name: 'Tools: PR Merged'

on:
  # zizmor: ignore[dangerous-triggers] - intentional: needs read access to merged PR metadata, no PR code checkout
  pull_request_target:
    branches:
      - 'master'
    types:
      - 'closed'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: false

permissions: {}

jobs:
  trigger-cloud-pull-request:
    if: |
      github.event.pull_request.merged == true &&
      github.repository == 'prowler-cloud/prowler' &&
      !contains(github.event.pull_request.labels.*.name, 'skip-sync')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443

      - name: Calculate short commit SHA
        id: vars
        run: |
          SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
          echo "short_sha=${SHORT_SHA::7}" >> "$GITHUB_OUTPUT"
        env:
          GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}

      - name: Trigger Cloud repository pull request
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
          repository: ${{ secrets.CLOUD_DISPATCH }}
          event-type: prowler-pull-request-merged
          # repository_dispatch caps client_payload at 10 properties; this is exactly at the cap.
          client-payload: |
            {
              "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
              "PROWLER_COMMIT_SHORT_SHA": "${{ steps.vars.outputs.short_sha }}",
              "PROWLER_PR_NUMBER": "${{ github.event.pull_request.number }}",
              "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
              "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
              "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
              "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
              "PROWLER_PR_STACK_NUMBER": "${{ github.event.pull_request.stack.number }}",
              "PROWLER_PR_STACK_POSITION": "${{ github.event.pull_request.stack.position }}",
              "PROWLER_PR_STACK_SIZE": "${{ github.event.pull_request.stack.size }}"
            }