name: 'Tools: PR Labeler'

on:
  # zizmor: ignore[dangerous-triggers] - intentional: needs write access to apply labels, no PR code checkout
  pull_request_target:
    branches:
      - 'master'
      - 'v5.*'
    types:
      - 'opened'
      - 'reopened'
      - 'synchronize'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions: {}

jobs:
  labeler:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Apply labels to PR
        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        with:
          sync-labels: true

  label-community:
    name: Add 'community' label if the PR is from a community contributor
    needs: labeler
    if: github.repository == 'prowler-cloud/prowler' && github.event.action == 'opened'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Check if author is org member
        id: check_membership
        env:
          AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          # Hardcoded list of prowler-cloud organization members
          # This list includes members who have set their organization membership as private
          ORG_MEMBERS=(
            "AdriiiPRodri"
            "Alan-TheGentleman"
            "alejandrobailo"
            "amitsharm"
            # "andoniaf"
            "cesararroba"
            "danibarranqueroo"
            "HugoPBrito"
            "jfagoagas"
            "josema-xyz"
            "lydiavilchez"
            "mmuller88"
            # "MrCloudSec"
            "pedrooot"
            "prowler-bot"
            "puchy22"
            "RosaRivasProwler"
            "StylusFrost"
            "toniblyx"
            "davidm4r"
            "pfe-nazaries"
          )

          echo "Checking if $AUTHOR is a member of prowler-cloud organization"

          # Check if author is in the org members list
          if printf '%s\n' "${ORG_MEMBERS[@]}" | grep -q "^${AUTHOR}$"; then
            echo "is_member=true" >> $GITHUB_OUTPUT
            echo "$AUTHOR is an organization member"
          else
            echo "is_member=false" >> $GITHUB_OUTPUT
            echo "$AUTHOR is not an organization member"
          fi

      - name: Add community label
        if: steps.check_membership.outputs.is_member == 'false' && github.event.pull_request.user.type != 'Bot'
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "Adding 'community' label to PR #$PR_NUMBER"
          gh api /repos/${{ github.repository }}/issues/${{ github.event.number }}/labels \
            -X POST \
            -f labels[]='community'