add-ci-passed-label.yml

# This workflow removes a stale 'ci-passed' label whenever a PR is updated
# or its eligibility labels change, then adds it back only after the
# 'CI Check' workflow completes successfully for a label-eligible PR.
name: Add CI Passed Label

on:
  pull_request_target:
    types:
      - synchronize
      - reopened
      - labeled
      - unlabeled
  workflow_run:
    workflows: ["CI Check"]
    types:
      - completed

permissions:
  pull-requests: write
  issues: write

jobs:
  gatekeeper:
    uses: ./.github/workflows/wait-for-gatekeeper.yml

  fetch_data:
    name: Fetch PR eligibility
    needs: gatekeeper
    runs-on: ubuntu-latest
    outputs:
      pr_number: ${{ steps.pr.outputs.pr_number }}
      eligible: ${{ steps.pr.outputs.eligible }}
      should_add_label: ${{ steps.pr.outputs.should_add_label }}
    steps:
      - name: Check PR label eligibility
        id: pr
        uses: actions/github-script@v8
        with:
          script: |
            core.setOutput("eligible", "false");
            core.setOutput("should_add_label", "false");

            if (context.eventName !== "workflow_run") {
              core.info(`No ci-passed eligibility lookup needed for ${context.eventName}.`);
              return;
            }

            if (context.payload.workflow_run.conclusion !== "success") {
              core.info(
                `CI Check concluded with ${context.payload.workflow_run.conclusion}; not adding ci-passed.`
              );
              return;
            }

            const workflowEvent = context.payload.workflow_run.event;
            if (workflowEvent !== "pull_request" && workflowEvent !== "pull_request_target") {
              core.info(`Skipping workflow_run event ${workflowEvent}`);
              return;
            }

            const headRepositoryOwner = context.payload.workflow_run.head_repository?.owner?.login;
            const headBranch = context.payload.workflow_run.head_branch;
            const runHeadSha = context.payload.workflow_run.head_sha;
            if (!headRepositoryOwner || !headBranch || !runHeadSha) {
              core.info("workflow_run is missing head repository, branch, or SHA metadata.");
              return;
            }

            const { data: pullRequests } = await github.rest.pulls.list({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: "open",
              head: `${headRepositoryOwner}:${headBranch}`,
            });

            const pullRequest = pullRequests.find((candidate) => candidate.head.sha === runHeadSha);
            if (!pullRequest) {
              core.info(
                `No open pull request matched ${headRepositoryOwner}:${headBranch} at ${runHeadSha}.`
              );
              return;
            }

            const labels = new Set(pullRequest.labels.map((label) => label.name));
            const eligible = labels.has("ok-to-test") && !labels.has("needs-ok-to-test");

            core.info(`PR #${pullRequest.number} labels: ${Array.from(labels).join(", ")}`);
            core.setOutput("pr_number", String(pullRequest.number));
            core.setOutput("eligible", eligible ? "true" : "false");
            core.setOutput("should_add_label", eligible ? "true" : "false");

  reset_ci_passed_label:
    name: Reset stale 'ci-passed' label
    needs: gatekeeper
    runs-on: ubuntu-latest
    steps:
      - name: Remove existing 'ci-passed' label
        shell: bash
        run: |
          should_reset=false

          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
            if [[ "${{ github.event.action }}" == "synchronize" || "${{ github.event.action }}" == "reopened" ]]; then
              should_reset=true
            elif [[ "${{ github.event.action }}" == "labeled" && "${{ github.event.label.name }}" == "needs-ok-to-test" ]]; then
              should_reset=true
            elif [[ "${{ github.event.action }}" == "unlabeled" && "${{ github.event.label.name }}" == "ok-to-test" ]]; then
              should_reset=true
            fi
          fi

          if [[ "${should_reset}" != "true" ]]; then
            echo "No stale ci-passed reset needed for ${GITHUB_EVENT_NAME} ${GITHUB_EVENT_ACTION:-}."
            exit 0
          fi

          pr_number=${{ github.event.pull_request.number }}
          echo "Checking for stale 'ci-passed' label on PR #${pr_number} after ${{ github.event.action }}"
          labels=$(gh pr view "${pr_number}" --repo "$GITHUB_REPOSITORY" --json labels --jq '.labels[].name')

          if echo "${labels}" | grep -qx 'ci-passed'; then
            echo "Removing stale 'ci-passed' label from PR #${pr_number}"
            gh pr edit "${pr_number}" --remove-label "ci-passed" --repo "$GITHUB_REPOSITORY"
          else
            echo "Label 'ci-passed' not present on PR #${pr_number}; nothing to remove."
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  add_ci_passed_label:
    name: Add 'ci-passed' label
    runs-on: ubuntu-latest
    needs: [fetch_data,gatekeeper]
    steps:
      - name: Add 'ci-passed' label
        shell: bash
        run: |
          if [[ "${{ needs.fetch_data.outputs.should_add_label }}" != "true" ]]; then
            echo "No ci-passed label update needed for this event."
            exit 0
          fi

          echo "Adding 'ci-passed' label to PR #${{ needs.fetch_data.outputs.pr_number }}"
          gh pr edit ${{ needs.fetch_data.outputs.pr_number }} --add-label "ci-passed" --repo "$GITHUB_REPOSITORY"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}