name: PR readiness coordinator

on:
  schedule:
    - cron: "0 * * * *"
  push:
    branches: [main]
  pull_request_target:
    types: [opened, synchronize, reopened, labeled, unlabeled, edited, ready_for_review]
  # Workers dispatched with GITHUB_TOKEN do not emit this completion event.
  # PR head updates, CI completion, and the hourly sweep reconcile their results.
  workflow_run:
    workflows: [ci, PR readiness worker]
    types: [completed]
  workflow_dispatch:
    inputs:
      pr:
        description: Retry one selected PR (repository writers only)
        required: false
        type: string

concurrency:
  group: pr-readiness-coordinator
  cancel-in-progress: false
  queue: max

permissions:
  contents: write
  actions: write
  issues: write
  pull-requests: write

jobs:
  reconcile:
    # workflow_run.pull_requests is empty on some same-repository PR CI runs, so
    # pilot CI wakeups use the exact head refs recorded with the selected PRs.
    if: >-
      vars.PR_READINESS_ENABLED == 'true' &&
      vars.PR_READINESS_PRS != '' &&
      (
        github.event_name == 'schedule' ||
        github.event_name == 'push' ||
        (
          github.event_name == 'workflow_dispatch' &&
          (
            !github.event.inputs.pr ||
            vars.PR_READINESS_PRS == 'all' ||
            (
              vars.PR_READINESS_PRS != '' &&
              contains(format(',{0},', vars.PR_READINESS_PRS), format(',{0},', github.event.inputs.pr))
            )
          )
        ) ||
        (
          github.event_name == 'pull_request_target' &&
          github.event.pull_request.head.repo.full_name == github.repository &&
          (
            vars.PR_READINESS_PRS == 'all' ||
            (
              vars.PR_READINESS_PRS != '' &&
              contains(format(',{0},', vars.PR_READINESS_PRS), format(',{0},', github.event.pull_request.number))
            )
          )
        ) ||
        (
          github.event_name == 'workflow_run' &&
          github.event.workflow_run.path == '.github/workflows/ci.yml' &&
          (
            github.event.workflow_run.event == 'pull_request' ||
            github.event.workflow_run.event == 'workflow_dispatch'
          ) &&
          github.event.workflow_run.head_repository.full_name == github.repository &&
          (
            vars.PR_READINESS_PRS == 'all' ||
            (
              vars.PR_READINESS_HEAD_REFS != '' &&
              github.event.workflow_run.head_branch != '' &&
              contains(format(',{0},', vars.PR_READINESS_HEAD_REFS), format(',{0},', github.event.workflow_run.head_branch))
            )
          )
        ) ||
        (
          github.event_name == 'workflow_run' &&
          github.event.workflow_run.path == '.github/workflows/pr-readiness-worker.lock.yml' &&
          github.event.workflow_run.event == 'workflow_dispatch' &&
          github.event.workflow_run.head_repository.full_name == github.repository
        )
      )
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      # This privileged job executes only trusted main, never a PR checkout.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: main
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
      - name: Reconcile current heads and reserved attempts
        run: node scripts/pr-maintenance/coordinator-run.mjs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_MAINTENANCE_STATE_KEY: ${{ secrets.PR_MAINTENANCE_STATE_KEY }}
          PR_READINESS_ENABLED: ${{ vars.PR_READINESS_ENABLED }}
          PR_READINESS_PRS: ${{ vars.PR_READINESS_PRS }}