automate_changeset_feedback.yml

name: Automate changeset feedback
on:
  pull_request_target:
    branches: ['master']

permissions:
  pull-requests: write
  actions: none
  checks: none
  contents: none
  deployments: none
  issues: none
  packages: none
  pages: none
  repository-projects: none
  security-events: none
  statuses: none

jobs:
  feedback:
    # prevent running towards forks and version packages
    if: github.repository == 'backstage/backstage' && github.event.pull_request.user.login != 'backstage-service'
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          # Fetch the commit that's merged into the base rather than the target ref
          # This will let us diff only the contents of the PR, without fetching more history
          ref: 'refs/pull/${{ github.event.pull_request.number }}/merge'
      - name: fetch base
        run: git fetch --depth 1 origin ${{ github.base_ref }}
      - uses: backstage/actions/changeset-feedback@772cef06641090d0095188e15c85647acdf0c250 # v0.6.11
        name: Generate feedback
        with:
          diff-ref: 'origin/master'
          marker: <!-- changeset-feedback -->
          issue-number: ${{ github.event.pull_request.number }}
          bot-username: backstage-goalie[bot]
          app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }}
          private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }}
          installation-id: ${{ secrets.BACKSTAGE_GOALIE_INSTALLATION_ID }}