ghostty/.github/workflows/vouch-pr-comment.yml

name: Vouch PR Comment

on:
  issue_comment:
    types: [created]

jobs:
  vouch:
    if: ${{ github.event.issue.pull_request }}
    runs-on: namespace-profile-ghostty-xsm
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.repository.default_branch }}

      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Manage contributor
        id: update
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          status=$(nix develop -c nu .github/vouch/vouch.nu gh-manage-by-issue \
            -R ${{ github.repository }} \
            ${{ github.event.issue.number }} \
            ${{ github.event.comment.id }} \
            --allow-vouch=false \
            --dry-run=false \
            | tail -1)
          echo "status=$status" >> "$GITHUB_OUTPUT"

      - name: Commit and push
        if: steps.update.outputs.status != 'unchanged' && steps.update.outputs.status != ''
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .github/VOUCHED
          git diff --staged --quiet || git commit -m "chore: update VOUCHED for ${{ github.event.issue.user.login }}"
          git push

      - name: Comment on denounce
        if: steps.update.outputs.status == 'denounced'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh pr comment ${{ github.event.issue.number }} \
            --body "@${{ github.event.issue.user.login }} has been denounced and will not be able to submit PRs."