pr-check.yml

name: Validate subdomain PR

# pull_request_target gives us a token that can comment on and close pull
# requests, even when they come from forks. We deliberately check out the BASE
# branch (trusted code) and read the PR's files through the API instead of
# checking out / running anything from the fork.
on:
  pull_request_target:
    types: [opened, reopened, synchronize, edited]

permissions:
  contents: read
  pull-requests: write
  issues: write

# Only run the latest validation per PR.
concurrency:
  group: validate-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      # Checks out the base branch (NOT the PR head) so the validation script
      # we run is the trusted version from the repository.
      - uses: actions/checkout@v4

      - uses: actions/github-script@v7
        with:
          script: |
            const validate = require('./.github/scripts/validate-pr.js')
            await validate({ github, context, core })