From c6132aa28a8fa326dd7d72e9d60d02d16d9a81cd Mon Sep 17 00:00:00 2001
From: Andrea Brancaleoni <abc@pompel.me>
Date: Mon, 25 Sep 2023 16:08:11 +0200
Subject: [PATCH] action.yml: add hotwords message

---
 action.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/action.yml b/action.yml
index 48da4d71..29e00416 100644
--- a/action.yml
+++ b/action.yml
@@ -420,7 +420,38 @@ runs:
               const ret = hotwords.some((word) => content.includes(word));
               console.log("hotword hit: %s", ret);
 
+              if (ret) {
+                const m = `The security team is monitoring all repositories for certain keywords. This PR includes the word(s) "${hotwords.filter(word => content.includes(word)).join(', ')}" and so security team members have been added as reviewers to take a look.<br/>
+                  No need to request a full security review at this stage, the security team will take a look shortly and either clear the label or request more information/changes.<br/>
+                  Notifications have already been sent, but if this is blocking your merge feel free to reach out directly to the security team on Slack so that we can expedite this check.`
+
+                var query = `query($owner:String!, $name:String!, $prnumber:Int!) { 
+                  repository(owner:$owner, name:$name) { 
+                    pullRequest(number:$prnumber) {
+                      comments(first: 100) {
+                        nodes {
+                          author { login }
+                          body
+                          bodyHTML
+                          bodyText
+                        }
+                      }
+                    }
+                  }
+                }`;
+                const messages = (await github.graphql(query, variables)).repository.pullRequest.comments.nodes.map(node => node.body);
+
+                if (!messages.includes(m))
+                  github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: context.issue.number,
+                    body: m
+                  });
+              }
+                
               return ret;
+
     - id: should-trigger 
       if: ${{ steps.reviewdog-enabled-pr.outputs.result == 'true' && !(steps.assignee-removed-label.outputs.result  == 'true') && ( (steps.comments-before.outputs.result != steps.comments-after.outputs.result) || steps.description-contains-hotwords.outputs.result == 'true') }}
       shell: bash