name: PR Sweeper

# Deferred half of the issue gate. Every six hours:
#
#   1. Re-check every pull request carrying `needs-approved-issue`. Clear the ones
#      that now link an approved issue; close the ones still failing 72h after they
#      were told. The re-check is the point — linking an issue through the sidebar
#      fires no webhook, so `issue-gate.yml` never sees it.
#   2. Close drafts from outside the org after 30 days without activity.
#
# Runs on `schedule`, so it never touches pull request code and needs none of the
# `pull_request_target` precautions. Dispatch manually with dry_run to see what it
# would do before it does it.

on:
  schedule:
    - cron: '17 */6 * * *'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Log intended actions without closing anything'
        type: boolean
        default: true

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  sweep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/github-script@v7
        env:
          DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
        with:
          script: |
            const gate = require(`${process.env.GITHUB_WORKSPACE}/.github/scripts/issue-gate.js`);
            await gate.runSweep({ github, core, context, dryRun: process.env.DRY_RUN === 'true' });