name: Latest Changes

on:
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    branches:
      - master
    types:
      - closed
  workflow_dispatch:
    inputs:
      number:
        description: PR number
        required: true
      debug_enabled:
        description: "Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)"
        required: false
        default: "false"

permissions: {}

jobs:
  latest-changes:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      pull-requests: read
    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true
    steps:
      - name: Dump GitHub context
        env:
          GITHUB_CONTEXT: ${{ toJson(github) }}
        run: echo "$GITHUB_CONTEXT"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.repository.default_branch }}
          # To allow latest-changes to commit to the default branch
          token: ${{ secrets.LATEST_CHANGES }} # zizmor: ignore[secrets-outside-env]
          persist-credentials: true # required by tiangolo/latest-changes
      - uses: tiangolo/latest-changes@c9b73efbc8992ef1a401e4235ea307a8ca8a724b # 0.6.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          latest_changes_file: ./release-notes.md
          latest_changes_header: "## Latest Changes"
          end_regex: "^## "
          debug_logs: true
          label_header_prefix: "### "