comment-on-test-label.yml

name: Comment on test-* label

# Posts a reminder when a `test openj9` / `test windows` label is added,
# explaining that `build-pull-request.yml` doesn't retrigger on `labeled`
# events (see the design notes at the top of that file for the rationale).
# Without this, applying the label and waiting would look broken.
#
# Why `pull_request_target` is safe here: this workflow does NOT check out
# or execute any PR code. Its only step is `gh pr comment`. Fork PRs
# therefore can't influence what runs, so the secrets that
# `pull_request_target` would normally expose are not reachable.

on:
  pull_request_target:
    types: [labeled]

permissions:
  contents: read
  pull-requests: write

jobs:
  comment:
    if: |
      github.event.label.name == 'test openj9' ||
      github.event.label.name == 'test windows'
    runs-on: ubuntu-latest
    steps:
      - name: Post explanatory comment
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          LABEL: ${{ github.event.label.name }}
        run: |
          gh pr comment "$PR_NUMBER" --body "The \`$LABEL\` label has been added, but the build only consults test-* labels at the moments it naturally runs (PR opened / synchronize / reopened). To pick up this label, push another commit or close-and-reopen the PR."