bot-next-issue-recommendation.yml

name: Next Issue Recommendation Bot

on:
  pull_request_target:
    types: [closed]
    branches: [main]

permissions:
  pull-requests: write
  issues: read
  contents: read

concurrency:
  group: next-issue-bot-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  recommend-next-issue:
    runs-on: hl-sdk-py-lin-md
    if: github.event.pull_request.merged == true

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      # pull_request_target runs with privileged context.
      # Explicitly checkout trusted base repository code only
      - name: Checkout trusted base repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          ref: ${{ github.event.repository.default_branch }}

      - name: Recommend next issue
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const script = require('./.github/scripts/bot-next-issue-recommendation.js');
            await script({ github, context, core });