refactor(automation): Add Check to ensure only next moves code to prod

.github/workflows/on-pr-change.yml

@@ -0,0 +1,29 @@
+name: Check pull request source branch
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - edited
+jobs:
+  check-branches:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branches
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if [[ "${{ env.HEAD_REF }}" =~ [^a-zA-Z0-9-_] ]]; then
+            echo "head_ref has invalid characters."
+            exit 1
+          fi
+          if [[ "${{ env.BASE_REF }}" =~ [^a-zA-Z0-9-_] ]]; then
+            echo "base_ref has invalid characters."
+            exit 1
+          fi
+          if [ ${{ env.HEAD_REF }} != "next" ] && [ ${{ env.BASE_REF }} == "prod" ]; then
+            echo "Merge requests to prod branch are only allowed from next branch."
+            exit 1
+          fi

.github/workflows/test.yml → .github/workflows/on-pr.yml

@@ -8,6 +8,7 @@ on:
   workflow_dispatch:
 
 jobs:
+
   dependency-review:
     name: Dependency review
     runs-on: ubuntu-latest
@@ -174,7 +175,7 @@ jobs:
       - uses: actions/checkout@v3
 
       - uses: ./.github/actions/setup-project
-      
+
       - name: Run Lint, Build, Test
         uses: mansagroup/nrwl-nx-action@v3
         with: