ci(workflow): enforce-pr-template

.github/workflows/enforce-pr-template.yml

@@ -0,0 +1,35 @@
+name: Enforce Pull Request Template
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - reopened
+
+concurrency:
+  group: enforce-pr-template-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  enforce:
+    if: ${{ github.repository == 'noctalia-dev/community-plugins' }}
+    runs-on: ubuntu-latest
+    steps:
+      # pull_request_target has write access. Only execute this trusted script from
+      # the default branch; never check out or run code from the pull request head.
+      - name: Check out trusted enforcement code
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+
+      - name: Validate pull request description
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 .github/workflows/scripts/enforce-pr-template.py "$GITHUB_EVENT_PATH"