From 38dc87002c890c7e90b50f5a6efe095191ad0170 Mon Sep 17 00:00:00 2001
From: Tim te Beek <tim@moderne.io>
Date: Mon, 16 Dec 2024 10:35:34 +0100
Subject: [PATCH] Run OpenRewrite best practices on pull requests

---
 .github/workflows/comment-pr.yml | 15 +++++++++++++++
 .github/workflows/receive-pr.yml | 17 +++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 .github/workflows/comment-pr.yml
 create mode 100644 .github/workflows/receive-pr.yml

diff --git a/.github/workflows/comment-pr.yml b/.github/workflows/comment-pr.yml
new file mode 100644
index 00000000..e5596102
--- /dev/null
+++ b/.github/workflows/comment-pr.yml
@@ -0,0 +1,15 @@
+name: comment-pr
+
+# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
+on:
+  workflow_run:
+    workflows: ["receive-pr"]
+    types:
+      - completed
+
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+# Since this pull request has write permissions on the target repo, we should **NOT** execute any untrusted code.
+jobs:
+  post-suggestions:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    uses: openrewrite/gh-automation/.github/workflows/comment-pr.yml@main
diff --git a/.github/workflows/receive-pr.yml b/.github/workflows/receive-pr.yml
new file mode 100644
index 00000000..f2751ff1
--- /dev/null
+++ b/.github/workflows/receive-pr.yml
@@ -0,0 +1,17 @@
+name: receive-pr
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    branches:
+      - main
+
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.ref }}'
+  cancel-in-progress: true
+
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+# Since this pull request receives untrusted code, we should **NOT** have any secrets in the environment.
+jobs:
+  upload-patch:
+    uses: openrewrite/gh-automation/.github/workflows/receive-pr.yml@main
\ No newline at end of file