From 89c664dc05e9b0c448aad38c904f88fd18cf8069 Mon Sep 17 00:00:00 2001
From: Timur Olzhabayev <timur.olzhabayev@grafana.com>
Date: Wed, 23 Jul 2025 11:41:05 +0200
Subject: [PATCH] Chore/label internal issues 2 (#108479)

* add PR author

* see if this way of getting org members is correct

* switch to env

* add check for repository

* cleanup logic a bit
---
 .github/workflows/issue-opened.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/issue-opened.yml b/.github/workflows/issue-opened.yml
index 76ebd06fe8b..3dc7cbad7f8 100644
--- a/.github/workflows/issue-opened.yml
+++ b/.github/workflows/issue-opened.yml
@@ -119,12 +119,34 @@ jobs:
           SLACK_WEBHOOK_URL:  ${{ env.AUTOTRIAGER_SLACK_WEBHOOK_URL }}
   auto-label-internal-issues:
     needs: [main]
+    if: github.repository == 'grafana/grafana'
     runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:
+        - name: "Get vault secrets"
+          id: vault-secrets
+          uses: grafana/shared-workflows/actions/get-vault-secrets@main # zizmor: ignore[unpinned-uses]
+          with:
+            # Secrets placed in the ci/repo/grafana/grafana/plugins_platform_issue_triager path in Vault
+            repo_secrets: |
+              GITHUB_APP_ID=plugins_platform_issue_triager_github_bot:app_id
+              GITHUB_APP_PRIVATE_KEY=plugins_platform_issue_triager_github_bot:app_pem  
+        - name: Generate token
+          id: generate_token
+          uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
+          with:
+            app-id: ${{ env.GITHUB_APP_ID }}
+            private-key: ${{ env.GITHUB_APP_PRIVATE_KEY }}
+            permission-members: read
+        - name: Check if member of grafana org
+          id: check-if-grafana-org-member
+          run: gh api https://api.github.com/orgs/grafana/members/${{ env.ACTOR }} >/dev/null 2>&1 && echo "is_grafana_org_member=true" >> "$GITHUB_OUTPUT"
+          env:
+              GH_TOKEN: ${{ steps.generate_token.outputs.token }}
+              ACTOR: ${{ github.actor }}
         - name: "Auto label internal issues"
-          if: github.repository == 'grafana/grafana' && (github.event.issue.author_association == 'MEMBER' || github.event.issue.author_association == 'OWNER')
+          if:  steps.check-if-grafana-org-member.outputs.is_grafana_org_member == 'true' || github.event.issue.author_association == 'MEMBER' || github.event.issue.author_association == 'OWNER'
           run: gh issue edit "$NUMBER" --add-label "$LABELS"
           env:
             GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}