name: Auto-label Issues

on:
  issues:
    types: [opened, edited]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.issue.number }}
  cancel-in-progress: true

jobs:
  auto-label:
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - name: Auto-label based on title and body
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
        with:
          script: |
            const issue = context.payload.issue;
            const title = issue.title.toLowerCase();
            const body = issue.body ? issue.body.toLowerCase() : '';
            const labels = [];

            // Priority detection
            if (title.includes('[critical]') || body.includes('priority: critical')) {
              labels.push('critical');
            } else if (title.includes('[high]') || body.includes('priority: high')) {
              labels.push('high');
            } else if (title.includes('[medium]') || body.includes('priority: medium')) {
              labels.push('medium');
            } else if (title.includes('[low]') || body.includes('priority: low')) {
              labels.push('low');
            }

            // Milestone detection
            if (title.includes('[alpha]') || body.includes('milestone: alpha')) {
              labels.push('alpha');
            } else if (title.includes('[beta]') || body.includes('milestone: beta')) {
              labels.push('beta');
            } else if (title.includes('[post-beta]') || body.includes('milestone: post-beta')) {
              labels.push('post-beta');
            }

            // Category detection
            if (title.includes('architecture') || body.includes('architecture')) labels.push('architecture');
            if (title.includes('backend') || body.includes('backend')) labels.push('backend');
            if (title.includes('frontend') || body.includes('frontend')) labels.push('frontend');
            if (title.includes('security') || body.includes('security')) labels.push('security');
            if (title.includes('ssl') || title.includes('tls') || body.includes('certificate')) labels.push('ssl');
            if (title.includes('sso') || body.includes('single sign-on')) labels.push('sso');
            if (title.includes('waf') || body.includes('web application firewall')) labels.push('waf');
            if (title.includes('crowdsec') || body.includes('crowdsec')) labels.push('crowdsec');
            if (title.includes('caddy') || body.includes('caddy')) labels.push('caddy');
            if (title.includes('database') || body.includes('database')) labels.push('database');
            if (title.includes('ui') || title.includes('interface')) labels.push('ui');
            if (title.includes('docker') || title.includes('deployment')) labels.push('deployment');
            if (title.includes('monitoring') || title.includes('logging')) labels.push('monitoring');
            if (title.includes('documentation') || title.includes('docs')) labels.push('documentation');
            if (title.includes('test') || body.includes('testing')) labels.push('testing');
            if (title.includes('performance') || body.includes('optimization')) labels.push('performance');
            if (title.includes('plus') || body.includes('premium feature')) labels.push('plus');

            // Feature detection
            if (title.includes('feature') || body.includes('feature request')) labels.push('feature');

            // Only add labels if we detected any
            if (labels.length > 0) {
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issue.number,
                labels: labels
              });

              console.log(`Added labels: ${labels.join(', ')}`);
            }