mcp-microsoft/.github/workflows/event-processor.yml

name: GitHub Event Processor

on:
  issues:
    types: [edited, labeled, opened, reopened, unlabeled]
  # issue_comment is used for both issues and pull_requests
  # github.event.issue.pull_request will be non-null on pull request comments
  issue_comment:
    types: [created]
  # synchronize is the pull_request_target event when changes are pushed
  # pull request merged is the closed event with github.event.pull_request.merged = true
  pull_request_target:
    types: [closed, labeled, opened, reopened, review_requested, synchronize, unlabeled]

# This removes all unnecessary permissions, the ones needed will be set below.
# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
permissions: {}

jobs:
  # Only newly opened issues need Azure login and secrets from Key Vault.
  event-handler-with-azure:
    if: ${{ github.event_name == 'issues' && github.event.action == 'opened' }}
    permissions:
      issues: write
      # For OIDC auth
      id-token: write
    name: Handle ${{ github.event_name }} ${{ github.event.action }} event with azure login
    runs-on: ubuntu-latest
    steps:
      - name: 'Az CLI login'
        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
        with:
            client-id: e4cb9fd5-0875-4ca1-bc43-56196f5dfb8f
            tenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
            allow-no-subscriptions: true

      - name: 'Run Azure CLI commands'
        run: |
          LABEL_SERVICE_API_KEY=$(az keyvault secret show \
            --vault-name issue-labeler \
            -n issue-labeler-func-key \
            -o tsv \
            --query value)

          echo "::add-mask::$LABEL_SERVICE_API_KEY"
          echo "LABEL_SERVICE_API_KEY=$LABEL_SERVICE_API_KEY" >> "$GITHUB_ENV"

          APP_CONFIG_ENDPOINT=$(az keyvault secret show \
            --vault-name issue-labeler \
            -n app-config-endpoint \
            -o tsv \
            --query value)

          echo "::add-mask::$APP_CONFIG_ENDPOINT"
          echo "APP_CONFIG_ENDPOINT=$APP_CONFIG_ENDPOINT" >> "$GITHUB_ENV"

      - name: Install GitHub Event Processor
        run: >
          dotnet tool install
          Azure.Sdk.Tools.GitHubEventProcessor
          --version 1.0.0-dev.20260403.1
          --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
          --global
        shell: bash

      - name: Process Action Event
        run: |
          github-event-processor ${{ github.event_name }} ${{ github.event_path }}
        shell: bash
        env:
          # This is a temporary secret generated by github
          # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LABEL_SERVICE_API_KEY: ${{ env.LABEL_SERVICE_API_KEY }}
          APP_CONFIG_ENDPOINT: ${{ env.APP_CONFIG_ENDPOINT }}

      - name: Archive github event data
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: event
          path: ${{ github.event_path }}

  event-handler:
    if: ${{ !(github.event_name == 'issues' && github.event.action == 'opened') }}
    permissions:
      issues: write
      # PR events can dismiss approvals after untrusted changes.
      pull-requests: write
    name: Handle ${{ github.event_name }} ${{ github.event.action }} event
    runs-on: ubuntu-latest
    steps:
      - name: Install GitHub Event Processor
        run: >
          dotnet tool install
          Azure.Sdk.Tools.GitHubEventProcessor
          --version 1.0.0-dev.20260403.1
          --add-source https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-net/nuget/v3/index.json
          --global
        shell: bash

      - name: Process Action Event
        run: |
          github-event-processor ${{ github.event_name }} ${{ github.event_path }}
        shell: bash
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Archive github event data
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: event
          path: ${{ github.event_path }}