name: Label rerun

# When the ``ci-reviewed`` label is added to a PR, rerun all failed jobs in
# the latest CI run. This re-evaluates ``review-labels`` (which now sees the
# label) and GitHub automatically reruns dependent jobs (``comment-live``,
# ``all-checks-pass``) — so the review comment gets updated too.
#
# If the CI run is still in progress when the label is added, we wait for it
# to finish before rerunning (``gh run rerun`` only works on completed runs).
# The wait can be long (20+ min for a full CI run), but it's better than
# silently failing and leaving the reviewer stuck.

on:
  pull_request:
    types: [labeled]

permissions:
  actions: write
  pull-requests: read

concurrency:
  group: label-rerun-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  rerun-review-labels:
    name: Rerun review-labels job
    if: github.event.label.name == 'ci-reviewed'
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - name: Wait for CI run to finish, then rerun failed jobs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -uo pipefail

          # Find the latest CI run for this PR's head SHA.
          RUN_ID=$(gh run list \
            --repo "$REPO" \
            --commit "$HEAD_SHA" \
            --workflow ci.yml \
            --limit 1 \
            --json databaseId,status \
            --jq '.[0] | "\(.databaseId) \(.status)"' 2>/dev/null || true)

          if [ -z "$RUN_ID" ]; then
            echo "No CI run found for this PR — nothing to rerun."
            exit 0
          fi

          # Split "RUN_ID STATUS" into two vars.
          RUN_ID="${RUN_ID%% *}"
          STATUS="${RUN_ID##* }"

          echo "Latest CI run: $RUN_ID (status: $STATUS)"

          # If the run is still in progress, wait for it to finish.
          # gh run rerun only works on completed runs — if we try while it's
          # running, GitHub rejects with "cannot be rerun; This workflow is
          # already running".
          if [ "$STATUS" != "completed" ]; then
            echo "Run is $STATUS — waiting for completion (this may take a while)..."
            # gh run watch --exit-status exits non-zero if the run fails,
            # which is expected (the label gate fails). Don't let that kill
            # the workflow — we WANT to rerun failed jobs.
            timeout 2100 gh run watch "$RUN_ID" --repo "$REPO" --interval 15 || true

            # Verify it's actually completed now.
            STATUS=$(gh run view "$RUN_ID" --repo "$REPO" --json status --jq '.status' 2>/dev/null || echo "unknown")
            if [ "$STATUS" != "completed" ]; then
              echo "Run is still $STATUS after wait — giving up."
              exit 0
            fi
          fi

          echo "Run completed. Rerunning all failed jobs..."
          gh run rerun "$RUN_ID" --repo "$REPO" --failed || true
          echo "Done. GitHub will rerun review-labels and all dependent jobs."