Replace broken actions/first-interaction with an inline github-script

[tpvasconcelos]

Description

actions/first-interaction@v3 posts the "first pull request" greeting on every PR from any author who has never opened an issue in this repo — which in practice means every PR from pre-commit.ci, dependabot, and Copilot (#350, #355, #358, #362, #366, #374, #379, #380–#383, #395, ...). The v3 rewrite introduced two regressions: it ORs the first-issue/first-PR checks together instead of branching on the event type, and its first-PR check lost the per-author filter entirely. The bug also affects humans: any contributor who never filed an issue here would be re-greeted on every new PR. Upstream has been broken since Oct 2025 with no fix in sight.

This PR replaces the action with a local reusable composite action, .github/actions/greet-new-users, built on actions/github-script@v9 (already a dependency of other workflows here) with the core logic in a standalone, directly-testable main.js module. It restores the correct v1 semantics and hardens the workflow:

• Never greet bots (user.type == "Bot": pre-commit.ci, dependabot, github-actions, Copilot, ...)
• Skip OWNER/MEMBER/COLLABORATOR authors cheaply (shortcut only — a missing/unreliable author_association falls through to the real check, so it can never cause a wrong greeting)
• Real detection matches v1: first issue = no earlier issues by the same creator; first PR = no earlier PRs by the same author (early-exit pagination)
• Keys off the resource author rather than the event sender (deterministic for agent-created PRs)
• Explicit least-privilege permissions: block (contents: read + issues: write + pull-requests: write) instead of the repo-default write-all token
• Fail-soft: API errors log a warning instead of putting a red ❌ on a newcomer's first PR
• Security invariants documented in-file: the pull_request_target workflow only ever checks out the base ref (required to load the local action; PR authors cannot alter the code this privileged workflow runs), and no untrusted fields are ${{ }}-interpolated into script source (messages flow through env, payload fields are read via context.payload)

The action is reusable by design — issue_message/pr_message/token inputs, a greeted output, only acts on opened events (no duplicate greetings if a consumer also triggers on edited), and skips unsupported events gracefully — so other repos can consume it via uses: tpvasconcelos/ridgeplot/.github/actions/greet-new-users@main, and open-sourcing it later is just a matter of moving the directory to a standalone repository.

Validation performed:

• All pre-commit hooks pass (incl. check-yaml, GitHub Actions/workflow schema validation, actionlint, and the timeout-minutes hook)
• main.js was behavior-tested under Node against mocked core/context/github objects replaying real scenarios: pre-commit-ci's [pre-commit.ci] pre-commit autoupdate #395, owner PRs, a repeat external contributor, a genuine first PR/issue, a second issue from the same reporter, a first issue from a previous PR author, an API failure, an edited event, an unsupported event, and an empty message — 11/11 pass
• Decision logic cross-checked against live API data for every author category this repo has seen

Note: issues and pull_request_target workflows run the default-branch version, so this only takes effect after merging. The next pre-commit.ci autoupdate is the natural negative test; the next external contributor is the positive one.

Related issues

Upstream: actions/first-interaction#369 (broken first-contribution detection), actions/first-interaction#394 (request to ignore bots). Latest upstream release is still v3.1.0 (Oct 2025); both issues remain open.

PR check list

• Read the contributing guidelines.
• Provided the relevant details in the PR's description.
• Referenced relevant issues in the PR's description.
• Added tests for all my changes. (No Python code changed; main.js was behavior-tested under Node with mocked payloads — see description.)
• Updated the docs for relevant changes. (N/A — workflow/action-only change; no modules or public API touched.)
• Changes are documented in docs/reference/changelog.md.
• Consider granting push permissions to your PR's branch. (Branch lives in this repo.)
• The CI check are all passing, or I'm working on fixing them!
• I have reviewed my own code! 🤠

---

📚 Documentation preview 📚: https://ridgeplot--398.org.readthedocs.build/en/398/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4b7cf77) to head (d49b150).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #398   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           19        19           
  Lines          674       674           
  Branches        88        88           
=========================================
  Hits           674       674           

Flag	Coverage Δ
combined-src	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.