add-ci-passed-label.yml

# This workflow removes a stale 'ci-passed' label whenever a PR is updated
# or its eligibility labels change, then adds it back only after the
# 'CI Check' workflow both completes successfully and records that it
# actually ran the CI polling gate for the current eligible PR head.
name: Add CI Passed Label

on:
  pull_request_target:
    types:
      - synchronize
      - reopened
      - labeled
      - unlabeled
  workflow_run:
    workflows: ["CI Check"]
    types:
      - completed

permissions:
  actions: read
  pull-requests: write
  issues: write


jobs:
  fetch_data:
    name: Fetch PR eligibility
    runs-on: ubuntu-latest
    outputs:
      pr_number: ${{ steps.ci_result.outputs.pr_number }}
      eligible: ${{ steps.ci_result.outputs.eligible }}
      should_add_label: ${{ steps.ci_result.outputs.should_add_label }}
    steps:
      - name: Download CI check result
        id: download_result
        uses: actions/github-script@v8
        with:
          script: |
            core.setOutput("artifact_found", "false");

            if (context.eventName !== "workflow_run") {
              core.info(`No ci-passed eligibility lookup needed for ${context.eventName}.`);
              return;
            }

            if (context.payload.workflow_run.conclusion !== "success") {
              core.info(
                `CI Check concluded with ${context.payload.workflow_run.conclusion}; not adding ci-passed.`
              );
              return;
            }

            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: context.payload.workflow_run.id,
            });
            const resultArtifact = artifacts.data.artifacts.find((artifact) => {
              return artifact.name === "ci-check-result";
            });

            if (!resultArtifact) {
              core.warning(
                `Required artifact "ci-check-result" was not found for workflow run ID ${context.payload.workflow_run.id}; skipping ci-passed update.`
              );
              return;
            }

            const download = await github.rest.actions.downloadArtifact({
              owner: context.repo.owner,
              repo: context.repo.repo,
              artifact_id: resultArtifact.id,
              archive_format: "zip",
            });

            const fs = require("fs");
            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/ci-check-result.zip`, Buffer.from(download.data));
            core.setOutput("artifact_found", "true");

      - name: Unzip CI check result
        if: steps.download_result.outputs.artifact_found == 'true'
        shell: bash
        run: unzip -o ci-check-result.zip -d ci-check-result

      - name: Parse CI check result and confirm current PR state
        id: ci_result
        if: steps.download_result.outputs.artifact_found == 'true'
        uses: actions/github-script@v8
        with:
          script: |
            core.setOutput("pr_number", "");
            core.setOutput("eligible", "false");
            core.setOutput("should_add_label", "false");

            const fs = require("fs");
            const result = JSON.parse(
              fs.readFileSync(`${process.env.GITHUB_WORKSPACE}/ci-check-result/result.json`, "utf8")
            );

            core.info(`Loaded CI check result: ${JSON.stringify(result)}`);

            if (result.should_add_label !== true) {
              core.info("Triggering CI Check run did not actually complete polling successfully.");
              return;
            }

            const recordedPRNumber = Number(result.pr_number);
            const recordedHeadSha = result.head_sha;
            if (!recordedPRNumber || !recordedHeadSha) {
              throw new Error(`Invalid ci-check-result payload: ${JSON.stringify(result)}`);
            }

            if (context.payload.workflow_run.head_sha !== recordedHeadSha) {
              core.info(
                `Ignoring mismatched artifact SHA ${recordedHeadSha}; workflow_run reported ${context.payload.workflow_run.head_sha}.`
              );
              return;
            }

            const { data: pullRequest } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: recordedPRNumber,
            });

            if (pullRequest.state !== "open") {
              core.info(`PR #${pullRequest.number} is ${pullRequest.state}; not adding ci-passed.`);
              return;
            }

            if (pullRequest.head.sha !== recordedHeadSha) {
              core.info(
                `PR #${pullRequest.number} head moved from ${recordedHeadSha} to ${pullRequest.head.sha}; not adding ci-passed.`
              );
              return;
            }

            const labels = new Set(pullRequest.labels.map((label) => label.name));
            const eligible = labels.has("ok-to-test") && !labels.has("needs-ok-to-test");

            core.info(`PR #${pullRequest.number} labels: ${Array.from(labels).join(", ")}`);
            core.setOutput("pr_number", String(pullRequest.number));
            core.setOutput("eligible", eligible ? "true" : "false");
            core.setOutput(
              "should_add_label",
              eligible && result.should_add_label === true ? "true" : "false"
            );

  reset_ci_passed_label:
    name: Reset stale 'ci-passed' label
    runs-on: ubuntu-latest
    steps:
      - name: Remove existing 'ci-passed' label
        shell: bash
        run: |
          should_reset=false

          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
            if [[ "${{ github.event.action }}" == "synchronize" || "${{ github.event.action }}" == "reopened" ]]; then
              should_reset=true
            elif [[ "${{ github.event.action }}" == "labeled" && "${{ github.event.label.name }}" == "needs-ok-to-test" ]]; then
              should_reset=true
            elif [[ "${{ github.event.action }}" == "unlabeled" && "${{ github.event.label.name }}" == "ok-to-test" ]]; then
              should_reset=true
            fi
          fi

          if [[ "${should_reset}" != "true" ]]; then
            echo "No stale ci-passed reset needed for ${GITHUB_EVENT_NAME} ${GITHUB_EVENT_ACTION:-}."
            exit 0
          fi

          pr_number=${{ github.event.pull_request.number }}
          echo "Checking for stale 'ci-passed' label on PR #${pr_number} after ${{ github.event.action }}"
          labels=$(gh pr view "${pr_number}" --repo "$GITHUB_REPOSITORY" --json labels --jq '.labels[].name')

          if echo "${labels}" | grep -qx 'ci-passed'; then
            echo "Removing stale 'ci-passed' label from PR #${pr_number}"
            gh pr edit "${pr_number}" --remove-label "ci-passed" --repo "$GITHUB_REPOSITORY"
          else
            echo "Label 'ci-passed' not present on PR #${pr_number}; nothing to remove."
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  add_ci_passed_label:
    name: Add 'ci-passed' label
    runs-on: ubuntu-latest
    needs: fetch_data
    steps:
      - name: Add 'ci-passed' label
        shell: bash
        run: |
          if [[ "${{ needs.fetch_data.outputs.should_add_label }}" != "true" ]]; then
            echo "No ci-passed label update needed for this event."
            exit 0
          fi

          echo "Adding 'ci-passed' label to PR #${{ needs.fetch_data.outputs.pr_number }}"
          gh pr edit ${{ needs.fetch_data.outputs.pr_number }} --add-label "ci-passed" --repo "$GITHUB_REPOSITORY"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}