name: Checks

on: pull_request_target

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  recent-base:
    name: Branch base is sufficiently recent
    runs-on: ubuntu-latest
    steps:
      - name: Check out the base branch
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Check out the PR branch
        uses: actions/checkout@v3
        with:
          ref: ${{ github.head_ref }}
          fetch-depth: 0

      - name: Ensure branch contains necessary commits for Tekton CI
        id: tekton
        # https://github.com/zcash/zcash/pull/6358
        run: git merge-base --is-ancestor 267ddf8efe36cc799c4c31772a8883ea332ef55b ${{ github.head_ref }}

      - name: Tell PR author if they need to rebase
        if: failure() && steps.tekton.outcome == 'failure'
        run: echo "::error::Branch needs to be rebased so that Tekton CI can run"

      - name: Avoid running Tekton CI if it would provably fail
        if: failure() && steps.tekton.outcome == 'failure'
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.issues.removeLabel({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: "safe-to-build",
            })