name: Issue Link Sync

"on":
  pull_request_target:
    types: [opened, reopened, edited, closed]
    branches: [main]

permissions:
  contents: read
  issues: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  sync-linked-issues:
    name: Sync linked issue state
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Check out trusted base branch scripts
        uses: actions/checkout@v4
        with:
          # pull_request_target has write-capable tokens. Run scripts from the
          # pre-merge base commit, never from the pull request head.
          ref: ${{ github.event.pull_request.base.sha }}
          persist-credentials: false

      - name: Sync issue labels and comments
        env:
          GITHUB_EVENT_PATH: ${{ github.event_path }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_TOKEN: ${{ github.token }}
        run: python3 .github/scripts/issue_link_sync.py