bot-intermediate-assignment.yml

# Prevents intermediate issues from being assigned to contributors without prior GFI experience.
name: Intermediate Issue Assignment Guard

on:
  issues:
    types:
      - assigned
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Run without making changes'
        required: false
        default: true
        type: boolean

permissions:
  issues: write
  contents: read

jobs:
  enforce-intermediate-guard:
    concurrency:
      group: intermediate-guard-${{ github.event.issue.number || github.run_id }}
      cancel-in-progress: false
    if: contains(github.event.issue.labels.*.name, 'intermediate')
    runs-on: hl-sdk-py-lin-md
    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Enforce intermediate assignment guard
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          INTERMEDIATE_LABEL: intermediate
          GFI_LABEL: Good First Issue
          INTERMEDIATE_COMMENT_MARKER: "<!-- Intermediate Issue Guard -->"
          INTERMEDIATE_EXEMPT_PERMISSIONS: admin,maintain,write,triage
          DRY_RUN: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run != 'false' }}"
        with:
          script: |
            const script = require('./.github/scripts/bot-intermediate-assignment.js');
            await script({ github, context });