chore: close PR after denouncing

.github/workflows/issue-command.yml

@@ -44,14 +44,15 @@ jobs:
         permissions:
             contents: write
             issues: write
-            pull-requests: read
+            pull-requests: write
         concurrency:
             group: vouch-manage
             cancel-in-progress: false
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-            - uses: mitchellh/vouch/action/manage-by-issue@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
+            - id: vouch
+              uses: mitchellh/vouch/action/manage-by-issue@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
               with:
                   issue-id: ${{ github.event.issue.number }}
                   comment-id: ${{ github.event.comment.id }}
@@ -59,6 +60,25 @@ jobs:
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+            - name: Close PR if denounced
+              if: ${{ github.event.issue.pull_request && steps.vouch.outputs.status == 'denounced' }}
+              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+              with:
+                  script: |
+                      const prNumber = context.payload.issue.number;
+                      await github.rest.issues.createComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: prNumber,
+                          body: 'This pull request has been automatically closed.',
+                      });
+                      await github.rest.pulls.update({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          pull_number: prNumber,
+                          state: 'closed',
+                      });
+
     test-on-demand:
         name: Test route on demand
         if: startsWith(github.event.comment.body, '/test')