.github/workflows/ci.yaml

name: Test

on:
  push:
    branches:
      - main
  pull_request_target:
    types: [labeled, opened, reopened, synchronize]

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

env:
  SUPER_SECRET: ${{ secrets.SUPER_SECRET }}

jobs:
  check-permissions:
    name: permissions check
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
        with:
          persist-credentials: false
      - name: permissions PR
        if: github.event_name == 'pull_request_target'
        run: |
          python3 -uS .github/workflows/script.py \
              --repo-id ${{ github.event.repository.id }} \
              --pr ${{ github.event.number }} \
              --event ${{ github.event.action }} \
              --username "$ARG_USERNAME" \
              --label-names "$ARG_LABEL_NAMES"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # these can contain special characters
          ARG_USERNAME: ${{ github.event.pull_request.user.login }}
          ARG_LABEL_NAMES: ${{ toJSON(github.event.pull_request.labels.*.name) }}
      - name: permissions
        if: github.event_name == 'push'
        run: true

  test:
    needs: check-permissions
    name: amazing-test
    runs-on: ubuntu-latest
    timeout-minutes: 1

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v4
        with:
          python-version: 3.12

      - name: Install
        run: |
          pip install sentry_sdk