automate_changeset_feedback.yml

name: Automate changeset feedback
on:
  pull_request_target:
    branches: ['main']

permissions:
  pull-requests: write
  actions: none
  checks: none
  contents: none
  deployments: none
  issues: none
  packages: none
  pages: none
  repository-projects: none
  security-events: none
  statuses: none

jobs:
  changeset-feedback:
    name: Generate Changeset Feedback
    # prevent running towards forks and version packages
    if: github.repository == 'redhat-developer/rhdh-plugins' && github.event.pull_request.user.login != 'rhdh-bot'
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
        with:
          # Fetch the commit that's merged into the base rather than the target ref
          # This will let us diff only the contents of the PR, without fetching more history
          ref: 'refs/pull/${{ github.event.pull_request.number }}/merge'
      - name: fetch base
        run: git fetch --depth 1 origin ${{ github.base_ref }}

      - uses: backstage/actions/changeset-feedback@v0.6.10
        name: Generate feedback
        with:
          diff-ref: 'origin/main'
          marker: <!-- changeset-feedback -->
          issue-number: ${{ github.event.pull_request.number }}
          app-id: ${{ secrets.RHDH_GH_APP_ID }}
          bot-username: rhdh-gh-app[bot]
          private-key: ${{ secrets.RHDH_GH_APP_PRIVATE_KEY }}
          installation-id: ${{ secrets.RHDH_GH_APP_INSTALLATION_ID }}
          multiple-workspaces: true