bot-pr-missing-linked-issue.yml

# This workflow checks PRs for missing linked issues and posts reminder comments when needed.
# Uses pull_request_target to enable write permissions for fork PRs while relying
# on the trusted base-branch checkout to avoid executing untrusted fork code.
name: PR Missing Linked Issue Reminder

on:
  pull_request_target:
    types: [opened, edited, reopened]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to check"
        required: true
        type: number
      dry_run:
        description: "Dry run (only log, no comments)"
        required: false
        type: boolean
        default: true

permissions:
  pull-requests: write
  contents: read
  issues: write

jobs:
  check-linked-issue:
    runs-on: hl-sdk-py-lin-md

    concurrency:
      group: bot-pr-missing-linked-issue-${{ github.event.pull_request.number || github.event.inputs.pr_number }}
      cancel-in-progress: true

    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Check PR for missing linked issue
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
          IMMEDIATE_CHECK: "true"
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const script = require('./.github/scripts/bot-pr-missing-linked-issue.js');
            await script({ github, context });