backstage/.github/workflows/sync_pull-requests.yml

name: Sync Pull Requests

on:
  workflow_run:
    workflows: ['Sync Pull Requests Trigger', 'CI', 'E2E Linux']
    types:
      - completed

jobs:
  run:
    runs-on: ubuntu-latest
    # Only run on the trigger workflow, or if the source workflow was triggered by a pull request
    if: >
      github.event.workflow_run.name == 'Sync Pull Requests Trigger' ||
      github.event.workflow_run.event == 'pull_request'
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit

      - name: Download PR context
        id: download
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        continue-on-error: true
        with:
          name: pr-context
          path: ./context
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Read context
        if: steps.download.outcome == 'success'
        id: context
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          script: |
            const fs = require('fs');
            function read(path, fallback) {
              try { return fs.readFileSync(path, 'utf8').trim(); }
              catch { return fallback; }
            }
            core.setOutput('pr-number', read('./context/pr-number', ''));
            core.setOutput('label-added', read('./context/label-added', ''));
            core.setOutput('review-state', read('./context/review-state', ''));
            core.setOutput('actor', read('./context/actor', ''));
            core.setOutput('action', read('./context/action', 'synchronize'));

      - name: Backstage PR automation
        if: steps.context.outputs.pr-number
        uses: backstage/actions/pr-automation@2cd6978b476cbdc39fec48346f8b6ca13199dd6a # v0.7.8
        with:
          app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }}
          private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }}
          installation-id: ${{ secrets.BACKSTAGE_GOALIE_INSTALLATION_ID }}
          project-owner: backstage
          project-number: '14'
          pr-number: ${{ steps.context.outputs.pr-number }}
          label-added: ${{ steps.context.outputs.label-added }}
          review-state: ${{ steps.context.outputs.review-state }}
          actor: ${{ steps.context.outputs.actor }}
          action: ${{ steps.context.outputs.action }}
          required-checks: |
            DCO
            E2E Linux 22.x
            E2E Linux 24.x
            Test 22.x
            Test 24.x
            Verify 22.x
            Verify 24.x