---
name: PR - Sentinel Bot

# Warning, this job runs on pull_request_target and therefore has access to issue content.
# Don't add any steps that act on external (PR-head) code.
on:
  pull_request_target:
    types:
      - opened
      - reopened
      - synchronize
      - edited
      - ready_for_review
      - converted_to_draft
    branches:
      - main
  workflow_dispatch:
    inputs:
      pr_number:
        description: "Single PR to evaluate; leave blank to evaluate all open PRs."
        required: false
        default: ""
      dry_run:
        description: "Log actions without posting comments, changing labels, or closing PRs."
        type: boolean
        default: false

permissions:
  contents: read
  pull-requests: write
  issues: write

concurrency:
  group: pr-sentinel-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

jobs:
  sentinel:
    name: PR Sentinel
    if: github.repository == 'thunderbird/thunderbird-android'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    environment: botmobile
    env:
      GH_REPO: ${{ github.repository }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false

      - name: App token generate
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
        id: app-token
        with:
          client-id: ${{ vars.BOT_CLIENT_ID }}
          private-key: ${{ secrets.BOT_PRIVATE_KEY }}

      - name: Determine target PRs
        id: prs
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          EVENT_NAME: ${{ github.event_name }}
          EVENT_PR: ${{ github.event.pull_request.number }}
          INPUT_PR: ${{ github.event.inputs.pr_number }}
        run: |
          set -euo pipefail
          if [[ "$EVENT_NAME" == "pull_request_target" ]]; then
            numbers="$EVENT_PR"
          elif [[ -n "$INPUT_PR" ]]; then
            numbers="$INPUT_PR"
          else
            numbers="$(gh pr list --state open --json number --jq 'map(.number) | join(" ")')"
          fi
          echo "numbers=${numbers}" >> "$GITHUB_OUTPUT"

      - name: Evaluate and report
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          NUMBERS: ${{ steps.prs.outputs.numbers }}
          DRY_RUN_INPUT: ${{ github.event.inputs.dry_run }}
        run: |
          set -euo pipefail
          args=()
          if [[ "${DRY_RUN_INPUT:-false}" == "true" ]]; then args+=(--dry-run); fi
          overall=0
          for pr in $NUMBERS; do
            ./scripts/ci/pr-sentinel/report-pr.sh "$pr" "${args[@]}" || overall=1
          done
          exit "$overall"