action.yml

name: 'Label PR based on approvals'
description: 'Adds a label to a PR when it is approved or changes are requested.'

inputs:
  token:
    description: 'GitHub token to use. If passed, takes precedence over the `app-id` and `app-private-key` inputs.'

  app-id:
    description: 'The app ID of the app.'

  private-key:
    description: 'The private key of the app.'

  required-approvals:
    description: 'Amount of approvals needed. If passed, skips fetching branch protections.'

  label-approved:
    description: 'Label to add when PR status is approved.'
    default: 'approved'

  label-changes-requested:
    description: 'Label to add when PR status is changes requested.'
    default: 'changes requested'

  protection-type:
    description: 'Type of protection to check for. Can be either "branch-protection" or "rulesets".'
    default: 'branch-protection'

runs:
  using: composite
  steps:
    - uses: actions/checkout@v4

    - uses: myparcelnl/actions/get-github-token@v4
      id: token
      with:
        token: ${{ inputs.token }}
        app-id: ${{ inputs.app-id }}
        private-key: ${{ inputs.private-key }}

    - name: 'Get required approvals from branch protection'
      id: branch-protection
      if: inputs.required-approvals == '' && inputs.protection-type == 'branch-protection'
      uses: actions/github-script@v7
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          const branchProtection = await github.rest.repos.getBranchProtection({
            owner: context.repo.owner,
            repo: context.repo.repo,
            branch: context.payload.pull_request.base.ref
          });

          const requiredApprovals = branchProtection.data.required_pull_request_reviews?.required_approving_review_count ?? 0;

          core.setOutput('required-approvals', requiredApprovals);

    - name: 'Get required approvals from rule sets'
      id: rulesets
      if: inputs.required-approvals == '' && inputs.protection-type == 'rulesets'
      uses: actions/github-script@v7
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          // Get all rules for the branch
          // we can use it directly from octokit since the endpoint is not yet supported by github-script
          // https://octokit.github.io/rest.js/v20#repos-get-branch-rules
          // When this issue is resolved, we can use `github.rest.repos.getBranchRules` to get the rules
          // https://github.com/actions/github-script/issues/345
          const rulesets = await github.request('/repos/{owner}/{repo}/rules/branches/{branch}', {
            owner: context.repo.owner,
            repo: context.repo.repo,
            branch: context.payload.pull_request.base.ref,
            headers: {
              'X-GitHub-Api-Version': '2022-11-28'
            }
          });

          // Filter out rules that are not for pull requests, Since we get all rules for the branch
          const pullRequestRules = rulesets.data.filter(rule => rule.type === 'pull_request');
          const highestAmountOfApprovals = pullRequestRules.reduce((highest, rule) => {
            const approvals = rule.parameters.required_approving_review_count ?? 0;

            return approvals > highest ? approvals : highest;
          }, 0);
          const requiredApprovals = highestAmountOfApprovals ?? 0;

          core.setOutput('required-approvals', requiredApprovals);

    - name: 'Collect pull request reviews'
      id: check
      uses: actions/github-script@v7
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          const reviews = await github.rest.pulls.listReviews({
            owner: context.repo.owner,
            repo: context.repo.repo,
            pull_number: context.payload.pull_request.number
          });

          // Filter out duplicate reviews from the same user and keep only the last review from each user
          const userReviews = new Map();

          reviews.data.forEach(review => {
            const { login } = review.user;

            if (!userReviews.has(login)) {
              userReviews.set(login, review);
            } else if (userReviews.get(login).submitted_at < review.submitted_at) {
              userReviews.set(login, review);
            }
          });

          const userReviewsArray = Array.from(userReviews.values());

          const changesRequested = userReviewsArray.some(review => review.state === 'CHANGES_REQUESTED');
          const approvals = userReviewsArray.filter(review => review.state === 'APPROVED');

          const requiredApprovals = Number(${{ inputs.required-approvals || steps.branch-protection.outputs.required-approvals || steps.rulesets.outputs.required-approvals }});
          const isApproved = !changesRequested && approvals.length >= requiredApprovals;

          core.setOutput('approved', isApproved ? 'true' : 'false');
          core.setOutput('changes-requested', changesRequested ? 'true' : 'false');

    - name: 'Add "approved" label'
      uses: actions/github-script@v7
      if: steps.check.outputs.approved == 'true' && !contains(github.event.pull_request.labels.*.name, inputs.label-approved)
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['${{ inputs.label-approved }}']
          });

    - name: 'Add "changes requested" label'
      uses: actions/github-script@v7
      if: steps.check.outputs.changes-requested == 'true' && !contains(github.event.pull_request.labels.*.name, inputs.label-changes-requested)
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          github.rest.issues.addLabels({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            labels: ['${{ inputs.label-changes-requested }}']
          });

    - name: 'Remove "approved" label'
      uses: actions/github-script@v7
      if: contains(github.event.pull_request.labels.*.name, inputs.label-approved) && (steps.check.outputs.approved == 'false')
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          github.rest.issues.removeLabel({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            name: '${{ inputs.label-approved }}'
          });

    - name: 'Remove "changes requested" label'
      uses: actions/github-script@v7
      if: contains(github.event.pull_request.labels.*.name, inputs.label-changes-requested) && (steps.check.outputs.changes-requested == 'false')
      with:
        github-token: ${{ steps.token.outputs.token }}
        #language=javascript
        script: |
          github.rest.issues.removeLabel({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            name: '${{ inputs.label-changes-requested }}'
          });