add-hashicorp-contributed-label.yml

name: Add HashiCorp contributed label

# The purpose of this job is to label all HashiCorp contributed PRs, so that
# we can more easily identify community contributed PRs (anything that doesn't
# have this label).
# While it might seem like this is the 'reverse' of what we should do, GitHub
# (rightly) does not allow branches from forks to have write permissions, so
# making PRs from forks self-label themselves as community-contributed is not
# possible.

on:
  # On every pull request, on every branch
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  add-hashicorp-contributed-label:
    # Only run if this is NOT coming from a fork of hashicorp/vault (if this is not true, it's community contributed)
    if: ${{ github.repository == 'hashicorp/vault' && (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) }}
    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
    steps:
      # gh pr edit needs a .git directory so we'll do a shallow checkout
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Add label to PR"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR: ${{ github.event.pull_request.html_url }}
        run: |
          gh pr edit "$PR" --add-label 'hashicorp-contributed-pr'