name: "Labelling new pull requests"

permissions:
  contents: read

on:
  # It's safe to use pull_request_target here, because we aren't checking out
  # code from the pull request branch.
  # See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
  pull_request_target:
    types:
      - opened
      - reopened
      - ready_for_review
      - synchronize

jobs:
  greeter:
    runs-on: ubuntu-24.04
    permissions:
      pull-requests: write
    # Only comment on PRs that have been opened for the first time, by someone
    # new to LLVM or to GitHub as a whole. Ideally we'd look for FIRST_TIMER
    # or FIRST_TIME_CONTRIBUTOR, but this does not appear to work. Instead check
    # that we do not have any of the other author associations.
    # See https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=opened#pull_request
    # for all the possible values.
    if: >-
      (github.event.action == 'opened') &&
      (github.event.pull_request.author_association != 'COLLABORATOR') &&
      (github.event.pull_request.author_association != 'CONTRIBUTOR') &&
      (github.event.pull_request.author_association != 'MANNEQUIN') &&
      (github.event.pull_request.author_association != 'MEMBER') &&
      (github.event.pull_request.author_association != 'OWNER')
    steps:
      - name: Checkout Automation Script
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
          ref: main

      - name: Setup Automation Script
        working-directory: ./llvm/utils/git/
        run: |
          pip install --require-hashes -r requirements.txt

      - name: Greet Author
        working-directory: ./llvm/utils/git/
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.pull_request.number }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          python3 ./github-automation.py \
            --token "$GH_TOKEN" \
            pr-greeter \
            --issue-number "$ISSUE_NUMBER" \
            --author "$PR_AUTHOR"

  automate-prs-labels:
    # Greet first so that only the author gets that notification.
    needs: greeter
    # See https://github.blog/changelog/2025-11-07-actions-pull_request_target-and-environment-branch-protections-changes/
    environment:
      name: main-branch-only
      deployment: false
    runs-on: ubuntu-24.04
    # Ignore PRs with more than 10 commits.  Pull requests with a lot of
    # commits tend to be accidents usually when someone made a mistake while trying
    # to rebase.  We want to ignore these pull requests to avoid excessive
    # notifications.
    # always() means that even if greeter is skipped, this job will run.
    if: >
      always() && github.repository == 'llvm/llvm-project' &&
      github.event.pull_request.draft == false &&
      github.event.pull_request.commits < 10
    steps:
      - id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3  # v3.1.1
        with:
          client-id: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
          private-key: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          permission-contents: read
          permission-pull-requests: write
      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          configuration-path: .github/new-prs-labeler.yml
          repo-token: ${{ steps.app-token.outputs.token }}