name: New Authors Check

# pull_request_target runs with base-repo permissions (including write) even
# for fork PRs, allowing us to post a comment directly without the artifact
# hand-off to a second workflow_run workflow.
#
# Only git history is read here — no PR code is built or executed — so
# checking out the PR head SHA is safe under pull_request_target.
on:
  pull_request_target:

permissions:
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  check-id:
    name: New Author Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout PR code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
      - run: sudo apt -y install git
      - name: Export known authors from main branch
        run: git log --format="%an <%ae>" origin/main | sort | uniq > authors.txt
      - name: Export authors from new commits
        run: git log --format="%an <%ae>" ${{ github.event.pull_request.base.sha }}... | sort | uniq > commit-authors.txt
      - name: Check new authors
        run: |
          touch new-authors.txt
          while read -r author; do
             echo "Checking author: ${author}"
             if ! grep -qFx "${author}" authors.txt; then
                 echo "ERROR: ${author} NOT FOUND"
                 echo "::warning ::New author found: ${author}"
                 echo "${author}" >> new-authors.txt
                 echo has_new_authors="yes" >> $GITHUB_ENV
             fi
          done < commit-authors.txt
      - name: Comment on PR
        if: ${{ env.has_new_authors == 'yes' }}
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            let msg = 'NOTE: This PR may contain new authors.';
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: msg
            });