fix: refuse to create new clsig if we switched to a different fork while we were signing #7335

	name: Check Merge Fast-Forward Only

	permissions:
	pull-requests: write

	on:
	push:
	pull_request_target:
	pull_request_review:
	types: [submitted]

	jobs:
	check_merge:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v3
	with:
	fetch-depth: 0

	- name: Set up Git
	run: \|
	git config user.name "GitHub Action"
	git config user.email "noreply@example.com"

	- name: Check merge --ff-only
	run: \|
	if [[ "${{ github.ref_name }}" == "master" ]]; then
	echo "Already on master, no need to check --ff-only"
	else
	git fetch origin master:master
	if [[ "${{ github.event_name }}" == "pull_request"* ]]; then
	git fetch origin ${{ github.event.pull_request.base.ref }}:base_branch
	git checkout base_branch
	git pull --rebase=false origin pull/${{ github.event.pull_request.number }}/head
	git checkout master
	git merge --ff-only base_branch
	else
	git checkout master
	git merge --ff-only ${{ github.sha }}
	fi
	fi

	- name: add labels
	uses: actions-ecosystem/action-add-labels@v1
	if: failure()
	with:
	labels: \|
	needs rebase

	- name: comment
	uses: mshick/add-pr-comment@v2
	if: failure()
	with:
	message: \|
	This pull request has conflicts, please rebase.

Provide feedback