name: Pull Request

on:
  pull_request:
    types: [labeled, opened, synchronize, reopened]

jobs:
  e2e:
    name: Build and Test
    runs-on: [self-hosted]
    permissions:
      contents: read
      packages: write

    # ─────────────────────────────────────────────────────────────
    # Run automatically for internal PRs (same repo).
    # For external PRs (forks) require the "ok‑to‑test" label.
    # Never run when the PR carries the "release" label.
    # ─────────────────────────────────────────────────────────────
    if: |
      !contains(github.event.pull_request.labels.*.name, 'release') &&
      (
        github.event.pull_request.head.repo.full_name == github.repository ||
        (
          github.event.pull_request.head.repo.full_name != github.repository &&
          contains(github.event.pull_request.labels.*.name, 'ok-to-test')
        )
      )

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io

      - name: Build
        run: make build

      - name: Test
        run: make test