task-claim.yml

name: Task Claim

# Required check for the AGENTS.md section 1 claim workflow: a PR into `dev`
# that closes an issue needs that issue to carry an `agent:*` label and
# `status:in-progress` or `status:in-review`. Dependabot PRs are exempt, and
# the dev to main promotion is out of scope (the `dev-task-claim` ruleset
# covers dev only). Logic and tests: scripts/task-claim-check.mjs.
#
# pull_request_target runs this file and the script from `dev`, never from the
# PR, so a PR cannot weaken the check it is held to. No PR code is checked out
# or run, and the token is read-only.
#
# The check reads issue labels when it runs. When an issue gains or loses an
# agent:* or status:* label, task-claim-revalidate.yml re-runs this check on
# every open PR into dev that closes it, so a claim added later unblocks the
# PR and a released claim blocks it again. `gh run rerun <id>` does the same
# by hand.

on:
  pull_request_target:
    types: [opened, reopened, synchronize, edited, ready_for_review]
    branches: [dev]

permissions: {}

jobs:
  claim:
    # This job name is the required status check context in the ruleset.
    name: task-claim
    runs-on: ubuntu-latest
    timeout-minutes: 2
    # No concurrency group: a cancelled run becomes the PR's task-claim result
    # (GitHub reports the newest run) and blocks the merge (#444). Runs are
    # read-only, take seconds and read the labels live, so overlap is harmless.
    permissions:
      contents: read
      issues: read
      pull-requests: read
    steps:
      # pull_request_target checks out the base branch by default; only the
      # script is fetched.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: scripts/task-claim-check.mjs
          sparse-checkout-cone-mode: false

      - name: Check that closing issues are claimed
        env:
          GITHUB_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: node scripts/task-claim-check.mjs