name: Restrict task creation

# yamllint disable-line rule:truthy
on:
  issues:
    types: [opened]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number }}

jobs:
  add-no-stale:
    name: Add no-stale label
    runs-on: ubuntu-latest
    permissions:
      issues: write # To add labels to issues
    if: >-
      github.event.issue.type.name == 'Task'
      || github.event.issue.type.name == 'Epic'
      || github.event.issue.type.name == 'Opportunity'
    steps:
      - name: Add no-stale label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['no-stale']
            });

  check-authorization:
    name: Check authorization
    runs-on: ubuntu-latest
    permissions:
      contents: read # To check out workflow scripts
      issues: write # To comment on, label, and close issues
    # Only run if this is a Task issue type (from the issue form)
    if: github.event.issue.type.name == 'Task'
    steps:
      - name: Check out workflow scripts
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/scripts
      - name: Check if user is authorized
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const { default: checkTaskAuthorization } = await import(
              `${process.env.GITHUB_WORKSPACE}/.github/scripts/check-task-authorization.mjs`
            );
            await checkTaskAuthorization({ github, context, core });