approved-issues.yml

# SPDX-License-Identifier: Apache-2.0

name: "Approve Issues"

on:
  issues:
    types:
      - labeled

defaults:
  run:
    shell: bash

permissions:
  issues: write
  contents: read

concurrency:
  group: approve-issues-${{ github.event.issue.number }}
  cancel-in-progress: false

jobs:
  approve:
    if: github.event.label.name == 'approved'
    name: Approve Issue
    runs-on: hl-sdk-py-lin-md

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Remove pending-review label
        uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          labels: pending-review

      - name: Unlock issue
        run: |
          gh api \
            -X DELETE \
            repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/lock
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Approval comment
        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
        with:
          issue-number: ${{ github.event.issue.number }}
          body: |
            Approved by @hiero-ledger/hiero-sdk-python-triage and @hiero-ledger/hiero-sdk-python-committers and @hiero-ledger/hiero-sdk-python-maintainers.

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Trigger CodeRabbit Plan
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const script = require('./.github/scripts/coderabbit_plan_trigger.js');
            await script({ github, context });