on-pr-update.yaml

name: Bot - On PR Update

# Runs on new commits (synchronize) and PR body edits (edited). Performs all
# 4 checks (DCO, GPG, merge conflict, issue link), posts/updates unified
# comment, and conditionally swaps the status label via bot-on-pr-update.js.
# For edited events, exits early if only title/base changed.
on:
  pull_request_target:
    types:
      - synchronize
      - edited

permissions:
  contents: read
  pull-requests: write
  checks: write

jobs:
  on-pr-update:
    runs-on: hiero-client-sdk-linux-large
    if: github.event.pull_request.draft == false

    concurrency:
      group: pr-bot-${{ github.event.pull_request.number }}
      cancel-in-progress: false

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Run Bot
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const script = require('./.github/scripts/bot-on-pr-update.js');
            await script({ github, context });