name: Supply Chain Review - PR Instructions

on:
  pull_request:
    types: [opened, reopened, synchronize]
    paths:
      - "package.json"
      - "pnpm-lock.yaml"
      - "**/package.json"
      - "pom.xml"
      - "**/pom.xml"

jobs:
  instructions:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: Alfresco/alfresco-build-tools/.github/actions/github-upsert-comment@10cea6c0b390c4f8af21d9dc1670d581bd10319f # v18.13.0
        with:
          comment-identifier: supply-chain-review-instructions
          comment-body: |
            ## 🔒 Supply Chain Security

            This PR modifies dependencies. To run a security analysis, comment:

            ```
            /supply-chain-review
            ```

            The analysis will check for vulnerabilities, typosquatting, maintainer takeovers, and other supply chain risks.