ci-label-check.yml

name: Verify PR Label

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - ready_for_review
      - labeled
      - unlabeled

permissions:  
  contents: read

jobs:
  check-label:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - name: Check PR label
        if: github.event.pull_request.user.login != 'dependabot'
        run: |
          LABEL_NAME="changelog:"
          if [[ $(curl -s "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" | jq -r '.labels[].name' | grep -c "^$LABEL_NAME") -eq 0 ]]; then
            echo "Error: Pull request is missing a required label of the form '${LABEL_NAME}***'."
            exit 1
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}