pull_request_target.yml

name: Process pull_request_target Events

on:
  pull_request_target:
    types:
      - assigned
      - closed
      - edited
      - labeled
      - opened
      - ready_for_review
env:
  ISSUE_URL: ${{ github.event.pull_request.html_url }}

jobs:
  labels:
    name: Labelers
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App Token
        id: token
        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PEM }}

      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          sparse-checkout: .github

      - name: Apply Service Labels
        if: contains(fromJSON('["opened", "edited"]'), github.event.action)
        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
        with:
          configuration-path: .github/labeler-pr-triage.yml
          repo-token: ${{ steps.token.outputs.token }}

      - name: Apply Size Labels
        if: contains(fromJSON('["opened", "edited"]'), github.event.action)
        uses: codelytv/pr-size-labeler@56f6f0fc35c7cc0f72963b8467729e1120cb4bed # v1.10.0
        with:
          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
          xs_label: "size/XS"
          xs_max_size: "30"
          s_label: "size/S"
          s_max_size: "60"
          m_label: "size/M"
          m_max_size: "150"
          l_label: "size/L"
          l_max_size: "300"
          xl_label: "size/XL"
          message_if_xl: ""

      - name: "Community Check: Author"
        id: author
        if: github.event.action == 'opened'
        uses: ./.github/actions/community_check
        with:
          user_login: ${{ github.event.pull_request.user.login }}
          maintainers: ${{ secrets.MAINTAINERS }}
          core_contributors: ${{ secrets.CORE_CONTRIBUTORS }}
          partners: ${{ secrets.PARTNERS }}

      - name: Indicate That Triage is Required
        if: |
          github.event.action == 'opened'
          && steps.author.outputs.maintainer == 'false'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: gh pr edit "$ISSUE_URL" --add-label needs-triage

      - name: Add prioritized to Maintainer Contributions
        if: |
          github.event.action == 'opened'
          && steps.author.outputs.maintainer == 'true'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: gh pr edit "$ISSUE_URL" --add-label prioritized

      - name: Credit Core Contributor Contributions
        if: |
          github.event.action == 'opened'
          && steps.author.outputs.core_contributor == 'true'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          gh pr edit "$ISSUE_URL" --add-label external-maintainer

      - name: Credit Partner Contributions
        if: |
          github.event.action == 'opened'
          && steps.author.outputs.partner == 'true'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          gh pr edit "$ISSUE_URL" --add-label partner

      - name: "Community Check: Assignee"
        id: assignee
        if: github.event.action == 'assigned'
        uses: ./.github/actions/community_check
        with:
          user_login: ${{ github.event.assignee.login }}
          maintainers: ${{ secrets.MAINTAINERS }}

      - name: Add prioritized to Maintainer Assignments
        if: |
          github.event.action == 'assigned'
          && steps.assignee.outputs.maintainer == 'true'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          gh pr edit "$ISSUE_URL" --add-label prioritized

      - name: Remove Triage Labels on Closure
        if: |
          github.event.action == 'closed'
          && (contains(github.event.pull_request.labels.*.name, 'needs-triage') || contains(github.event.pull_request.labels.*.name, 'waiting-response'))
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: gh pr edit "$ISSUE_URL" --remove-label needs-triage,waiting-response

  project:
    name: Maintainer Work Board
    runs-on: ubuntu-latest
    env:
      # Some gh project calls take the project's ID, some take the project's number
      PROJECT_ID: "PVT_kwDOAAuecM4AF-7h"
      PROJECT_NUMBER: "196"
      STATUS_FIELD_ID: "PVTSSF_lADOAAuecM4AF-7hzgDcsQA"
      VIEW_FIELD_ID: "PVTSSF_lADOAAuecM4AF-7hzgMRB34"

    steps:
      - name: Generate GitHub App Token
        id: token
        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PEM }}

      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          sparse-checkout: .github/actions/community_check

      - name: Community Check
        id: community_check
        if: github.event.action == 'opened'
        uses: ./.github/actions/community_check
        with:
          user_login: ${{ github.event.action == 'assigned' && github.event.assignee.login || github.event.pull_request.user.login }}
          maintainers: ${{ secrets.MAINTAINERS }}

      - name: Maintainer Pull Requests
        if: |
          github.event.action == 'opened'
          && steps.community_check.outputs.maintainer == 'true'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          # In order to update the item's Status field, we need to capture the project item id from the output
          PROJECT_ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner "hashicorp" --url "$ISSUE_URL" --format json | jq '.id')
          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id "$PROJECT_ID" --field-id "$STATUS_FIELD_ID" --single-select-option-id ${{ vars.team_project_status_maintainer_pr }}
          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id "$PROJECT_ID" --field-id "$VIEW_FIELD_ID "--single-select-option-id ${{ vars.team_project_view_working_board }}

      - name: Assigned to Maintainers
        if: |
          github.event.action == 'assigned'
          && steps.community_check.outputs.maintainer == 'true'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          PROJECT_ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner "hashicorp" --url "$ISSUE_URL" --format json | jq '.id')
          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id "$PROJECT_ID" --field-id "$STATUS_FIELD_ID" --single-select-option-id ${{ vars.team_project_status_in_progress }}
          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id "$PROJECT_ID" --field-id "$VIEW_FIELD_ID" --single-select-option-id ${{ vars.team_project_view_working_board }}

      - name: Labeled Prioritized
        if: github.event.label.name == 'prioritized'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          PROJECT_ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner "hashicorp" --url "$ISSUE_URL" --format json | jq '.id')
          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id "$PROJECT_ID" --field-id "$VIEW_FIELD_ID" --single-select-option-id ${{ vars.team_project_view_working_board }}

      - name: Labeled Engineering Initiative
        if: github.event.label.name == 'engineering-initiative'
        env:
          GH_TOKEN: ${{ steps.token.outputs.token }}
        run: |
          PROJECT_ITEM_ID=$(gh project item-add "$PROJECT_NUMBER" --owner "hashicorp" --url "$ISSUE_URL" --format json | jq '.id')
          gh project item-edit --id "$PROJECT_ITEM_ID" --project-id "$PROJECT_ID" --field-id "$VIEW_FIELD_ID" --single-select-option-id ${{ vars.team_project_view_engineering_initiative }}

  add_to_milestone:
    name: Add Merged Pull Requests and Related Issues to Milestone
    if: github.event.action == 'closed' && github.event.pull_request.merged
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Get Current Milestone Name
        id: get-current-milestone
        run: echo "current_milestone=v$(head -1 CHANGELOG.md | cut -d " " -f 2)" >> "$GITHUB_OUTPUT"

      - name: Add Items to Milestone
        env:
          GH_TOKEN: ${{ github.token }}
          MILESTONE: ${{ steps.get-current-milestone.outputs.current_milestone }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        shell: bash
        run: ./.ci/scripts/add-to-milestone.sh

  community_note:
    name: Community Note
    if: github.event.action == 'opened'
    runs-on: ubuntu-latest
    steps:
      - name: Add community note to new Pull Requests
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            # Community Note

            **Voting for Prioritization**

            * Please vote on this pull request by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original post to help the community and maintainers prioritize this pull request.
            * Please see our [prioritization guide](https://hashicorp.github.io/terraform-provider-aws/prioritization/) for information on how we prioritize.
            * Please **do not** leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

            **For Submitters**

            * Review the [contribution guide](https://hashicorp.github.io/terraform-provider-aws/) relating to the type of change you are making to ensure all of the necessary steps have been taken.
            * For new resources and data sources, use [skaff](https://hashicorp.github.io/terraform-provider-aws/skaff/) to generate scaffolding with comments detailing common expectations.
            * Whether or not the branch has been rebased will **not** impact prioritization, but doing so is always a welcome surprise.

  first_contribution_note:
    name: New Contributor Note
    if: github.event.action == 'opened'
    runs-on: ubuntu-latest
    steps:
      - name: Add comment to add helpful context for new contributors
        uses: actions/first-interaction@34f15e814fe48ac9312ccf29db4e74fa767cbab7 # v1.3.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          pr-message: |-
            Welcome @${{github.actor}} :wave:

            It looks like this is your first Pull Request submission to the [Terraform AWS Provider](https://github.com/hashicorp/terraform-provider-aws)! If you haven’t already done so please make sure you have checked out our [CONTRIBUTOR](https://hashicorp.github.io/terraform-provider-aws/) guide and [FAQ](https://hashicorp.github.io/terraform-provider-aws/faq/) to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

            Also take a look at our [FAQ](https://hashicorp.github.io/terraform-provider-aws/faq/) which details how we prioritize Pull Requests for inclusion.

            Thanks again, and welcome to the community! :smiley:

  permissions_check:
    name: Verify Maintainers Can Edit
    runs-on: ubuntu-latest
    if: github.event.action == 'opened'
    steps:
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          sparse-checkout: .github/actions/community_check

      - name: Community Check
        id: community_check
        uses: ./.github/actions/community_check
        with:
          user_login: ${{ github.event.action == 'assigned' && github.event.assignee.login || github.event.pull_request.user.login }}
          maintainers: ${{ secrets.MAINTAINERS }}

      - name: Comment if Not
        if: |
          steps.community_check.outputs.maintainer == 'false'
          && !github.event.pull_request.maintainer_can_modify
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            Hey @${{ github.actor }} :wave: Thank you very much for your contribution! At times, our maintainers need to make direct edits to pull requests in order to help get it ready to be merged. Your current settings do not allow maintainers to make such edits. To help facilitate this, update your pull request to allow such edits as described in GitHub's [Allowing changes to a pull request branch created from a fork][1] documentation. (If you're using a fork owned by an organization, your organization may not allow you to change this setting. If that is the case, let us know.)

            [1]: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork