label-test.yml

name: Label Test

on:
  workflow_call:
    inputs:
      label_sync_repository:
        description: "Repository that contains the central Label Test workflow config and scripts."
        required: true
        type: string
      label_sync_ref:
        description: "Ref to check out from the central Label Sync repository."
        required: true
        type: string
      review_signal_run_id:
        description: "Review signal workflow run whose artifact identifies the pull request."
        required: false
        type: number
        default: 0
      review_signal_head_sha:
        description: "Pull request head SHA recorded by the review signal workflow run."
        required: false
        type: string
        default: ""

# The target repository and event are read from the caller's context: inside a reusable
# workflow, github.repository and github.event describe the calling workflow. The review
# artifact is untrusted input and is validated against the workflow run's recorded head
# SHA before the configured PAT or GitHub App token reruns the authoritative policy run.

permissions:
  actions: read
  contents: read
  issues: read
  pull-requests: read
  statuses: write

jobs:
  label-test:
    runs-on: ubuntu-latest

    steps:
      - name: Download review context
        if: ${{ github.event_name == 'workflow_run' }}
        uses: actions/download-artifact@v8
        with:
          name: label-test-review-context
          path: ${{ runner.temp }}/label-test-review-context
          run-id: ${{ inputs.review_signal_run_id }}
          github-token: ${{ github.token }}

      - name: Check out Label Sync repository
        uses: actions/checkout@v7
        with:
          repository: ${{ inputs.label_sync_repository }}
          ref: ${{ inputs.label_sync_ref }}

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Load properties
        id: properties
        env:
          GITHUB_REPOSITORY: ${{ inputs.label_sync_repository }}
        run: node scripts/export-properties.mjs

      - name: Resolve PAT auth token
        id: pat_auth
        if: ${{ steps.properties.outputs.auth_mode == 'pat' }}
        env:
          AUTH_MODE: pat
          PAT_TOKEN: ${{ secrets[steps.properties.outputs.pat_token_secret_name] }}
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/create-github-auth-token.mjs

      - name: Resolve GitHub App auth token
        id: app_auth
        if: ${{ steps.properties.outputs.auth_mode == 'githubApp' }}
        env:
          AUTH_MODE: githubApp
          GITHUB_APP_ID: ${{ secrets[steps.properties.outputs.github_app_id_secret_name] }}
          GITHUB_APP_PRIVATE_KEY: ${{ secrets[steps.properties.outputs.github_app_private_key_secret_name] }}
          GITHUB_APP_INSTALLATION_ID: ${{ secrets[steps.properties.outputs.github_app_installation_id_secret_name] }}
        run: node scripts/create-github-auth-token.mjs

      - name: Check PR labels and approvals
        if: ${{ github.event_name == 'pull_request_target' }}
        env:
          TARGET_REPOSITORY: ${{ github.repository }}
          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_TOKEN: ${{ github.token }}
        run: node scripts/check-pr-label-policy.mjs

      - name: Rerun authoritative Label Test
        if: ${{ github.event_name == 'workflow_run' }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
          TARGET_REPOSITORY: ${{ github.repository }}
          PULL_REQUEST_NUMBER_FILE: ${{ runner.temp }}/label-test-review-context/pr-number.txt
          REVIEW_SIGNAL_HEAD_SHA: ${{ inputs.review_signal_head_sha }}
        run: node scripts/rerun-label-policy.mjs