name: Label rerun

# When the ``ci-reviewed`` label is added to a PR, rerun all failed jobs in
# the latest CI run. This re-evaluates ``review-labels`` (which now sees the
# label) and GitHub reruns the dependent ``all-checks-pass`` gate.
#
# ``gh run rerun`` only works on a completed run. Thus this waits when the
# run is still in progress. The wait is now short. The two slowest jobs are
# the 40-minute comment poller and the 45-minute image build. Each one moved
# to its own workflow, so a CI run ends when its required jobs end.
#
# The review comment updates without help. The poller in
# ci-review-comment.yml watches the CI run through the API. It gets the
# rerun results.

on:
  pull_request:
    types: [labeled]

permissions:
  actions: write
  pull-requests: read

concurrency:
  group: label-rerun-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  rerun-review-labels:
    name: Rerun review-labels job
    if: github.event.label.name == 'ci-reviewed'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - name: Wait for CI run to finish, then rerun failed jobs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -uo pipefail

          # Find the latest CI run for this PR's head SHA.
          RUN_INFO=$(gh run list \
            --repo "$REPO" \
            --commit "$HEAD_SHA" \
            --workflow ci.yaml \
            --limit 1 \
            --json databaseId,status \
            --jq '.[0] | "\(.databaseId) \(.status)"' 2>/dev/null || true)

          if [ -z "$RUN_INFO" ]; then
            echo "No CI run found for this PR — nothing to rerun."
            exit 0
          fi

          # Split "RUN_ID STATUS" into two vars. Read STATUS from RUN_INFO,
          # not from the truncated RUN_ID. Both values came from the same
          # var before, which made STATUS the run id. Thus the wait branch
          # always ran.
          RUN_ID="${RUN_INFO%% *}"
          STATUS="${RUN_INFO##* }"

          echo "Latest CI run: $RUN_ID (status: $STATUS)"

          # If the run is still in progress, wait for it to finish.
          # gh run rerun only works on completed runs — if we try while it's
          # running, GitHub rejects with "cannot be rerun; This workflow is
          # already running".
          if [ "$STATUS" != "completed" ]; then
            echo "Run is $STATUS — waiting for completion (this may take a while)..."
            # gh run watch --exit-status exits non-zero if the run fails,
            # which is expected (the label gate fails). Don't let that kill
            # the workflow — we WANT to rerun failed jobs.
            timeout 2100 gh run watch "$RUN_ID" --repo "$REPO" --interval 15 || true

            # Verify it's actually completed now.
            STATUS=$(gh run view "$RUN_ID" --repo "$REPO" --json status --jq '.status' 2>/dev/null || echo "unknown")
            if [ "$STATUS" != "completed" ]; then
              echo "Run is still $STATUS after wait — giving up."
              exit 0
            fi
          fi

          echo "Run completed. Rerunning all failed jobs..."
          gh run rerun "$RUN_ID" --repo "$REPO" --failed || true
          echo "Done. GitHub will rerun review-labels and all dependent jobs."