# ======================================================================================
# Workflow: Label External Contributors
# ======================================================================================
# Usage:
#   - Runs whenever a pull request is opened.
#   - Adds the `external-contributor` label to the PR if the PR head repository is
#     a fork (i.e. it does not belong to the same repository as the base), and the
#     PR is not authored by a bot.
#
# Notes:
#   - The workflow triggers on `pull_request_target` rather than `pull_request` so
#     that it has the `pull-requests: write` permission needed to apply labels even
#     when the PR is opened from a fork. Because we never check out the PR's code
#     and only read the event payload, this trigger is safe.
# ======================================================================================

name: Label External Contributors

on:
  pull_request_target:
    types: [opened]

# Default to a read-only token. The job below widens permissions explicitly.
permissions:
  contents: read

jobs:
  label-external-contributor:
    name: Label external-contributor PRs
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: Determine and apply external-contributor label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const pr = context.payload.pull_request;
            const author = pr.user.login;

            // Ignore PRs authored by bots.
            if (pr.user.type === 'Bot' || author.endsWith('[bot]')) {
              console.log(`Skipping bot user: ${author}`);
              return;
            }

            // The PR comes from a fork if its head repo differs from its base repo.
            const isFork =
              !pr.head.repo ||
              pr.head.repo.full_name !== pr.base.repo.full_name;

            console.log(
              `PR #${pr.number} by ${author}: isFork=${isFork}`,
            );

            if (!isFork) {
              return;
            }

            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: pr.number,
              labels: ['external-contributor'],
            });
            console.log(`Labeled PR #${pr.number} as external-contributor`);