core/notify"'
+
+      - name: No manual update-flag chains
+        run: '! grep -rnE "determine_update_flags|UpdateFlags" src-tauri/src'