pr-comment.yml

# Description: This workflow is triggered when the "Check" workflow completes.
# Since this pull request has write permissions on the target repo, we should **NOT** execute any untrusted code.
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
# Based on https://github.com/spring-projects/spring-security/pull/15477/files
---
name: Comment on PR

on:
  workflow_run:
    workflows: ["Tests"]
    types:
      - completed

jobs:
  comment:
    # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-a-workflow-based-on-the-conclusion-of-another-workflow
    if: ${{ github.event.workflow_run.conclusion == 'failure' && (github.repository_owner == 'JabRef') }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      pull-requests: write
    timeout-minutes: 10
    steps:
      - name: Download PR number
        uses: actions/download-artifact@v4
        with:
          name: pr_number
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}
      - name: Read pr_number.txt
        id: read-pr_number
        run: |
          PR_NUMBER=$(cat pr_number.txt)
          echo "Read PR number $PR_NUMBER"
          echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
      - uses: actions/checkout@v4
      - name: Is PR from forked?
        if: ${{ steps.read-pr_number.outputs.pr_number != '' }}
        id: isCrossRepository
        run: |
          isCrossRepository=$(gh pr view $pr_number --json isCrossRepository --jq '.isCrossRepository')
          echo "Got isCrossRepository $isCrossRepository"
          echo isCrossRepository=$isCrossRepository >> $GITHUB_OUTPUT
        env:
          GH_TOKEN: ${{ github.token }}
          pr_number: ${{ steps.read-pr_number.outputs.pr_number }}
      - name: Checkout
        if: ${{ steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true' }}
        uses: actions/checkout@v4
        with:
          fetch-depth: '0'
          show-progress: 'false'
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: jbang
        if: ${{ steps.read-pr_number.outputs.pr_number != '' && steps.isCrossRepository.outputs.isCrossRepository == 'true' }}
        uses: jbangdev/jbang-action@v0.119.0
        with:
          script: ghprcomment@koppor/ghprcomment
          scriptargs: "-r JabRef/jabref -p ${{ steps.read-pr_number.outputs.pr_number }} -w ${{ github.event.workflow_run.id }}"
          trust: https://github.com/koppor/ghprcomment/
        env:
          GITHUB_OAUTH: ${{ secrets.GITHUB_TOKEN }}