bitwarden-server/.github/workflows/protect-files.yml

# Runs if there are changes to the paths: list.
# Starts a matrix job to check for modified files, then sets output based on the results.
# The input decides if the label job is ran, adding a label to the PR.
name: Protect files

on:
  pull_request:
    types:
      - opened
      - synchronize
      - unlabeled
    paths:
      - "util/Migrator/DbScripts/**.sql"

jobs:
  changed-files:
    name: Check for file changes
    runs-on: ubuntu-22.04
    outputs:
      changes: ${{steps.check-changes.outputs.changes_detected}}

    strategy:
      fail-fast: true
      matrix:
        include:
          - name: Database Scripts
            path: util/Migrator/DbScripts
            label: "DB-migrations-changed"
    steps:
      - name: Check out repo
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 2

      - name: Check for file changes
        id: check-changes
        run: |
          MODIFIED_FILES=$(git diff --name-only --diff-filter=M HEAD~1)

          for file in $MODIFIED_FILES
          do
            if [[ $file == *"${{ matrix.path }}"* ]]; then
              echo "changes_detected=true" >> $GITHUB_OUTPUT
              break
            else echo "changes_detected=false" >> $GITHUB_OUTPUT
            fi
          done          

      - name: Add label to pull request
        if: contains(steps.check-changes.outputs.changes_detected, 'true')
        uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 # 1.0.4
        with:
          add-labels: ${{ matrix.label }}