ratatui/.github/workflows/check-pr.yml

name: Check Pull Requests

# Set the permissions of the github token to the minimum and only enable what is needed
# See https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions
permissions: {}

on:
  # this workflow is required to be run on pull_request_target as it modifies the PR comments
  # care should be taken that the jobs do not run any untrusted input
  # zizmor: ignore[dangerous-triggers]
  pull_request_target:
    types:
      - opened
      - edited
      - synchronize
      - labeled
      - unlabeled

jobs:
  check-title:
    permissions:
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Check PR title
        if: github.event_name == 'pull_request_target'
        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v5
        id: check_pr_title
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # Add comment indicating we require pull request titles to follow conventional commits specification
      - uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
        if: always() && (steps.check_pr_title.outputs.error_message != null)
        with:
          header: pr-title-lint-error
          message: |
            Thank you for opening this pull request!

            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted.

            Details:

            > ${{ steps.check_pr_title.outputs.error_message }}

      # Delete a previous comment when the issue has been resolved
      - if: ${{ steps.check_pr_title.outputs.error_message == null }}
        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
        with:
          header: pr-title-lint-error
          delete: true

  check-breaking-change-label:
    permissions:
      pull-requests: write
    runs-on: ubuntu-latest
    env:
      # use an environment variable to pass untrusted input to the script
      # see https://securitylab.github.com/research/github-actions-untrusted-input/
      PR_TITLE: ${{ github.event.pull_request.title }}
    steps:
      - name: Check breaking change label
        id: check_breaking_change
        run: |
          pattern='^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\(\w+\))?!:'
          # Check if pattern matches
          if echo "${PR_TITLE}" | grep -qE "$pattern"; then
            echo "breaking_change=true" >> $GITHUB_OUTPUT
          else
            echo "breaking_change=false" >> $GITHUB_OUTPUT
          fi
      - name: Add label
        if: steps.check_breaking_change.outputs.breaking_change == 'true'
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['Type: Breaking Change']
            })

  do-not-merge:
    if: ${{ contains(github.event.*.labels.*.name, 'do not merge') }}
    name: Prevent Merging
    runs-on: ubuntu-latest
    steps:
      - name: Check for label
        run: |
          echo "Pull request is labeled as 'do not merge'"
          echo "This workflow fails so that the pull request cannot be merged"
          exit 1