name: 'Tools: Lock Issue on Close'

on:
  issues:
    types:
      - closed

concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number }}
  cancel-in-progress: false

permissions: {}

jobs:
  lock:
    if: |
      github.repository == 'prowler-cloud/prowler' &&
      github.event.issue.locked == false
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      issues: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443

      - name: Comment and lock issue
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: |
            const { owner, repo } = context.repo;
            const issue_number = context.payload.issue.number;

            try {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body: 'This issue is now locked as it has been closed. If you are still hitting a related problem, please open a new issue and link back to this one for context. Thanks!'
              });
            } catch (error) {
              core.warning(`Failed to post lock comment on issue #${issue_number}: ${error.message}`);
            }

            const lockParams = { owner, repo, issue_number };
            if (context.payload.issue.state_reason === 'completed') {
              lockParams.lock_reason = 'resolved';
            }
            await github.rest.issues.lock(lockParams);