name: Maintainer Approval Rerun

# Bridges a maintainer's approving review to a re-run of the Maintainer Approval
# check (`pull_request_target` doesn't fire on reviews). A fork PR's review token
# is read-only and held behind the fork-approval gate, so it can't re-run a
# workflow itself; this job only records the PR number as an artifact, and the
# privileged re-run happens in maintainer-approval-rerun-run.yml (workflow_run).
# See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

on:
  pull_request_review:
    types: [submitted]

permissions:
  contents: read

concurrency:
  group: maintainer-approval-rerun-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  record:
    # Approvals flip the check green; dismissals and changes-requested flip
    # it red. Skip COMMENTED reviews (they don't change review state).
    if: github.event.review.state != 'commented'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Record PR number
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          mkdir -p pr
          echo "$PR_NUMBER" > pr/pr_number
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: maintainer-approval-pr-number
          path: pr/
          retention-days: 1
          if-no-files-found: error