frontend/.github/workflows/restrict-task-creation.yml

name: Restrict task creation

# yamllint disable-line rule:truthy
on:
  issues:
    types: [opened]

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number }}

jobs:
  add-no-stale:
    name: Add no-stale label
    runs-on: ubuntu-latest
    permissions:
      issues: write # To add labels to issues
    if: >-
      github.event.issue.type.name == 'Task'
      || github.event.issue.type.name == 'Epic'
      || github.event.issue.type.name == 'Opportunity'
    steps:
      - name: Add no-stale label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['no-stale']
            });

  check-authorization:
    name: Check authorization
    runs-on: ubuntu-latest
    permissions:
      issues: write # To comment on, label, and close issues
    # Only run if this is a Task issue type (from the issue form)
    if: github.event.issue.type.name == 'Task'
    steps:
      - name: Check if user is authorized
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const issueAuthor = context.payload.issue.user.login;

            // Check if user is an organization member
            try {
              await github.rest.orgs.checkMembershipForUser({
                org: 'home-assistant',
                username: issueAuthor
              });
              console.log(`✅ ${issueAuthor} is an organization member`);
              return; // Authorized
            } catch (error) {
              console.log(`❌ ${issueAuthor} is not authorized to create Task issues`);
            }

            // Close the issue with a comment
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `Hi @${issueAuthor}, thank you for your contribution!\n\n` +
                    `Task issues are restricted to Open Home Foundation staff and authorized contributors.\n\n` +
                    `If you would like to:\n` +
                    `- Report a bug: Please use the [bug report form](https://github.com/home-assistant/frontend/issues/new?template=bug_report.yml)\n` +
                    `- Request a feature: Please submit to [Feature Requests](https://github.com/orgs/home-assistant/discussions)\n\n` +
                    `If you believe you should have access to create Task issues, please contact the maintainers.`
            });

            await github.rest.issues.update({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              state: 'closed'
            });

            // Add a label to indicate this was auto-closed
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['auto-closed']
            });