label-on-approval.yml

name: Label Pull Request on Pull Request review approval

on:
  pull_request_review:
    types:
      - submitted
  pull_request_target:
    types:
      - ready_for_review
      - review_requested

permissions:
  contents: read

jobs:
  label_approved:
    name: Label on Approval
    runs-on: ubuntu-latest
    if: |
      (!contains(github.event.pull_request.labels.*.name, 'approved')) &&
      (github.event.review.state == 'approved') &&
      (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name)
    permissions:
      checks: write
      contents: read
      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443

      - name: Label Approved
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['approved']
            })

  comment_approved:
    name: Comment Concerning Approved Tag
    runs-on: ubuntu-latest
    if: |
      (github.event_name == 'pull_request_target') &&
      (github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
    permissions:
      checks: write
      contents: read
      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
      - name: Find comment
        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
        id: fc
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: 'github-actions[bot]'
          body-includes: This Pull Request is coming from a fork and must be manually tagged `approved` in order to perform additional testing.
      - name: Create comment
        if: |
          (steps.fc.outputs.comment-id == '') &&
          (!contains(github.event.pull_request.labels.*.name, 'approved')) &&
          (github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            > **Warning**
            > This Pull Request is coming from a fork and must be manually tagged `approved` in order to perform additional testing.
          edit-mode: replace
      - name: Update comment
        if: |
          contains(github.event.pull_request.labels.*.name, 'approved')
        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            > **Note**
            > This Pull Request is approved!
          reactions: |
            hooray
          edit-mode: append