name: PR Checks

on:
  pull_request:
    types: [opened, labeled, unlabeled, synchronize]
permissions:
  contents: read
  actions: read
  checks: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  migration-atlas-sum:
    name: Migration atlas.sum append-only
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Run atlas.sum check unit tests
        run: python3 -m unittest discover -s .github/tools/migrate -p 'test_*.py'

      - name: Check atlas.sum is append-only
        # base.sha is always a hex SHA, but route it via env for consistency
        # with the repo-wide rule of never interpolating ${{ }} into run:.
        run: python3 .github/tools/migrate/check_atlas_sum_append_only.py "$BASE_SHA"
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}

  release-label:
    name: Release note label
    runs-on: ubuntu-latest
    permissions:
      checks: write
      pull-requests: write
    steps:
      - name: Check minimum labels
        uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
        with:
          mode: minimum
          count: 1
          labels: |
            release-note/ignore
            kind/feature
            release-note/feature
            kind/bug
            release-note/bug-fix
            release-note/breaking-change
            release-note/deprecation
            area/dependencies
            release-note/dependency-update
            kind/refactor
            release-note/misc
            kind/documentation