name: Auto Label

on:
  pull_request_target:
    types: [opened, synchronize]

permissions: {}

jobs:
  label:
    runs-on: ubuntu-latest
    # Skip PRs targeting next (retargeted or direct) to avoid label explosion
    # from the large diff between next and feature branches.
    # Skip bot sync PRs (main→next) which touch many files but are purely devops.
    if: >
      github.repository_owner == 'better-auth' &&
      github.event.pull_request.base.ref != 'next' &&
      github.actor != 'better-release[bot]'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Generate App Token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        if: vars.RELEASE_APP_ID != ''
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
        with:
          repo-token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
          sync-labels: false
          dot: true