new-prs.yml | Explore in Territory

name: "Labelling new pull requests"

permissions:
  contents: read

on:
  # It's safe to use pull_request_target here, because we aren't checking out
  # code from the pull request branch.
  # See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
  pull_request_target:
    types:
      - opened
      - reopened
      - ready_for_review
      - synchronize

jobs:
  greeter:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    # Only comment on PRs that have been opened for the first time, by someone
    # new to LLVM or to GitHub as a whole. Ideally we'd look for FIRST_TIMER
    # or FIRST_TIME_CONTRIBUTOR, but this does not appear to work. Instead check
    # that we do not have any of the other author associations.
    # See https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=opened#pull_request
    # for all the possible values.
    if: >-
      (github.repository == 'llvm/llvm-project') &&
      (github.event.action == 'opened') &&
      (github.event.pull_request.author_association != 'COLLABORATOR') &&
      (github.event.pull_request.author_association != 'CONTRIBUTOR') &&
      (github.event.pull_request.author_association != 'MANNEQUIN') &&
      (github.event.pull_request.author_association != 'MEMBER') &&
      (github.event.pull_request.author_association != 'OWNER')
    steps:
      - name: Checkout Automation Script
        uses: actions/checkout@v4
        with:
          sparse-checkout: llvm/utils/git/
          ref: main

      - name: Setup Automation Script
        working-directory: ./llvm/utils/git/
        run: |
          pip install --require-hashes -r requirements.txt

      - name: Greet Author
        working-directory: ./llvm/utils/git/
        run: |
          python3 ./github-automation.py \
            --token '${{ secrets.GITHUB_TOKEN }}' \
            pr-greeter \
            --issue-number "${{ github.event.pull_request.number }}"

  automate-prs-labels:
    # Greet first so that only the author gets that notification.
    needs: greeter
    runs-on: ubuntu-latest
    # Ignore PRs with more than 10 commits.  Pull requests with a lot of
    # commits tend to be accidents usually when someone made a mistake while trying
    # to rebase.  We want to ignore these pull requests to avoid excessive
    # notifications.
    # always() means that even if greeter is skipped, this job will run.
    if: >
      always() && github.repository == 'llvm/llvm-project' &&
      github.event.pull_request.draft == false &&
      github.event.pull_request.commits < 10
    steps:
      - uses: actions/labeler@v4
        with:
          configuration-path: .github/new-prs-labeler.yml
          # workaround for https://github.com/actions/labeler/issues/112
          sync-labels: ''
          repo-token: ${{ secrets.ISSUE_SUBSCRIBER_TOKEN }}
llvm/.github/workflows/new-prs.yml
