self-coderabbit-collapse.yml

name: Self — CodeRabbit Collapse

# Folds CodeRabbit's review summary on this repository's pull requests once every
# inline thread it opened is resolved. Paired with `self-pr-validation.yml`, which
# is where the review is requested in the first place.
#
# The triggers are the ones GitHub offers, not the one this wants. See the note in
# coderabbit-collapse.yml.

on:
  pull_request:
    types:
      - synchronize
  pull_request_review:
    types:
      - submitted
  pull_request_review_comment:
    types:
      - created

permissions:
  contents: read

# A burst of activity fires this several times over — a push and a review landing
# together is enough. They must not race to the same mutation, so they are grouped
# per pull request and run one at a time.
#
# Not `cancel-in-progress: true`: that kills the *running* one, and a cancelled run
# is reported as a non-success check, leaving the pull request UNSTABLE over tidying
# that is cosmetic to begin with.
#
# This does not remove cancellation, only moves it somewhere harmless. GitHub keeps
# at most one pending run per group, and a newly queued run cancels the pending one
# it replaces, so a burst of three or more still cancels the ones in the middle.
# What is guaranteed is that no in-progress run is killed and the last one queued —
# the one with the freshest view — survives. Nothing is lost by the cancellation
# either way: every run reads the live thread state, so a superseded pending run
# would have found the same work already done. `queue: max` holds up to 100 pending
# instead, but it is limited to newer Actions generations and is a validation error
# where unavailable — too much risk for cosmetic tidying.
concurrency:
  group: coderabbit-collapse-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  collapse:
    name: Collapse Resolved Reviews
    # A fork pull request checks out the contributor's merge ref, so the composite below
    # is their code running in this repository's job. GitHub already makes that inert —
    # fork pull requests get a read-only GITHUB_TOKEN and no secrets, and that holds for
    # all three events here — but the guarantee is a platform setting rather than
    # something this workflow controls, and a read-only token could not fold anything
    # anyway. Skip outright instead of depending on it and logging warnings that only
    # ever mean "this was never going to work".
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ${{ vars.GENERAL_RUNNERS || 'blacksmith-4vcpu-ubuntu-2404' }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      # The composite is used by path rather than through coderabbit-collapse.yml,
      # matching how self-pr-validation.yml runs this repository's own composites.
      # The reusable workflow resolves `LerianStudio/…/src/notify/coderabbit-collapse@v1`,
      # an absolute ref for the benefit of other repositories — which cannot resolve
      # at all until this merges and a version carries it. A self entrypoint that
      # depended on that could never run on the pull request introducing it.
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          persist-credentials: false

      - name: Collapse resolved reviews
        uses: ./src/notify/coderabbit-collapse
        with:
          github-token: ${{ secrets.MANAGE_TOKEN || github.token }}
          pr-number: ${{ github.event.pull_request.number }}