# This workflow is run whenever a pull request is opened, re-opened, or taken
# out of draft (ready for review). 
#
# NOTE: pull_request_target behaves the same as pull_request except it grants a
# read/write token to workflows running on a pull request from a fork. While
# this may seem unsafe, the permissions for the token are limited below and
# the permissions can not be changed without merging to master which is
# protected by CODEOWNERS.
name: Label
on:
  pull_request_target:
    types: [opened, ready_for_review]

# Limit the permissions on the GitHub token for this workflow to the subset
# that is required. In this case, the label workflow only needs to be able
# to update labels on the PR, so it needs write access to "pull-requests",
# nothing else.
permissions:
    pull-requests: write
    actions: none
    checks: none
    contents: none
    deployments: none
    issues: none
    packages: none
    repository-projects: none
    security-events: none
    statuses: none

jobs:
  auto-label-pr:
    name: Label Pull Request
    if: ${{ !github.event.pull_request.draft }}
    runs-on: ubuntu-latest
    steps:
      # Checkout master branch of Teleport repository. This is to prevent an
      # attacker from submitting their own bot logic.
      - name: Checkout master branch
        uses: actions/checkout@v2
        with:
          ref: master
      - name: Installing the latest version of Go.
        uses: actions/setup-go@v2
      # Run "label" subcommand on bot.
      - name: Labeling PR
        run: cd .github/workflows/robot && go run main.go -workflow=label -token="${{ secrets.GITHUB_TOKEN }}" -reviewers="${{ secrets.reviewers }}"