name: Issue lifecycle

on:
  issues:
    types:
      - opened
      - edited
      - assigned
      - unassigned
      - labeled
      - unlabeled
      - closed
      - reopened
      - field_added
      - field_removed
  pull_request:
    types:
      - opened
      - edited
      - synchronize
      - reopened
      - labeled
      - unlabeled
      - review_requested
  pull_request_review:
    types:
      - submitted

permissions:
  contents: read

concurrency:
  group: issue-lifecycle-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }}
  cancel-in-progress: false

jobs:
  lifecycle:
    name: Issue lifecycle
    # Runs on every pull_request_review event so the check reports success rather
    # than a gray "skipped" segment. The token-creating and board-mutating steps
    # are gated at step level (a skipped step does not gray the job): only a
    # changes_requested review drives the Project board; approved/commented
    # reviews never mint a write-capable App token.
    runs-on: ubuntu-latest
    steps:
      - name: Check out trusted policy
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Create project token
        id: app-token
        if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'changes_requested' }}
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ vars.DSH_ISSUE_APP_CLIENT_ID }}
          private-key: ${{ secrets.DSH_ISSUE_APP_PRIVATE_KEY }}
          owner: deepseek-harness
          repositories: deepseek-harness
      - name: Handle repository event
        if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'changes_requested' }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: node .github/issue-management/policy.mjs lifecycle