Files

64 lines
2.2 KiB
YAML

name: Close Solved
on:
push:
branches: [main]
paths: ["work/**"]
workflow_dispatch:
inputs:
dry_run:
description: Report matches without closing anything
type: boolean
default: false
permissions:
contents: read
issues: write
concurrency:
group: close-solved
cancel-in-progress: false
jobs:
close:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: oven-sh/setup-bun@v2
# No install step: the script only uses Bun builtins + fetch.
#
# SRS_ADMIN_KEY lets the script report the solved set to the Worker
# (POST /admin/solved). Closing an issue is invisible to D1 — the
# catalog reconcile never reads issue state, and only logAttempt() moves
# the ladder — so without this a pushed solution would never reach the
# charts, the digest's solved ticks, or the drill/gate pools.
- run: bun apps/cli/close-solved.ts
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DRY_RUN: ${{ inputs.dry_run }}
SRS_ADMIN_KEY: ${{ secrets.SRS_ADMIN_KEY }}
# Project fields are a projection of the issue labels, so the same push
# that adds a solution (and any issue filed since the last run) can leave
# the board's Set/Difficulty empty. Reconciling here keeps the one
# "solution landed" entry point responsible for the whole fan-out; the
# script is idempotent, so a run with nothing to do writes nothing.
#
# Needs the `project` scope, which GITHUB_TOKEN does not have — hence
# PROJECT_PAT. Unset = skip, matching SRS_ADMIN_KEY above. Best-effort by
# design: D1 and the issues are the truth, so a Project failure must not
# fail a run that already closed issues and logged the solve.
- name: Reconcile Project Set/Difficulty
continue-on-error: true
env:
GH_TOKEN: ${{ secrets.PROJECT_PAT }}
DRY_RUN: ${{ inputs.dry_run }}
run: |
if [ -z "$GH_TOKEN" ]; then
echo "PROJECT_PAT unset — skipping the Project field reconcile"
exit 0
fi
bun apps/cli/sync-project-fields.ts