name: Supply Chain Review - PR Instructions

on:
  pull_request:
    types: [opened, reopened, synchronize]
    paths:
      - "package.json"
      - "pnpm-lock.yaml"
      - "**/package.json"
      - "pom.xml"
      - "**/pom.xml"

jobs:
  instructions:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: Alfresco/alfresco-build-tools/.github/actions/github-upsert-comment@da99ab845e78301fcb0680d16cbc185a40a1938c # v18.24.1
        with:
          comment-identifier: supply-chain-review-instructions
          comment-body: |
            ## 🔒 Supply Chain Security

            This PR modifies dependencies. To run a security analysis, comment:

            ```
            /supply-chain-review
            ```

            The analysis will check for vulnerabilities, typosquatting, maintainer takeovers, and other supply chain risks.