pm-github-sync.yml

name: Sync GitHub issues into pm

on:
  schedule:
    - cron: "17 2 * * *"
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: pm-github-sync
  cancel-in-progress: false

jobs:
  sync:
    # Imported issue bodies need a fail-closed pre-push privacy gate first.
    if: ${{ false }}
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ github.token }}
      REPOSITORY: ${{ github.repository }}
      SYNC_BRANCH: automation/pm-github-sync
    steps:
      - name: Checkout main
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          fetch-tags: true
          ref: main

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 22.18.0
          cache: npm

      - name: Prepare sync branch
        shell: bash
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch --force origin main
          if git ls-remote --exit-code --heads origin "refs/heads/${SYNC_BRANCH}" > /dev/null 2>&1; then
            git fetch --force origin "${SYNC_BRANCH}"
            git switch --force-create "${SYNC_BRANCH}" "origin/${SYNC_BRANCH}"
            git merge --no-edit origin/main
          else
            git switch --create "${SYNC_BRANCH}" --track origin/main
          fi

      - name: Install dependencies
        run: npm ci

      - name: Install project pm-github extension
        shell: bash
        run: bash scripts/install-pm-github.sh

      - name: Validate GitHub access
        run: ./node_modules/.bin/pm github validate --repo "${REPOSITORY}"

      - name: Preview GitHub to pm plan
        run: ./node_modules/.bin/pm github import "${REPOSITORY}" --state all --atomic --dry-run

      - name: Apply GitHub to pm sync
        run: ./node_modules/.bin/pm github import "${REPOSITORY}" --state all --atomic

      - name: Verify strict pm health
        run: ./node_modules/.bin/pm health --strict-exit

      - name: Commit sync changes on branch and open PR
        shell: bash
        run: |
          set -euo pipefail
          git add -A
          if git diff --cached --quiet; then
            echo "GitHub issues already match the pm tracker; no PR is needed."
            exit 0
          fi
          git diff --cached --check
          links_file="${RUNNER_TEMP}/pm-github-sync-links.md"
          : > "${links_file}"
          while IFS= read -r path; do
            case "${path}" in
              .agents/pm/*/*.toon)
                item_id="${path##*/}"
                item_id="${item_id%.toon}"
                printf -- '- [%s](%s)\n' "${item_id}" "${path}" >> "${links_file}"
                ;;
            esac
          done < <(git diff --cached --name-only -- .agents/pm)
          if [[ ! -s "${links_file}" ]]; then
            echo "::error::The sync changed tracker state but no item .toon link could be generated."
            exit 1
          fi
          git commit -m "chore(pm): sync GitHub issues"
          git push --set-upstream origin "${SYNC_BRANCH}"
          body_file="${RUNNER_TEMP}/pm-github-sync-pr.md"
          {
            printf '%s\n\n' "Automated pm-github issue synchronization for ${REPOSITORY}."
            printf '%s\n\n' "The atomic dry-run plan was shown before the write. Changes are on ${SYNC_BRANCH}; main is never pushed directly."
            printf '%s\n' 'Tracker items changed:'
            cat "${links_file}"
          } > "${body_file}"
          pr_number="$(gh pr list -R "${REPOSITORY}" --head "${SYNC_BRANCH}" --base main --state open --json number --jq '.[0].number // empty')"
          if [[ -z "${pr_number}" ]]; then
            gh pr create -R "${REPOSITORY}" --base main --head "${SYNC_BRANCH}" --title "chore(pm): sync GitHub issues" --body-file "${body_file}"
          else
            gh pr edit "${pr_number}" -R "${REPOSITORY}" --body-file "${body_file}"
          fi