bot-next-issue-recommendation.yml

name: Next Issue Recommendation Bot

on:
  pull_request_target:
    types: [closed]
    branches: [main]

permissions:
  pull-requests: write
  issues: read
  contents: read

concurrency:
  group: next-issue-bot-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  recommend-next-issue:
    runs-on: hl-sdk-py-lin-md
    if: github.event.pull_request.merged == true

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      # pull_request_target runs with privileged context.
      # Explicitly checkout trusted base repository code only
      - name: Checkout trusted base repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event.repository.default_branch }}

      - name: Recommend next issue
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const script = require('./.github/scripts/bot-next-issue-recommendation.js');
            await script({ github, context, core });