name: Rebase open PRs

on:
  push:
    branches: [main]
  schedule:
    - cron: "7 */4 * * *"
  workflow_dispatch:

# Serialize branch updates with Codex's complete read/verify/apply cycle.
concurrency:
  group: pr-babysitter
  cancel-in-progress: false
  queue: max

permissions:
  contents: read
  pull-requests: read

jobs:
  rebase:
    if: vars.PR_READINESS_ENABLED != 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          ref: main
          persist-credentials: false

      - name: Rebase eligible PRs with GitHub's guarded API
        env:
          GH_TOKEN: ${{ secrets.PR_MAITENANCE_TOKEN }}
        run: |
          if [ -z "$GH_TOKEN" ]; then
            echo "Set PR_MAITENANCE_TOKEN with Contents and Pull requests read/write access."
            exit 1
          fi
          node scripts/pr-maintenance/run.mjs rebase