name: PR Labeler

on:
    pull_request_target:
        types: [opened, reopened, synchronize, edited, labeled, unlabeled]
    workflow_dispatch:
        inputs:
            mode:
                description: "Run mode for managed-label governance"
                required: true
                default: "audit"
                type: choice
                options:
                    - audit
                    - repair

concurrency:
    group: pr-labeler-${{ github.event.pull_request.number || github.run_id }}
    cancel-in-progress: true

permissions:
    contents: read
    pull-requests: write
    issues: write

jobs:
    label:
        runs-on: blacksmith-2vcpu-ubuntu-2404
        timeout-minutes: 10
        steps:
            - name: Checkout repository
              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

            - name: Apply path labels
              if: github.event_name == 'pull_request_target'
              uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
              continue-on-error: true
              with:
                  repo-token: ${{ secrets.GITHUB_TOKEN }}
                  sync-labels: true

            - name: Apply size/risk/module labels
              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
              continue-on-error: true
              with:
                  script: |
                      const script = require('./.github/workflows/scripts/pr_labeler.js');
                      await script({ github, context, core });