issue-creation-tool-versions.yml

---
name: Evaluate Tool Versions

on:
  schedule:
    - cron: 0 0 1 */3 *
  workflow_dispatch:

permissions: {}

jobs:
  create-issue:
    name: Create tool version evaluation issue
    runs-on: ubuntu-latest
    permissions:
      contents: read # is needed to checkout the repository
      issues: write # is needed by gh cli to create/close/pin/unpin issues
    steps:
      - uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
        with:
          disable-sudo-and-containers: true
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          sparse-checkout: .github/TOOL_VERSION_ISSUE_TEMPLATE.md
          sparse-checkout-cone-mode: false
      - run: |
          previous_issue_number=$(gh issue list \
            --label "$LABELS" \
            --json number \
            --jq '.[0].number // empty')

          if [[ -n $previous_issue_number ]]; then
            gh issue close "$previous_issue_number" --reason completed
            gh issue unpin "$previous_issue_number" || true
          fi

          new_issue_url=$(gh issue create \
            --title "$TITLE" \
            --label "$LABELS" \
            --body-file .github/TOOL_VERSION_ISSUE_TEMPLATE.md)

          if [[ $PINNED == true ]]; then
            gh issue pin "$new_issue_url"
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          LABELS: scheduled,tool-versions
          PINNED: true
          TITLE: Evaluate tool versions