# The status check context of this job is "checks / depends-upstream
# (pull_request)", which the required status check `checks / *` of the protected
# main branch matches, so a pull request waiting for gitea cannot be merged.
# It is a workflow of its own so that a label change does not cancel the build
# and the preview deployment of the `checks` workflow in test.yaml.
#
# The check script comes from the pull request, like the workflow file itself:
# `pull_request` runs both from the head, so taking the script from the base
# branch would not gain anything and would leave this workflow unable to run on
# the pull request that adds it.
name: checks

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - edited
      - labeled
      - unlabeled

concurrency:
  group: depends-upstream-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  depends-upstream:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: check the upstream dependencies
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          # optional, only lifts the rate limit of the unauthenticated github api
          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}
        run: |
          set -euo pipefail

          # read the description and the labels from the api instead of the
          # event context, so nothing from a pull request body is expanded into
          # this script
          api="${GITHUB_API_URL:-$GITHUB_SERVER_URL/api/v1}/repos/$GITHUB_REPOSITORY"
          curl --silent --show-error --fail --output pull.json "$api/pulls/$PR_NUMBER"

          ./scripts/check-upstream-deps.sh pull.json