label.yml

name: Labeler

on:
  pull_request:
      # opened, reopened, and synchronize are default for pull_request
      # edited - when PR title or body is changed
      # labeled - when labels are added to PR
      types: [opened, reopened, synchronize, edited, labeled]
  push:
    branches: [ main ]
    paths:
      - '../labels.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Disable all default permissions at workflow level for security (least privilege principle)
# Individual jobs will explicitly request only the permissions they need
permissions: {}

jobs:

  label-syncer:
    name: Syncer
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write # Needed to add existing labels to PRs
      issues: write # Needed to create labels that do not already exist
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  labeler:
    name: Set labels
    needs: [label-syncer]
    permissions:
      contents: read        # Required to read repository files and .github/labeler.yml configuration
      pull-requests: write  # Required to add/modify labels on pull requests
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      PR_NUMBER: ${{ github.event.pull_request.number }}
    steps:
      # Label based on modified files
      - name: Label based on changed files
        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"

      # Label based on branch name
      - name: Label docs
        if: startsWith(github.event.pull_request.head.ref, 'docs')
        run: gh pr edit "$PR_NUMBER" --add-label "documentation" --repo ansys/pyaedt

      - name: Label maintenance
        if: |
          startsWith(github.event.pull_request.head.ref, 'maint') ||
          startsWith(github.event.pull_request.head.ref, 'ci')
        run: gh pr edit "$PR_NUMBER" --add-label "maintenance" --repo ansys/pyaedt

      - name: Label enhancement
        if: startsWith(github.event.pull_request.head.ref, 'feat')
        run: gh pr edit "$PR_NUMBER" --add-label "enhancement" --repo ansys/pyaedt

      - name: Label bug
        if: startsWith(github.event.pull_request.head.ref, 'fix')
        run: gh pr edit "$PR_NUMBER" --add-label "bug" --repo ansys/pyaedt

      - name: Label testing
        if: startsWith(github.event.pull_request.head.ref, 'test')
        run: gh pr edit "$PR_NUMBER" --add-label "testing" --repo ansys/pyaedt

      - name: Label extension
        if: |
          contains(github.event.pull_request.title, 'extension') ||
          contains(github.event.pull_request.title, 'extensions')
        run: gh pr edit "$PR_NUMBER" --add-label "extensions" --repo ansys/pyaedt

      - name: Label examples
        if: contains(github.event.pull_request.title, 'pyaedt-examples')
        run: gh pr edit "$PR_NUMBER" --add-label "examples" --repo ansys/pyaedt

      # Label based on trailers in PR description and commit messages
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          sparse-checkout: .github/actions/label-from-trailers/action.yml
          persist-credentials: false
          sparse-checkout-cone-mode: false

      - name: Label based on trailers
        if: github.event_name == 'pull_request'
        uses: ./.github/actions/label-from-trailers
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          pr-number: ${{ github.event.pull_request.number }}

  commenter:
    name: Suggest labels if none assigned
    runs-on: ubuntu-latest
    permissions:
      contents: read        # Required to read PR metadata
      pull-requests: write  # Required to post comments on pull requests
    steps:
    - name: Suggest to add labels
      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
      # Execute only when no labels have been applied to the pull request
      if: toJSON(github.event.pull_request.labels.*.name) == '{}'
      with:
        issue-number: ${{ github.event.pull_request.number }}
        body: |
          Please add one of the following labels to add this contribution to the Release Notes :point_down:
          - [bug](https://github.com/ansys/pyaedt/pulls?q=label%3Abug+)
          - [documentation](https://github.com/ansys/pyaedt/pulls?q=label%3Adocumentation+)
          - [enhancement](https://github.com/ansys/pyaedt/pulls?q=label%3Aenhancement+)
          - [good first issue](https://github.com/ansys/pyaedt/pulls?q=label%3Agood+first+issue)
          - [maintenance](https://github.com/ansys/pyaedt/pulls?q=label%3Amaintenance+)
          - [release](https://github.com/ansys/pyaedt/pulls?q=label%3Arelease+)
          - [testing](https://github.com/ansys/pyaedt/pulls?q=label%Atesting+)

  changelog-fragment:
    name: "Create changelog fragment"
    needs: [labeler]
    permissions:
      contents: write       # Required to commit changelog fragments to the repository
      pull-requests: write  # Required to update PR with changelog information
    runs-on: ubuntu-latest
    steps:
    # NOTE: Temporary pin of ansys/actions to avoid the breaking change side effect.
    - uses: ansys/actions/doc-changelog@84b6533ae76f5dde69a1df26c18682160a8121cf # v10.3.5
      with:
        bot-email: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}
        bot-user: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
        token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
        use-pull-request-title: true
        use-default-towncrier-config: true
        use-python-cache: false

  check-pr-template:
    name: Check PR template
    # NOTE: Disable checking for dependabot and other automated PRs
    if: |
      !startsWith(github.event.pull_request.title, 'BUILD(uv):') &&
      !startsWith(github.event.pull_request.title, 'BUILD(actions):') &&
      !startsWith(github.event.pull_request.title, 'BUILD(pre-commit):') &&
      !startsWith(github.event.pull_request.title, 'CHORE: update CHANGELOG for v') &&
      github.event.pull_request.user.login != 'pyansys-automation'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read   # Required to read PR content for validation
    steps:
      - name: Check PR description
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        run: |
          ERRORS=()

          # Check required sections exist
          for section in "## Description" "## Issue linked" "## Checklist"; do
            if ! echo "$PR_BODY" | grep -qF "$section"; then
              ERRORS+=("Missing section: '$section'")
            fi
          done

          # Check placeholder texts have been replaced
          PLACEHOLDERS=(
            "**Please provide a brief description of the changes made in this pull request.**"
            "**Please mention the issue number or describe the problem this pull request addresses.**"
          )
          for placeholder in "${PLACEHOLDERS[@]}"; do
            if echo "$PR_BODY" | grep -qF "$placeholder"; then
              ERRORS+=("Placeholder not replaced: '$placeholder'")
            fi
          done

          # Report
          if [ ${#ERRORS[@]} -ne 0 ]; then
            echo "PR description validation failed:"
            for err in "${ERRORS[@]}"; do
              echo "  - $err"
            done
            exit 1
          fi

          echo "PR description is valid."