TEMP: prove the generated-file guard fires

.gitattributes

@@ -62,3 +62,4 @@
 #*.rtf   diff=astextplain
 #*.RTF   diff=astextplain
 libprisma/grammars.json eol=lf
+libprisma/grammars.dat linguist-generated

.github/workflows/build-grammars.yml

@@ -1,27 +1,37 @@
 name: Update grammars
 
-on: [ workflow_dispatch ]
+on:
+  workflow_dispatch:
+  push:
+    branches: [ master ]
+    # grammars.dat itself is deliberately not listed: regenerating it must not trigger another run.
+    paths:
+      - components/**
+      - generate.js
+      - package.json
+      - package-lock.json
+
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
   build:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [18.x]
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-node@v3
+    - uses: actions/checkout@v5
+    - uses: actions/setup-node@v5
       with:
-        node-version: 18
+        node-version: 22
     - run: npm install
     - run: npm start
     - name: Upload a Build Artifact
-      uses: actions/upload-artifact@v3.1.3
+      uses: actions/upload-artifact@v7
       with:
         name: grammars.dat
         path: ./libprisma/grammars.dat
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v5
+      uses: peter-evans/create-pull-request@v8
       with:
         commit-message: Update grammars
         title: Update grammars

.github/workflows/check-generated.yml

@@ -0,0 +1,22 @@
+name: Check generated files
+
+# The path filter is the whole test: the job only exists when the pull request
+# touches grammars.dat, so reaching it is already the failure.
+on:
+  pull_request:
+    paths:
+      - libprisma/grammars.dat
+
+permissions: {}
+
+jobs:
+  grammars:
+    runs-on: ubuntu-latest
+    # A pull request opened with GITHUB_TOKEN cannot trigger this workflow at all,
+    # so the guard only matters if "Update grammars" is ever moved to a PAT.
+    if: github.event.pull_request.user.login != 'github-actions[bot]'
+    steps:
+    - name: Reject changes to the generated grammar table
+      run: |
+        echo "::error file=libprisma/grammars.dat::libprisma/grammars.dat is generated by generate.js and is regenerated on master by the Update grammars workflow. Please drop it from this pull request and keep only the components/ and generate.js changes."
+        exit 1