name: vouch-check-issue

on:
 issues:
 types: [opened]

permissions:
 contents: read
 issues: write

jobs:
 check:
 runs-on: ubuntu-latest
 steps:
 - name: Check if issue author is denounced
 uses: actions/github-script@v7
 with:
 script: |
 const author = context.payload.issue.user.login;
 const issueNumber = context.payload.issue.number;

 // Skip bots
 if (author.endsWith('[bot]')) {
 core.info(`Skipping bot: ${author}`);
 return;
 }

 // Read the VOUCHED.td file via API (no checkout needed)
 let content;
 try {
 const response = await github.rest.repos.getContent({
 owner: context.repo.owner,
 repo: context.repo.repo,
 path: '.github/VOUCHED.td',
 });
 content = Buffer.from(response.data.content, 'base64').toString('utf-8');
 } catch (error) {
 if (error.status === 404) {
 core.info('No .github/VOUCHED.td file found, skipping check.');
 return;
 }
 throw error;
 }

 // Parse the .td file for vouched and denounced users
 const vouched = new Set();
 const denounced = new Map();
 for (const line of content.split('\n')) {
 const trimmed = line.trim();
 if (!trimmed || trimmed.startsWith('#')) continue;

 const isDenounced = trimmed.startsWith('-');
 const rest = isDenounced ? trimmed.slice(1).trim() : trimmed;
 if (!rest) continue;

 const spaceIdx = rest.indexOf(' ');
 const handle = spaceIdx === -1 ? rest : rest.slice(0, spaceIdx);
 const reason = spaceIdx === -1 ? null : rest.slice(spaceIdx + 1).trim();

 // Handle platform:username or bare username
 // Only match bare usernames or github: prefix (skip other platforms)
 const colonIdx = handle.indexOf(':');
 if (colonIdx !== -1) {
 const platform = handle.slice(0, colonIdx).toLowerCase();
 if (platform !== 'github') continue;
 }
 const username = colonIdx === -1 ? handle : handle.slice(colonIdx + 1);
 if (!username) continue;

 if (isDenounced) {
 denounced.set(username.toLowerCase(), reason);
 continue;
 }

 vouched.add(username.toLowerCase());
 }

 // Check if the author is denounced
 const reason = denounced.get(author.toLowerCase());
 if (reason !== undefined) {
 // Author is denounced — close the issue
 const body = 'This issue has been automatically closed.';

 await github.rest.issues.createComment({
 owner: context.repo.owner,
 repo: context.repo.repo,
 issue_number: issueNumber,
 body,
 });

 await github.rest.issues.update({
 owner: context.repo.owner,
 repo: context.repo.repo,
 issue_number: issueNumber,
 state: 'closed',
 state_reason: 'not_planned',
 });

 core.info(`Closed issue #${issueNumber} from denounced user ${author}`);
 return;
 }

 // Author is positively vouched — add label
 if (!vouched.has(author.toLowerCase())) {
 core.info(`User ${author} is not denounced or vouched. Allowing issue.`);
 return;
 }

 await github.rest.issues.addLabels({
 owner: context.repo.owner,
 repo: context.repo.repo,
 issue_number: issueNumber,
 labels: ['Vouched'],
 });

 core.info(`Added vouched label to issue #${issueNumber} from ${author}`);