tenant.openagents/omega

1# Sync triage state into "Zed weekly triage" (project #84).
2#
3# Runs in two modes:
4#   1. Event-driven (primary): fires on issue events + new issue comments.
5#      Re-derives Status / Stale since / Aged? / Intake week for that one
6#      issue. Latency: ~10–30 seconds end-to-end.
7#   2. Daily cron (safety net): re-derives across all project items at 06:00
8#      UTC. Catches any events that GH dropped under load.
9#
10# Auth: GitHub App `ZED_COMMUNITY_BOT_APP_ID` with
11# `Organization Projects: Read and write` permission added. Token is
12# requested with `owner: zed-industries` so it can mutate org-level project
13# items (the default repo-scoped token is insufficient for org projects).
14#
15# This workflow only mutates the triage project (#84). It does not write
16# labels, comments, or any issue metadata. Adding any other write capability
17# requires a separate workflow.
18
19name: Triage Project Sync (#84)
20
21on:
22  issues:
23    types:
24      - opened
25      - reopened
26      - closed
27      - labeled
28      - unlabeled
29      - assigned
30      - unassigned
31      - edited
32  issue_comment:
33    types: [created]
34  schedule:
35    - cron: "0 6 * * *" # daily 06:00 UTC
36  workflow_dispatch:
37    inputs:
38      issue_number:
39        description: "Issue number to sync (leave blank to sync all)"
40        type: number
41        required: false
42      dry_run:
43        description: "Dry run (compute but don't mutate)"
44        type: boolean
45        default: false
46
47# Coalesce rapid event bursts on the same issue (e.g., 5 labels added at once
48# = 5 events). Cancel any in-progress run for the same issue when a new event
49# arrives — the latest run will compute the most up-to-date state.
50concurrency:
51  group: triage-sync-${{ github.event.issue.number || github.run_id }}
52  cancel-in-progress: true
53
54# Default to no permissions for any job in this workflow. The single job below
55# explicitly opts back in to `contents: read` for the sparse checkout. If a
56# future job is added without its own `permissions:` block, it will inherit
57# this empty default rather than the repo-wide token defaults.
58permissions: {}
59
60jobs:
61  sync:
62    name: Sync triage project
63    # Run only on the canonical repo (not forks); skip PR comments since this
64    # workflow is for issues only.
65    if: |
66      github.repository == 'zed-industries/zed' &&
67      (github.event_name != 'issue_comment' || github.event.issue.pull_request == null)
68    runs-on: ubuntu-latest
69    timeout-minutes: 15
70    permissions:
71      contents: read
72
73    steps:
74      - name: Checkout (sparse — script only)
75        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
76        with:
77          sparse-checkout: script/triage_project_sync.py
78          sparse-checkout-cone-mode: false
79          # Don't write GITHUB_TOKEN into .git/config. We never push from this
80          # workflow; we only read one file. Keeps the token out of any
81          # filesystem state that subsequent steps could access.
82          persist-credentials: false
83
84      - name: Get App installation token
85        id: token
86        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
87        with:
88          app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
89          private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
90          # IMPORTANT: org-scoped token is required for org-level project
91          # mutations. Without `owner:`, the default token is repo-scoped and
92          # cannot write to org projects.
93          owner: zed-industries
94          repositories: zed
95          # Scope the token down to the minimum needed for this workflow.
96          # Even though the App may have broader permissions for other
97          # automations (e.g., Issues:Write for the dupe-bot), this token
98          # only carries what we list below. Per the action's docs, an
99          # unrequested permission is *not* available on the resulting token.
100          #
101          # Required:
102          #   - organization-projects:write — mutate project items + read
103          #     project schema
104          #   - members:read — query the `staff` team membership
105          #   - issues:read — fetch issue body, labels, comments
106          #   - metadata:read — always required for any GH API access
107          permission-organization-projects: write
108          permission-members: read
109          permission-issues: read
110          permission-metadata: read
111
112      - name: Setup Python
113        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
114        with:
115          python-version: "3.12"
116
117      - name: Install dependencies
118        run: pip install requests
119
120      - name: Sync (event-driven, single issue)
121        if: github.event_name == 'issues' || github.event_name == 'issue_comment'
122        env:
123          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
124          ISSUE_NUMBER: ${{ github.event.issue.number }}
125        run: |
126          python script/triage_project_sync.py --issue "$ISSUE_NUMBER"
127
128      - name: Sync (cron, all items)
129        if: github.event_name == 'schedule'
130        env:
131          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
132        run: |
133          python script/triage_project_sync.py --all
134
135      - name: Sync (manual dispatch — single)
136        if: github.event_name == 'workflow_dispatch' && inputs.issue_number != ''
137        env:
138          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
139          ISSUE_NUMBER: ${{ inputs.issue_number }}
140          DRY_RUN: ${{ inputs.dry_run }}
141        run: |
142          if [ "$DRY_RUN" = "true" ]; then
143            python script/triage_project_sync.py --issue "$ISSUE_NUMBER" --dry-run
144          else
145            python script/triage_project_sync.py --issue "$ISSUE_NUMBER"
146          fi
147
148      - name: Sync (manual dispatch — all)
149        if: github.event_name == 'workflow_dispatch' && inputs.issue_number == ''
150        env:
151          GITHUB_TOKEN: ${{ steps.token.outputs.token }}
152          DRY_RUN: ${{ inputs.dry_run }}
153        run: |
154          if [ "$DRY_RUN" = "true" ]; then
155            python script/triage_project_sync.py --all --dry-run
156          else
157            python script/triage_project_sync.py --all
158          fi
159
160      - name: Write summary
161        if: always()
162        env:
163          EVENT_NAME: ${{ github.event_name }}
164          ISSUE_NUMBER: ${{ github.event.issue.number }}
165        run: |
166          {
167            echo "## Triage sync summary"
168            echo ""
169            echo "- Event: \`$EVENT_NAME\`"
170            if [ -n "$ISSUE_NUMBER" ]; then
171              echo "- Issue: #$ISSUE_NUMBER"
172            fi
173            echo "- Project: [#84 Zed weekly triage](https://github.com/orgs/zed-industries/projects/84)"
174          } >> "$GITHUB_STEP_SUMMARY"
175