[max-charlamb]

Summary

• Add a Validate mirrored sources PR check using GitHub's official actions/github-script action, pinned to a commit.
• Keep allowed branches, mirrored directories, and commit-marker files in explicit lists at the top of the script.
• Allow the automation/sync-cdac and automation/sync-dbi branches only when they belong to the same repository; a fork cannot bypass validation by reusing those names.
• Reject other PRs that modify either mirror or its commit marker, including renames out of protected paths. Fail if the changed-file response is incomplete.
• No checkout, runtime download, GitHub App token, or additional secrets are required. The sync branches are trusted; this does not verify snapshot contents against runtime.

Validation

• Exercised 20 policy cases covering branch exceptions, fork spoofing, protected paths, metadata, renames, incomplete responses, and API errors.
• Checked 312 branch/path/rename combinations after refactoring to explicit lists; behavior matches the previous policy.

Repository configuration

After merging, make Validate mirrored sources a required status check in the ruleset for main. This PR only adds the workflow and does not change repository settings.

[hoyosjs]

Can we run this metadata-only validator with pull_request_target, keeping the read-only permissions and no-checkout design? With pull_request, a PR can change both a mirrored file and this validator to make the required check pass. We should also add code ownership for /.github/workflows/ and /.github/CODEOWNERS, and require code-owner approval in the main ruleset. That protects changes to the enforcement logic itself.

[hoyosjs]

Please include edited alongside opened, synchronize, and reopened so retargeting an existing PR to main runs validation. Otherwise retargeting alone won't trigger it, potentially leaving the required check missing and blocking the PR until another push.