---
name: "Enforce PR labels"

on:  # yamllint disable-line rule:truthy
  pull_request_target:
    types: [labeled, unlabeled, opened, edited, synchronize]

permissions:
  contents: read # to read configuration file
  pull-requests: write # to label PRs

jobs:
  enforce-label:
    if: github.repository == 'dev-sec/ansible-collection-hardening'
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"