[Backport release-25.05] workflows/check: run "checks" in one workflow

.github/workflows/check-cherry-picks.yml → .github/workflows/check.yml

@@ -1,29 +1,45 @@
-name: "Check cherry-picks"
+name: Check
 
 on:
   pull_request:
     paths:
-      - .github/workflows/check-cherry-picks.yml
+      - .github/workflows/check.yml
   pull_request_target:
-    branches:
-      - 'release-**'
-      - 'staging-**'
-      - '!staging-next'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 defaults:
   run:
     shell: bash
 
 jobs:
-  check:
-    name: cherry-pick-check
+  no-channel-base:
+    name: no channel base
+    if: |
+      startsWith(github.base_ref, 'nixos-') ||
+      startsWith(github.base_ref, 'nixpkgs-')
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: |
+          cat <<EOF
+          The nixos-* and nixpkgs-* branches are pushed to by the channel
+          release script and should not be merged into directly.
+
+          Please target the equivalent release-* branch or master instead.
+          EOF
+          exit 1
+
+  cherry-pick:
+    if: |
+      github.event_name == 'pull_request' ||
+      startsWith(github.base_ref, 'release-') ||
+      (startsWith(github.base_ref, 'staging-') && github.base_ref != 'staging-next')
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2