name: CLA Check

on:
  pull_request_target:
    types: [opened, reopened, synchronize]
  issue_comment:
    types: [created]

permissions:
  contents: write
  pull-requests: write
  statuses: write

jobs:
  cla-check:
    # Run on PR events, or on issue comments that are on PRs (not plain issues).
    if: >
      github.event_name == 'pull_request_target' ||
      (github.event_name == 'issue_comment' && github.event.issue.pull_request)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          # pull_request_target runs on the base branch; check out the base
          # so the signatures file is from the canonical source.
          ref: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: CLA enforcement
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const claCheck = require('${{ github.workspace }}/.github/scripts/cla-check.js');
            await claCheck({ github, context, core });