name: Build & Test PR
on:
  pull_request_target:
    types: [opened, synchronize, edited]
concurrency: ci-${{ github.event.pull_request.head.ref}}
jobs:
  build-and-test:
    uses: ./.github/workflows/build-test-common.yml
    with:
      actor: ${{ github.actor }}
      ref: ${{ github.event.pull_request.head.ref }}
      commit: ${{ github.event.pull_request.head.sha }}
      is_main_branch: false
    secrets:
      ACC_API_KEY_STAGE: ${{ secrets.ACC_API_KEY_STAGE }}
      ACC_API_KEY_PROD: ${{ secrets.ACC_API_KEY_PROD }}
      TEAM_GITHUB_TOKEN: ${{ secrets.TEAM_GITHUB_TOKEN }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      GLOBAL_JFROG_ARTIFACTORY_TOKEN: ${{ secrets.GLOBAL_JFROG_ARTIFACTORY_TOKEN }}
      GLOBAL_NEWRELIC_DEV_LICENSE_KEY: ${{ secrets.GLOBAL_NEWRELIC_DEV_LICENSE_KEY }}
      GLOBAL_NEWRELIC_TEST_LICENSE_KEY: ${{ secrets.GLOBAL_NEWRELIC_TEST_LICENSE_KEY }}
      GLOBAL_NEWRELIC_STAGE_LICENSE_KEY: ${{ secrets.GLOBAL_NEWRELIC_STAGE_LICENSE_KEY }}
      GLOBAL_NEWRELIC_PROD_LICENSE_KEY: ${{ secrets.GLOBAL_NEWRELIC_PROD_LICENSE_KEY }}
      GLOBAL_NEWRELIC_DEV_PERSONAL_API_KEY: ${{ secrets.GLOBAL_NEWRELIC_DEV_PERSONAL_API_KEY }}
      GLOBAL_NEWRELIC_TEST_PERSONAL_API_KEY: ${{ secrets.GLOBAL_NEWRELIC_TEST_PERSONAL_API_KEY }}
      GLOBAL_NEWRELIC_STAGE_PERSONAL_API_KEY: ${{ secrets.GLOBAL_NEWRELIC_STAGE_PERSONAL_API_KEY }}
      GLOBAL_NEWRELIC_PROD_PERSONAL_API_KEY: ${{ secrets.GLOBAL_NEWRELIC_PROD_PERSONAL_API_KEY }}
      GLOBAL_NPM_TOKEN: ${{ secrets.GLOBAL_NPM_TOKEN }}
      GLOBAL_GITHUB_TOKEN: ${{ secrets.GLOBAL_GITHUB_TOKEN }}
  auto-approve:
    runs-on: ubuntu-latest
    needs: build-and-test
    if: ${{ github.actor == 'dependabot[bot]' || github.actor == 'gh-bot-user' }}
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v3.3.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
      - name: approve-dependabot
        if: github.actor == 'dependabot[bot]'
        env:
          GITHUB_TOKEN: ${{ secrets.TEAM_GITHUB_TOKEN }}
        run: |
          gh pr review --approve || true
          gh pr merge --auto --rebase || true
      - name: approve-dependabump
        if: github.actor == 'gh-bot-user' && contains(fromJSON('["dep-updates-major-gha-scheduled","dep-updates-gha-scheduled","dep-updates-gha-companyx-only"]'), github.event.pull_request.head.ref)
        env:
          GITHUB_TOKEN: ${{ secrets.TEAM_GITHUB_TOKEN }}
        run: |
          gh pr review --approve || true
          gh pr merge --auto --rebase || true
  label:
    name: label when approved
    needs: auto-approve
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: ${{ github.actor == 'dependabot[bot]' || github.actor == 'gh-bot-user' }}
    steps:
      - name: label approved
        uses: abinoda/label-when-approved-action@master
        env:
          APPROVALS: "1"
          GITHUB_TOKEN: ${{ secrets.TEAM_GITHUB_TOKEN }}
          ADD_LABEL: "approved"