pr-bot-pr-updates.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: pr-bot-pr-updates
on:
  pull_request_target:
    types: ["synchronize"] # Synchronize is the action that runs after pushes to the user branch
  issue_comment:
permissions: read-all
jobs:
  process-pr-update:
    # Give GITHUB_TOKEN permissions to write pull request comments and to the state branch, and read PR related info
    permissions:
      contents: write
      pull-requests: write
      checks: read
      issues: read
      statuses: read

    # Don't run on forks
    if: github.repository == 'apache/beam'
    runs-on: [self-hosted, ubuntu-20.04]

    steps:
      # Pin to master so users can't do anything malicious on their own branch and run it here.
      - uses: actions/checkout@v3
        with:
          ref: 'master'
      - name: Setup Node
        uses: actions/setup-node@v3
        with:
          node-version: 16
      - name: Install pr-bot npm dependencies
        run: npm ci
        working-directory: 'scripts/ci/pr-bot'
      # Runs a set of commands using the runners shell
      - run: npm run processPrUpdate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        working-directory: 'scripts/ci/pr-bot'