name: Auto-label community adapter PRs

# Adds the `community-adapter` label to any PR that touches files under
# `examples/connectors/**`. The label surfaces the PR in the maintainer triage
# queue used by the rotation in docs/how-to/contributors/mentor-rotation.md.
#
# Security notes:
#   - This workflow runs on `pull_request_target`, which exposes write tokens
#     to runs initiated by forks. We therefore deliberately do NOT check out
#     the PR head — we never run code from the fork. The path detection uses
#     GitHub's REST API against the base repository, and the labeling step
#     uses only first-party `actions/github-script` to avoid third-party
#     supply-chain risk.

on:
  pull_request_target:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: write

jobs:
  label:
    runs-on: ubuntu-latest
    steps:
      - name: Detect and label community adapter PRs
        uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo
            const pull_number = context.payload.pull_request.number

            const files = await github.paginate(github.rest.pulls.listFiles, {
              owner,
              repo,
              pull_number,
              per_page: 100,
            })

            const touchesConnector = files.some((f) =>
              f.filename.startsWith('examples/connectors/'),
            )

            if (!touchesConnector) {
              core.info('No examples/connectors/** files changed — nothing to label.')
              return
            }

            await github.rest.issues.addLabels({
              owner,
              repo,
              issue_number: pull_number,
              labels: ['community-adapter'],
            })
            core.info(`Labeled PR #${pull_number} with community-adapter.`)
