name: Close Solved

on:
  push:
    branches: [main]
    paths: ["work/**"]
  workflow_dispatch:
    inputs:
      dry_run:
        description: Report matches without closing anything
        type: boolean
        default: false

permissions:
  contents: read
  issues: write

concurrency:
  group: close-solved
  cancel-in-progress: false

jobs:
  close:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2

      # No install step: the script only uses Bun builtins + fetch.
      #
      # SRS_ADMIN_KEY lets the script report the solved set to the Worker
      # (POST /admin/solved). Closing an issue is invisible to D1 — the
      # catalog reconcile never reads issue state, and only logAttempt() moves
      # the ladder — so without this a pushed solution would never reach the
      # charts, the digest's solved ticks, or the drill/gate pools.
      - run: bun apps/cli/close-solved.ts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DRY_RUN: ${{ inputs.dry_run }}
          SRS_ADMIN_KEY: ${{ secrets.SRS_ADMIN_KEY }}