name: Danger CI

on:
  pull_request:
    types: [labeled, synchronize, opened, reopened]

permissions: {}

jobs:
  build:
    name: Danger
    runs-on: ubuntu-latest
    timeout-minutes: 15

    permissions:
      contents: read # HealthChat: this fork is INTERNAL, so a metadata-only token 404s on checkout. Upstream is public, hence permissions: {} there.
      issues: read # HealthChat: Danger reads the PR via the issues API (a PR is an issue there); pull-requests alone 403s on GET /issues/{n}.
      pull-requests: write # HealthChat: Danger posts its report comment and inline SwiftLint review comments (Dangerfile.swift:5 sets inline: true) with GITHUB_TOKEN.

    concurrency:
      # Only allow a single run of this workflow on each branch, automatically cancelling older runs.
      group: ${{ format('danger-ci-{0}', github.ref) }}
      cancel-in-progress: true

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Danger
        uses: danger/swift@434d7c25f3b02d490a340b23f5e78dd15a5670bc # 3.22.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}