workflow-warning.yml

name: Workflow Changes Warnings

on:
  # Note: potential security risk from this action using pull_request_target.
  # Do not add actions in here which need a checkout of the repo, and do not use any caching in here.
  # See: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target
  pull_request_target:
    types:
      - opened
      - reopened
      - synchronize
    paths:
      - .github/workflows/*.yml

permissions:
  contents: read

jobs:
  comment-concerning-workflow-changes:
    name: Comment Concerning Workflow Changes
    runs-on: ubuntu-latest
    if: |
      (github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
      - name: Find comment
        uses: peter-evans/find-comment@d5fe37641ad8451bdd80312415672ba26c86575e # v3.0.0
        id: fc
        with:
          issue-number: ${{ github.event.pull_request.number }}
          comment-author: 'github-actions[bot]'
          body-includes: |
            This Pull Request modifies GitHub workflows and is coming from a fork.
      - name: Create comment
        if: |
          (steps.fc.outputs.comment-id == '') &&
          (!contains(github.event.pull_request.labels.*.name, 'approved')) &&
          (github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name)
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            > **Warning**
            > This Pull Request modifies GitHub Workflows and is coming from a fork.
            **It is very important for the reviewer to ensure that the workflow changes are appropriate.**
          edit-mode: replace
      - name: Update comment
        if: |
          contains(github.event.pull_request.labels.*.name, 'approved')
        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
        with:
          comment-id: ${{ steps.fc.outputs.comment-id }}
          issue-number: ${{ github.event.pull_request.number }}
          body: |
            > **Note**
            > Changes have been approved by a maintainer.
          reactions: |
            hooray
          edit-mode: append