name: PR Sheriff

on:
  issues:
    types: [opened, reopened]
  schedule:
    # Daily UTC afternoon pass. The script uses an aggressive 7/14 day window:
    # warn contributor-blocked PRs after 7 days open, close after 14.
    - cron: "17 15 * * *"
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Print planned changes without mutating GitHub"
        type: boolean
        default: false

permissions:
  actions: read
  checks: read
  contents: read
  issues: write
  pull-requests: write

concurrency:
  group: pr-sheriff
  cancel-in-progress: false

jobs:
  issue-inbox:
    if: github.event_name == 'issues'
    runs-on: ubuntu-latest
    steps:
      - name: Mark issue for triage
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
        run: |
          gh label create "needs triage" \
            --repo "$GH_REPO" \
            --color "d4c5f9" \
            --description "New or reopened issue awaiting maintainer triage" \
            --force
          gh issue edit "$ISSUE_NUMBER" --repo "$GH_REPO" --add-label "needs triage"

  sheriff:
    if: github.event_name != 'issues'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24

      - name: Run sheriff
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mode="--apply"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.dry_run }}" = "true" ]; then
            mode="--dry-run"
          fi

          node scripts/github/sheriff.mjs "$mode" \
            --repo "$GITHUB_REPOSITORY" \
            --warning-days 7 \
            --close-days 14 \
            --maintainers "pbakaus" \
            --regular-contributors "pbakaus,abdulwahabone" \
            --auto-close-regulars