OnLabelApproved.yml

name: Re-run all checks for PR

on:
  pull_request_target:
    types: [labeled]
  workflow_dispatch:
    inputs:
      pr:
        description: "PR number to re-run (manual)"
        required: true
        type: number
      dry_run:
        description: "Only list; do not approve/rerun"
        required: false
        default: "true"
        type: choice
        options: ["true", "false"]

permissions:
  actions: write
  contents: read
  pull-requests: read

env:
  ORG: 'zul8ha'
  REPO: 'zul8ha/demo-repository'   # апстрим-репо, где бегают ранки
  GH_TOKEN: ${{ secrets.GH_TOKEN }}
  GITHUB_TOKEN: ${{ secrets.READ_ORG_TOKEN }}

jobs:
  run:
    # для label-трига — только если лейбл тот, что нам нужен
    if: github.event_name != 'pull_request_target' || github.event.label.name == 'approved'
    runs-on: ubuntu-latest
    steps:
      - name: Resolve PR number and dry-run flag
        id: in
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            pr="${{ github.event.inputs.pr }}"
            dry="${{ github.event.inputs.dry_run }}"
          else
            pr="${{ github.event.pull_request.number }}"
            dry="false"  # при label-триггере по умолчанию исполняем
          fi
          echo "pr=$pr"   >> "$GITHUB_OUTPUT"
          echo "dry=$dry" >> "$GITHUB_OUTPUT"

      - name: (Optional) Check actor is org member (for label trigger)
        if: github.event_name == 'pull_request_target'
        run: |
          set -euo pipefail
          resp=$(curl -sS \
            -H "Authorization: Bearer $GH_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/orgs/${{ env.ORG }}/memberships/${{ github.actor }})
          state=$(jq -r '.state // empty' <<< "$resp")
          if [ "$state" != "active" ]; then
            echo "Not an org member (or token lacks read:org)"; exit 1
          fi

      - name: Fetch PR head info
        id: pr
        run: |
          set -euo pipefail
          pr="${{ steps.in.outputs.pr }}"
          pr_json=$(gh api -H "X-GitHub-Api-Version: 2022-11-28" "/repos/${{ env.REPO }}/pulls/$pr")
          head_sha=$(jq -r '.head.sha' <<<"$pr_json")
          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
          echo "PR #$pr head_sha=$head_sha"

      - name: List workflow runs for this PR@head_sha
        id: runs
        run: |
          set -euo pipefail
          pr="${{ steps.in.outputs.pr }}"
          head_sha="${{ steps.pr.outputs.head_sha }}"

          # Сольём все ранки события pull_request, пагинация включена
          gh api -H "X-GitHub-Api-Version: 2022-11-28" \
            "/repos/${{ env.REPO }}/actions/runs?event=pull_request&per_page=100" --paginate \
          | jq -r --argjson pr "$pr" --arg sha "$head_sha" '
              .workflow_runs[]
              | select( any(.pull_requests[]?; .number == $pr) )
              | select(.head_sha == $sha)  # важный фильтр: только текущий коммит PR
              | [.id, .name, .status, .conclusion, .html_url] | @tsv
            ' | tee runs.tsv

          count=$(wc -l < runs.tsv | tr -d ' ')
          echo "found=$count" >> "$GITHUB_OUTPUT"
          echo "Найдено ранков: $count"
          echo ""
          echo "Список:"
          cat runs.tsv || true

      - name: Approve waiting (needs approval) runs from fork
        if: steps.runs.outputs.found != '0' && steps.in.outputs.dry == 'false'
        run: |
          set -euo pipefail
          while IFS=$'\t' read -r RUN_ID NAME STATUS CONCLUSION URL; do
            [ -z "${RUN_ID:-}" ] && continue
            echo "Approve try: $RUN_ID ($NAME) $URL"
            gh api -X POST -H "X-GitHub-Api-Version: 2022-11-28" \
              "/repos/${{ env.REPO }}/actions/runs/$RUN_ID/approve" \
            || echo "  Not awaiting approval (ok)"
          done < runs.tsv

      - name: Re-run all COMPLETED runs
        if: steps.runs.outputs.found != '0' && steps.in.outputs.dry == 'false'
        run: |
          set -euo pipefail
          while IFS=$'\t' read -r RUN_ID NAME STATUS CONCLUSION URL; do
            [ -z "${RUN_ID:-}" ] && continue
            if [ "$STATUS" = "completed" ]; then
              echo "Re-run: $RUN_ID ($NAME) [$CONCLUSION] $URL"
              gh api -X POST -H "X-GitHub-Api-Version: 2022-11-28" \
                "/repos/${{ env.REPO }}/actions/runs/$RUN_ID/rerun" \
              || echo "  Cannot rerun (unexpected) — skip"
            else
              echo "Skip (status=$STATUS): $RUN_ID $URL"
            fi
          done < runs.tsv

      - name: Summary
        run: |
          echo "Done. Dry-run=${{ steps.in.outputs.dry }}. Processed ${{ steps.runs.outputs.found }} runs."