name: Pull Request
on:
  pull_request_target:
    types: [ opened, edited, labeled, unlabeled, synchronize ]
  workflow_call: # zizmor: ignore[dangerous-triggers]
    secrets:
      ELEMENT_BOT_TOKEN:
        required: true

permissions: {}

jobs:
  prevent-blocked:
    name: Prevent blocked
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    steps:
      - name: Add notice
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        if: contains(github.event.pull_request.labels.*.name, 'X-Blocked')
        with:
          script: |
            core.setFailed("PR has been labeled with X-Blocked; it cannot be merged.");

  # Disabled on the HealthChat fork. This job asks whether the PR author belongs to the
  # element-hq "Vector Core" team, using secrets.ELEMENT_BOT_TOKEN_READ_ORG — a secret
  # that only exists upstream. Here it fails on every PR that is opened, and there is no
  # community to label anyway. Kept commented rather than deleted so upstream changes to
  # it still conflict visibly on merge.
  # community-prs:
  #   name: Label Community PRs
  #   runs-on: ubuntu-latest
  #   if: github.event.action == 'opened'
  #   permissions:
  #     pull-requests: write
  #   steps:
  #     - name: Check membership
  #       if: github.event.pull_request.user.login != 'renovate[bot]'
  #       uses: tspascoal/get-user-teams-membership@b2546c5affc730fd8e3d8483ae9ad3621938c2f9 # v4.0.2
  #       id: teams
  #       with:
  #         username: ${{ github.event.pull_request.user.login }}
  #         organization: element-hq
  #         team: Vector Core
  #         GITHUB_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN_READ_ORG }}
  #     - name: Add label
  #       if: steps.teams.outputs.isTeamMember == 'false'
  #       uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
  #       with:
  #         script: |
  #           github.rest.issues.addLabels({
  #             issue_number: context.issue.number,
  #             owner: context.repo.owner,
  #             repo: context.repo.repo,
  #             labels: ['Z-Community-PR']
  #           });

  close-if-fork-develop:
    name: Forbid develop branch fork contributions
    runs-on: ubuntu-latest
    permissions:
      # Require to comment and close the PR.
      pull-requests: write
    if: >
      github.event.action == 'opened' &&
      github.event.pull_request.head.ref == 'develop' &&
      github.event.pull_request.head.repo.full_name != github.repository
    steps:
      - name: Close pull request
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: "Thanks for opening this pull request, unfortunately we do not accept contributions from the main" +
                " branch of your fork, please re-open once you switch to an alternative branch for everyone's sanity.",
            });
            
            github.rest.pulls.update({
              pull_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'closed'
            });