pr-takeover.yml

name: PR Takeover on Label

on:
  pull_request_target:
    types:
      - labeled

permissions:
  contents: read

jobs:
  pr-takeover:
    if: github.event.label.name == 'takeover'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
        with:
          egress-policy: audit

      - name: Check out the repo
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Set up Git
        run: |
          git config --global user.name "urunc-bot[bot]"
          git config --global user.email "urunc-bot[bot]@users.noreply.github.com"

      - name: Extract PR info
        id: prinfo
        shell: bash
        env:
          GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
          GITHUB_EVENT_PULL_REQUEST_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
          GITHUB_EVENT_PULL_REQUEST_HEAD_REF: ${{ github.event.pull_request.head.ref }}
        run: |
          {
            echo "PR_NUMBER=${GITHUB_EVENT_PULL_REQUEST_NUMBER}"
            echo "PR_HEAD_REPO=${GITHUB_EVENT_PULL_REQUEST_HEAD_REPO}"
            echo "PR_HEAD_REF=${GITHUB_EVENT_PULL_REQUEST_HEAD_REF}"
          } >> "$GITHUB_OUTPUT"

      - name: Create new local branch for takeover
        run: |
          git fetch origin main
          git checkout -b main-pr${{ steps.prinfo.outputs.PR_NUMBER }} origin/main

      - name: Generate urunc-bot token
        id: generate-token
        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
        with:
          app-id: ${{ vars.URUNC_BOT_APP_ID }}
          private-key: ${{ secrets.URUNC_BOT_PRIVATE_KEY }}

      - name: Push new branch to origin
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          git push origin main-pr${{ steps.prinfo.outputs.PR_NUMBER }}

      - name: Change PR base via GitHub API
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          gh pr edit ${{ steps.prinfo.outputs.PR_NUMBER }} --base main-pr${{ steps.prinfo.outputs.PR_NUMBER }}