name: PR Subscriber

on:
  pull_request_target:
    types:
      - labeled

permissions:
  contents: read

jobs:
  auto-subscribe:
    # See https://github.blog/changelog/2025-11-07-actions-pull_request_target-and-environment-branch-protections-changes/
    environment:
      name: main-branch-only
      deployment: false
    runs-on: ubuntu-24.04
    if: github.repository == 'llvm/llvm-project'
    steps:
      - name: Checkout Automation Script
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: llvm/utils/git/
          ref: main

      - name: Setup Automation Script
        working-directory: ./llvm/utils/git/
        run: |
          pip install --require-hashes -r requirements.txt

      - id: app-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3  # v3.1.1
        with:
          client-id: ${{ secrets.LLVM_TOKEN_GENERATOR_CLIENT_ID }}
          private-key: ${{ secrets.LLVM_TOKEN_GENERATOR_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          permission-members: read
          permission-contents: read
          permission-pull-requests: write

      - name: Update watchers
        working-directory: ./llvm/utils/git/
        env:
          LABEL_NAME: ${{ github.event.label.name }}
          PR_SUBSCRIBER_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          python3 ./github-automation.py \
            --token "$PR_SUBSCRIBER_TOKEN" \
            pr-subscriber \
            --issue-number "${{ github.event.number }}" \
            --label-name "$LABEL_NAME"