label-analysis.yml

---
name: "Label analysis"

on:
  pull_request:
    types: [labeled, unlabeled, synchronize]
    branches:
      - main
      - "[0-9]+.[0-9]+.x"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

permissions: {}

jobs:
  release-note-check:
    if: github.triggering_actor != 'dd-devflow[bot]'
    runs-on: ubuntu-latest
    steps:
      # Checkout base repo for trusted code (tasks, dda install)
      # NOTE: Do NOT use sparse-checkout here — reno uses dulwich which doesn't
      # support the extensions.worktreeConfig that sparse-checkout enables.
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: main
          fetch-depth: 0
          persist-credentials: false
      # Fetch and checkout only releasenotes folders from PR (data only, no code execution)
      # Using refs/pull/NUMBER/head works for both fork and non-fork PRs
      - name: Fetch PR head
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: git fetch origin "refs/pull/${PR_NUMBER}/head"
      - name: Checkout releasenotes from PR
        run: git checkout FETCH_HEAD -- releasenotes releasenotes-dca 2>/dev/null || true
      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: legacy-tasks
      - name: Check release note
        env:
          BRANCH_NAME: ${{ github.head_ref }}
          PR_ID: ${{ github.event.pull_request.number }}
        run: dda inv -- -e linter.releasenote

  fetch-labels:
    if: github.triggering_actor != 'dd-devflow[bot]'
    runs-on: ubuntu-latest
    outputs:
      LABELS: ${{ steps.pr-labels.outputs.LABELS }}
    steps:
      - name: Get PR labels
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        id: pr-labels
        run: |
          labels="$(curl --retry 4 -fsSL \
            -H "Accept: application/vnd.github+json" \
            -H "Authorization: Bearer $GITHUB_TOKEN" \
            "https://api.github.com/repos/${{ github.repository }}/pulls/$PR_NUMBER" \
            | jq -r '[.labels[].name] | join(" ")')"
          echo "Fetched labels for PR $PR_NUMBER: $labels"
          echo "LABELS=$labels" >> "$GITHUB_OUTPUT"

  team-label-check:
    needs: fetch-labels
    if: github.triggering_actor != 'dd-devflow[bot]'
    runs-on: ubuntu-latest
    steps:
      - name: Check team assignment
        run: |
          for label in $LABELS; do
            if [[ "$label" =~ ^qa/ ]]; then
              echo "A label to skip QA is set -- no need for team assignment"
              exit 0
            fi
            if [[ "$label" =~ ^team/ && "$label" != team/triage ]]; then
              echo "Team label found: $label"
              exit 0
            fi
          done
          echo "PR ${{ github.event.pull_request.number }} requires at least one non-triage team assignment label (label starting by 'team/')"
          exit 1
        env:
          LABELS: ${{ needs.fetch-labels.outputs.LABELS }}

  skip-qa-check:
    needs: fetch-labels
    if: github.triggering_actor != 'dd-devflow[bot]'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: main
          sparse-checkout: |
            .gitlab-ci.yml
            .github/actions/install-dda
            tasks
          persist-credentials: false
      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: legacy-tasks
      - name: Check qa/[done|no-code-change] labels are not set together
        env:
          LABELS: ${{ needs.fetch-labels.outputs.LABELS }}
        run: |
          dda inv -- -e github.check-qa-labels --labels "${LABELS[@]}"

  agenttelemetry-list-change-ack-check:
    if: github.triggering_actor != 'dd-devflow[bot]' && github.event.pull_request.head.repo.full_name == github.repository # Run only on non-fork PRs
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: ${{ github.head_ref }}
      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: legacy-tasks
      - name: Check agent telemetry metric list
        run: dda inv -- -e github.agenttelemetry-list-change-ack-check --pr-id=${{ github.event.pull_request.number }}