dependabot-triage.yml

name: Dependabot Triage

run-name: "Dependabot Triage${{ inputs.projects != '' && format(' [{0}]', inputs.projects) || '' }} (${{ inputs.repo_type || 'both' }})${{ inputs.dry_run != false && ' - Dry Run' || '' }}"

# Acts on the open Dependabot PRs that dependabot-report.yml only describes:
#
#   1. sets the milestone matching the PR's base branch
#   2. adds OSS PRs to the release train's org-level GitHub Project
#   3. comments "@dependabot rebase" on a PR that has fallen into conflict
#
# Implements features 2 and 3 of DESIGN-dependabot-automation.md. It shares the
# read-only dependabot-scan action with the report rather than re-deriving any of
# this, so the two can never disagree about what state a PR is in.
#
# Defaults to a dry run, in the same way post-release.yml and lock-unlock-branches.yml do.
#
# See README-dependabot-triage.md for details.

on:
  workflow_dispatch:
    inputs:
      projects:
        description: 'Comma-separated list of Spring Cloud project names. When empty, every project in projects.json is processed.'
        required: false
        type: string
        default: ''
      repo_type:
        description: 'Triage commercial, oss, or both?'
        required: false
        type: choice
        default: 'both'
        options:
          - both
          - oss
          - commercial
      merge_green:
        description: 'Merge green npm / github_actions PRs, OSS and commercial, once triage has filed them (docs-build needs no milestone; the project board is OSS-only). Maven PRs are never merged.'
        required: false
        type: boolean
        default: true
      merge_method:
        description: 'How to merge a green dependency PR.'
        required: false
        type: choice
        default: 'squash'
        options:
          - squash
          - merge
          - rebase
      close_unmaintained:
        description: 'Close Dependabot PRs opened against branches that are no longer maintained. They target locked branches and can never merge.'
        required: false
        type: boolean
        default: true
      dry_run:
        description: 'Dry run, if checked nothing is changed, but you can see what would happen'
        required: false
        type: boolean
        default: true
      token:
        description: 'GitHub token with write access to issues/PRs and the `project` scope. Falls back to GH_ACTIONS_REPO_TOKEN.'
        required: false
        type: string
        default: ''

  # Once a day on weekdays, an hour BEFORE dependabot-report.yml - triage files, merges and
  # closes first, so the report the team reads describes the state after that work rather
  # than a backlog that has already been dealt with.
  #
  # GitHub Actions cron is always UTC with no notion of DST, so this is two month-selected
  # entries - EDT (UTC-4) and EST (UTC-5). The report uses the same split and the same
  # weekdays, so the one-hour gap holds all year instead of drifting to two hours or zero
  # at a DST boundary. Keep the two in step: an hour is comfortably longer than a triage
  # run, but GitHub starts scheduled runs 8-23 minutes late in practice, so a smaller gap
  # would not reliably preserve the order.
  schedule:
    - cron: '17 10 * 3-10 1-5'      # ~6:17am EDT, March-October
    - cron: '17 11 * 11,12,1,2 1-5' # ~6:17am EST, November-February

permissions:
  contents: read

jobs:
  setup:
    name: Build Matrix
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.build-matrix.outputs.matrix }}
      count: ${{ steps.build-matrix.outputs.count }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build matrix
        id: build-matrix
        env:
          PROJECTS_FILTER: ${{ inputs.projects }}
          REPO_TYPE: ${{ inputs.repo_type || 'both' }}
          MATRIX_LIB: ${{ github.workspace }}/.github/scripts/project-branch-matrix.js
        run: |
          node - << 'JSEOF'
          const fs = require('fs');
          const { buildRepoMatrix } = require(process.env.MATRIX_LIB);

          const projects = JSON.parse(fs.readFileSync('config/projects.json', 'utf8'));

          // One entry per repository, matching dependabot-report.yml - Dependabot PRs are
          // listed repo-wide and then attributed to a branch.
          const { entries } = buildRepoMatrix(projects, {
            filter: process.env.PROJECTS_FILTER,
            repoType: process.env.REPO_TYPE,
          });

          console.log(`Repositories to triage: ${entries.length}`);
          for (const e of entries) console.log(`  ${e.repo} (${e.type}) [${e.branches}]`);

          fs.appendFileSync(process.env.GITHUB_OUTPUT,
            `matrix=${JSON.stringify({ include: entries })}\n`);
          fs.appendFileSync(process.env.GITHUB_OUTPUT, `count=${entries.length}\n`);
          JSEOF

  releaser-map:
    name: Build Releaser Map
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build releaser map
        uses: ./.github/actions/releaser-map
        with:
          token: ${{ inputs.token || secrets.GH_ACTIONS_REPO_TOKEN }}

      - name: Upload releaser map
        uses: actions/upload-artifact@v4
        with:
          name: triage-releaser-maps
          path: releaser-maps.json

  triage:
    name: "Triage — ${{ matrix.repo }}"
    needs: [setup, releaser-map]
    if: needs.setup.outputs.count != '0'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download releaser map
        uses: actions/download-artifact@v4
        with:
          name: triage-releaser-maps

      # The same read-only scan the report uses. Triage never re-derives PR state itself,
      # so a PR can never be classified one way in the report and another way here.
      - name: Scan repository
        id: scan
        uses: ./.github/actions/dependabot-scan
        with:
          repo: ${{ matrix.repo }}
          project: ${{ matrix.project }}
          type: ${{ matrix.type }}
          maintained-branches: ${{ matrix.branches }}
          releaser-map-file: releaser-maps.json
          token: ${{ inputs.token || secrets.GH_ACTIONS_REPO_TOKEN }}

      - name: Apply triage
        id: apply
        env:
          GH_TOKEN: ${{ inputs.token || secrets.GH_ACTIONS_REPO_TOKEN }}
          RESULT_FILE: ${{ steps.scan.outputs.result-file }}
          SAFE_NAME: ${{ steps.scan.outputs.safe-name }}
          DRY_RUN: ${{ inputs.dry_run != false }}
          CLOSE_UNMAINTAINED: ${{ github.event_name == 'schedule' || inputs.close_unmaintained != false }}
          MERGE_GREEN: ${{ github.event_name == 'schedule' || inputs.merge_green != false }}
          MERGE_METHOD: ${{ inputs.merge_method || 'squash' }}
          ORG: spring-cloud
        run: |
          node - << 'JSEOF'
          const fs = require('fs');
          const path = require('path');
          const { execFileSync } = require('child_process');

          // The milestone/board pre-release rule, shared with the dependabot-scan action,
          // which applies it to milestones. This job checks the repository out, so the
          // module sits under the workspace.
          const prerelease = require(path.join(process.env.GITHUB_WORKSPACE,
            '.github', 'scripts', 'prerelease-rank.js'));

          const DRY = process.env.DRY_RUN !== 'false';
          const CLOSE_UNMAINTAINED = process.env.CLOSE_UNMAINTAINED === 'true';
          const MERGE_GREEN = process.env.MERGE_GREEN === 'true';
          const MERGE_METHOD = process.env.MERGE_METHOD || 'squash';
          // Maven is deliberately absent: those updates change what the projects ship,
          // and are left for a human. npm and github_actions updates are build and docs
          // tooling, where a green CI run is the whole story.
          const MERGEABLE_ECOSYSTEMS = new Set(['npm_and_yarn', 'github_actions']);
          const ORG = process.env.ORG;
          const scan = JSON.parse(fs.readFileSync(process.env.RESULT_FILE, 'utf8'));

          const gh = args => {
            try {
              return { ok: true, out: execFileSync('gh', args,
                { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 1 << 26 }) };
            } catch (err) {
              return { ok: false, out: err.stdout || '',
                err: (err.stderr || err.message || '').split('\n')[0].trim() };
            }
          };

          // Same backoff as the scan action. Writes are retried too: a 502 on the way out
          // would otherwise leave the PR untouched until the next scheduled run.
          const ghRetry = (args, attempts = 3) => {
            let last;
            for (let attempt = 1; attempt <= attempts; attempt++) {
              last = gh(args);
              if (last.ok) return last;
              if (attempt < attempts) execFileSync('sleep', [String(attempt * 3)]);
            }
            return last;
          };

          const graphql = (query, ...fields) => {
            const args = ['api', 'graphql', '-f', `query=${query}`, ...fields];
            const r = ghRetry(args);
            let body = null;
            try { body = JSON.parse(r.out); } catch (_) { /* non-JSON error output */ }
            const errors = body?.errors || [];
            return { ...r, body, errors, ok: r.ok && errors.length === 0 };
          };

          const actions = [];   // what happened, for the summary
          const errors = [];
          const record = (pr, action, status, detail) => {
            actions.push({ number: pr.number, url: pr.url, base: pr.baseRefName,
              action, status, detail });
            const tag = DRY && status === 'would' ? '[dry run] would' : status;
            console.log(`  #${pr.number} ${action}: ${tag}${detail ? ` - ${detail}` : ''}`);
          };

          // ── Milestone numbers, looked up once per repository ────────────────────────
          let milestoneIndex = null;
          const milestoneNumber = title => {
            if (milestoneIndex === null) {
              milestoneIndex = new Map();
              // --paginate: a repository past a hundred open milestones would otherwise
              // lose the newest ones, which are the only ones this ever looks for.
              const r = ghRetry(['api', '--paginate', '--slurp',
                `repos/${scan.repo}/milestones?state=open&per_page=100`]);
              if (r.ok) {
                for (const m of JSON.parse(r.out || '[]').flat()) milestoneIndex.set(m.title, m.number);
              } else {
                errors.push(`could not list milestones: ${r.err}`);
              }
            }
            return milestoneIndex.get(title);
          };

          // ── Project boards, listed once and cached ──────────────────────────────────
          let boards = null;
          const allBoards = () => {
            if (boards === null) {
              boards = [];
              const q = `{ organization(login: "${ORG}") { projectsV2(first: 100) ` +
                `{ nodes { id title closed } } } }`;
              const r = graphql(q);
              if (r.ok) {
                boards = (r.body?.data?.organization?.projectsV2?.nodes || [])
                  .map(n => ({ id: n.id, title: n.title, closed: !!n.closed }));
              } else {
                errors.push('could not list Projects v2: ' +
                  (r.errors[0]?.message || r.err || 'unknown error'));
              }
            }
            return boards;
          };

          // The releaser config names a train by its GA version (2026.0.0), but a train is
          // not born at GA: it ships milestones and release candidates first, and the board
          // that is actually open is titled 2026.0.0-M1, then -M2, then -RC1. Asking only
          // for the exact title means every PR against a freshly branched train is skipped
          // with "no board titled 2026.0.0" until GA, which is most of the train's life.
          //
          // So the GA title is a base to match against, not a literal: any board titled
          // <base> or <base>-M<n> / <base>-RC<n> is a candidate.
          //
          // Ranked open-first, because a milestone's board is closed once it ships and
          // adding to a closed board is worse than adding to none. Within that, later
          // wins - GA over RC over M, and a higher number over a lower one - so the board
          // picked is the one the train is currently working toward.
          const resolveBoard = base => {
            const candidates = [];
            for (const b of allBoards()) {
              const rank = prerelease.rank(b.title, base);
              if (rank) candidates.push({ ...b, rank });
            }
            if (!candidates.length) return null;
            // Open before closed, then furthest along. The scan applies the same rule to
            // milestones, minus the closed test - it only ever lists open ones.
            candidates.sort((x, y) => (x.closed - y.closed) || prerelease.byRankDesc(x, y));
            return candidates[0];
          };

          const PR_QUERY = `query($owner:String!,$name:String!,$number:Int!){
            repository(owner:$owner,name:$name){
              pullRequest(number:$number){
                id
                projectItems(first:20){ nodes { project { id title } } }
              }
            }
          }`;

          const [owner, name] = scan.repo.split('/');

          for (const pr of scan.prs) {
            // A PR against a branch that is no longer maintained targets a locked branch
            // and can never merge, so the only useful action is to close it. Milestone and
            // project are skipped entirely for these - there is no train to file them under.
            if (pr.state === 'unmaintained') {
              if (!CLOSE_UNMAINTAINED) {
                record(pr, 'close', 'skipped', `${pr.baseRefName} is not maintained`);
                continue;
              }
              if (DRY) {
                record(pr, 'close', 'would', `close - ${pr.baseRefName} is not maintained`);
                continue;
              }
              // The comment goes first and is the whole audit trail: closing in silence
              // leaves no way to tell an intentional close from a mistaken one, and the
              // judgement rests on projects.json, which can be wrong if a live branch was
              // dropped from it. Closing is reversible; an unexplained close is not.
              const body =
                `Closing automatically: \`${pr.baseRefName}\` is no longer a maintained ` +
                `branch of this repository (it is not listed in ` +
                `[config/projects.json](https://github.com/spring-cloud/spring-cloud-github-actions/blob/main/config/projects.json)), ` +
                `so this update cannot be merged here.\n\n` +
                `If that is wrong - the branch is still maintained and was dropped from ` +
                `projects.json by mistake - reopen this PR and restore the branch there.\n\n` +
                `Closed by [dependabot-triage.yml](https://github.com/spring-cloud/spring-cloud-github-actions/blob/main/.github/workflows/dependabot-triage.yml).`;
              const c = ghRetry(['api', `repos/${scan.repo}/issues/${pr.number}/comments`,
                '--method', 'POST', '-f', `body=${body}`]);
              if (!c.ok) {
                record(pr, 'close', 'error', `could not comment: ${c.err}`);
                errors.push(`#${pr.number} close: ${c.err}`);
                continue;
              }
              const cl = ghRetry(['api', `repos/${scan.repo}/pulls/${pr.number}`,
                '--method', 'PATCH', '-f', 'state=closed']);
              if (cl.ok) {
                record(pr, 'close', 'closed', `${pr.baseRefName} is not maintained`);
              } else {
                record(pr, 'close', 'error', cl.err);
                errors.push(`#${pr.number} close: ${cl.err}`);
              }
              continue;
            }

            // ── 1. Milestone ─────────────────────────────────────────────────────────
            // Whether the PR ends this run with a milestone and a board item. Evaluated as
            // the actions happen, not from the scan, so a PR filed moments ago by this same
            // run is eligible to merge rather than having to wait four hours for the next.
            let milestoneOk = pr.milestoneState === 'set';
            let projectOk = false;

            if (pr.milestoneState === 'unset') {
              const number = milestoneNumber(pr.expectedMilestone);
              if (!number) {
                record(pr, 'milestone', 'skipped',
                  `milestone ${pr.expectedMilestone} not found`);
              } else if (DRY) {
                milestoneOk = true;
                record(pr, 'milestone', 'would', `set ${pr.expectedMilestone}`);
              } else {
                const r = ghRetry(['api', `repos/${scan.repo}/issues/${pr.number}`,
                  '--method', 'PATCH', '-F', `milestone=${number}`]);
                if (r.ok) { milestoneOk = true; record(pr, 'milestone', 'set', pr.expectedMilestone); }
                else {
                  record(pr, 'milestone', 'error', r.err);
                  errors.push(`#${pr.number} milestone: ${r.err}`);
                }
              }
            } else if (pr.milestoneState === 'missing') {
              // Deliberately not created here - the report warns about it instead, so a
              // missing milestone stays a human decision about the release train.
              record(pr, 'milestone', 'skipped',
                `milestone ${pr.expectedMilestone} does not exist`);
            } else if (pr.milestoneState === 'mismatch') {
              record(pr, 'milestone', 'skipped',
                `already set to ${pr.currentMilestone}, expected ${pr.expectedMilestone}`);
            }

            // ── 2. Project board (OSS only) ──────────────────────────────────────────
            if (pr.projectState === 'resolved') {
              // -f sends a literal string, -F coerces to a JSON type. owner/name are
              // String!, number is Int!, so they need different flags.
              const pq = graphql(PR_QUERY, '-f', `owner=${owner}`, '-f', `name=${name}`,
                '-F', `number=${pr.number}`);
              if (!pq.ok) {
                record(pr, 'project', 'error',
                  pq.errors[0]?.message || pq.err || 'lookup failed');
                errors.push(`#${pr.number} project lookup: ${pq.err || 'GraphQL error'}`);
              } else {
                const node = pq.body?.data?.repository?.pullRequest;
                const board = resolveBoard(pr.expectedProject);
                // Membership is checked against the board actually picked, not the GA
                // title, so a PR already sitting on 2026.0.0-M1 is left alone.
                const already = board && (node?.projectItems?.nodes || [])
                  .some(i => i.project?.title === board.title);
                if (already) {
                  projectOk = true;
                  record(pr, 'project', 'already', board.title);
                } else if (!board) {
                  record(pr, 'project', 'skipped',
                    `no board titled ${pr.expectedProject} or ${pr.expectedProject}-M*/-RC*`);
                } else if (board.closed) {
                  // Every candidate was closed. Filing into one hides the PR, so this needs
                  // a human to open the next milestone's board.
                  record(pr, 'project', 'skipped',
                    `only board for ${pr.expectedProject} is ${board.title}, which is closed`);
                } else if (DRY) {
                  projectOk = true;
                  record(pr, 'project', 'would', `add to ${board.title}`);
                } else {
                  const m = graphql(
                    `mutation($p:ID!,$c:ID!){ addProjectV2ItemById(input:{projectId:$p,` +
                    `contentId:$c}){ item { id } } }`,
                    '-f', `p=${board.id}`, '-f', `c=${node.id}`);
                  if (m.ok) { projectOk = true; record(pr, 'project', 'added', board.title); }
                  else {
                    const msg = m.errors[0]?.message || m.err || 'mutation failed';
                    record(pr, 'project', 'error', msg);
                    errors.push(`#${pr.number} project add: ${msg}`);
                  }
                }
              }
            } else if (pr.projectState === 'unresolved') {
              record(pr, 'project', 'skipped', `no train resolved for ${pr.baseRefName}`);
            }

            // ── 3. Rebase on conflict ────────────────────────────────────────────────
            if (pr.state === 'conflicting') {
              // Idempotency without state: only ask again if no "@dependabot rebase"
              // comment is newer than the PR's current head commit. A rebase that produced
              // a new head makes the PR eligible again; one that changed nothing does not,
              // so a permanently conflicting PR is asked once, not once every run.
              const head = ghRetry(['api',
                `repos/${scan.repo}/commits/${pr.headRefOid}`, '--jq', '.commit.committer.date']);
              if (!head.ok) {
                record(pr, 'rebase', 'error', `could not read head commit: ${head.err}`);
                errors.push(`#${pr.number} rebase: ${head.err}`);
                continue;
              }
              const headDate = new Date(head.out.trim()).getTime();

              const comments = ghRetry(['api',
                `repos/${scan.repo}/issues/${pr.number}/comments?per_page=100`]);
              if (!comments.ok) {
                record(pr, 'rebase', 'error', `could not read comments: ${comments.err}`);
                errors.push(`#${pr.number} rebase: ${comments.err}`);
                continue;
              }

              const asked = JSON.parse(comments.out || '[]').some(c =>
                /@dependabot\s+rebase/i.test(c.body || '') &&
                new Date(c.created_at).getTime() > headDate);

              if (asked) {
                record(pr, 'rebase', 'already', 'already asked since the current head');
              } else if (DRY) {
                record(pr, 'rebase', 'would', 'comment @dependabot rebase');
              } else {
                const r = ghRetry(['api', `repos/${scan.repo}/issues/${pr.number}/comments`,
                  '--method', 'POST', '-f', 'body=@dependabot rebase']);
                if (r.ok) record(pr, 'rebase', 'requested', '');
                else {
                  record(pr, 'rebase', 'error', r.err);
                  errors.push(`#${pr.number} rebase: ${r.err}`);
                }
              }
            }

            // ── 4. Merge green dependency PRs ────────────────────────────────────────
            // Gated on state === 'ready', which the scan defines as every check passing,
            // mergeable, and a CLEAN merge state - so branch protection and conflicts are
            // already excluded and there is nothing to re-derive here.
            if (!MERGE_GREEN) continue;

            // Everything below records *why* a PR is not being merged rather than dropping
            // out silently. Without this a dry run showed only the PRs it would merge, so
            // "why is this one not in the list?" had no answer anywhere in the summary.
            if (!MERGEABLE_ECOSYSTEMS.has(pr.ecosystem)) {
              // Policy rather than a passing state - it will never change for this PR, so
              // it is spelled out when explaining a plan and left out of a run that is
              // reporting what it changed.
              if (DRY) {
                record(pr, 'merge', 'skipped',
                  `${pr.ecosystem || 'unknown ecosystem'} is never auto-merged`);
              }
              continue;
            }

            if (pr.state !== 'ready') {
              // These do change run to run, so they are always worth reporting.
              const why =
                pr.state === 'failing' ? `checks failing: ${(pr.failingChecks || []).join(', ')}`
                : pr.state === 'pending' ? `checks still running: ${(pr.pendingChecks || []).join(', ')}`
                : pr.state === 'conflicting' ? 'conflicts with the base branch'
                : pr.state === 'blocked' ? `all checks pass but GitHub reports ${pr.mergeStateStatus}`
                : pr.state === 'unknown' ? 'GitHub has not resolved mergeability yet'
                : `not ready (${pr.state})`;
              record(pr, 'merge', 'skipped', why);
              continue;
            }

            // A release branch PR must be filed before it is merged, so merging never
            // loses the record of which train shipped it. docs-build belongs to no train
            // and gets neither a milestone nor a board by design, so requiring them there
            // would mean never merging a docs update at all.
            //
            // The board applies to OSS only - commercial PRs are never added to one - so
            // that half of the requirement is taken from the scan's own verdict rather
            // than re-deciding it here: projectState is 'n/a' exactly when no board was
            // ever expected, which covers both commercial and docs-build.
            if (pr.isReleaseBranch) {
              const needsProject = pr.projectState !== 'n/a';
              if (!milestoneOk || (needsProject && !projectOk)) {
                // Say which milestone is in the way, not just that one is. "waiting on
                // milestone" reads as "has none" when the usual cause is the opposite - a
                // PR carrying the previous train's milestone, which triage will not
                // overwrite, so the row otherwise contradicts the visible PR.
                const milestoneReason = pr.currentMilestone
                  ? `milestone is ${pr.currentMilestone}, expected ${pr.expectedMilestone}`
                  : `milestone ${pr.expectedMilestone} not set`;
                const missing = [!milestoneOk && milestoneReason,
                  needsProject && !projectOk && 'project'].filter(Boolean).join(' and ');
                record(pr, 'merge', 'skipped', `not filed yet - waiting on ${missing}`);
                continue;
              }
            }

            if (DRY) {
              record(pr, 'merge', 'would', `merge ${pr.ecosystem} (${MERGE_METHOD})`);
              continue;
            }

            const mg = ghRetry(['pr', 'merge', String(pr.number), '--repo', scan.repo,
              `--${MERGE_METHOD}`]);
            if (mg.ok) {
              record(pr, 'merge', 'merged', `${pr.ecosystem}, ${MERGE_METHOD}`);
            } else {
              record(pr, 'merge', 'error', mg.err);
              errors.push(`#${pr.number} merge: ${mg.err}`);
            }
          }

          const tally = key => actions.filter(a => a.status === key).length;
          const result = {
            repo: scan.repo, type: scan.type, project: scan.project,
            dryRun: DRY,
            prsConsidered: scan.prs.length,
            counts: {
              would: tally('would'), set: tally('set'), added: tally('added'),
              closed: tally('closed'), merged: tally('merged'),
              requested: tally('requested'), already: tally('already'),
              skipped: tally('skipped'), error: tally('error'),
            },
            actions,
            errors: errors.concat(scan.warnings || []),
          };

          fs.writeFileSync(`triage-${process.env.SAFE_NAME}.json`, JSON.stringify(result, null, 2));

          const c = result.counts;
          console.log(`${scan.repo}: ${result.prsConsidered} PR(s) considered - ` +
            `${c.would} would-change, ${c.set + c.added + c.requested} changed, ` +
            `${c.already} already done, ${c.skipped} skipped, ${c.error} error(s)`);
          JSEOF

      - name: Upload result
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: triage-${{ steps.scan.outputs.safe-name }}
          path: triage-${{ steps.scan.outputs.safe-name }}.json

  summary:
    name: Summary
    needs: [setup, triage]
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Download results
        uses: actions/download-artifact@v4
        with:
          pattern: triage-spring-cloud-*
          merge-multiple: true
          path: results

      - name: Write summary
        id: write-summary
        run: |
          node - << 'JSEOF'
          const fs = require('fs');

          let results = [];
          try {
            results = fs.readdirSync('results')
              .filter(f => f.endsWith('.json'))
              .map(f => JSON.parse(fs.readFileSync(`results/${f}`, 'utf8')))
              .sort((a, b) => a.repo.localeCompare(b.repo));
          } catch (err) {
            console.log('No results to summarize.');
          }

          const dry = results.some(r => r.dryRun);
          const sum = k => results.reduce((n, r) => n + (r.counts?.[k] || 0), 0);

          const md = ['## Dependabot Triage', ''];
          if (dry) {
            md.push('> **Dry run** — nothing was changed. Re-run with `dry_run` unchecked to apply.', '');
          }
          const parts = [`${sum('would')} pending change(s)`,
            `${sum('set') + sum('added') + sum('requested')} applied`];
          // Only mentioned when they happened: these are the outcomes worth noticing, and
          // padding every run with "0 merged, 0 closed" would bury them.
          if (sum('merged')) parts.push(`**${sum('merged')} merged**`);
          if (sum('closed')) parts.push(`**${sum('closed')} closed**`);
          parts.push(`${sum('already')} already done`, `${sum('skipped')} skipped`,
            `${sum('error')} error(s)`);
          md.push(`${parts.join(', ')} across ${results.length} repositories.`);
          md.push('');

          const changed = results.filter(r =>
            (r.actions || []).some(a => a.status !== 'already'));

          if (!changed.length) {
            md.push('Nothing to do — every open Dependabot PR is already triaged.');
          } else {
            md.push('| Repo | PR | Action | Status | Detail |');
            md.push('|---|---|---|---|---|');
            for (const r of changed) {
              for (const a of r.actions) {
                if (a.status === 'already') continue;
                md.push(`| \`${r.repo}\` | [#${a.number}](${a.url}) | ${a.action} | ` +
                  `${a.status === 'would' ? '_would_' : a.status} | ${a.detail || ''} |`);
              }
            }
          }

          const errs = results.flatMap(r => (r.errors || []).map(e => `\`${r.repo}\` — ${e}`));
          if (errs.length) {
            md.push('', '### Errors', '');
            for (const e of errs) md.push(`- ${e}`);
          }

          fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, md.join('\n') + '\n');
          console.log(md.join('\n'));

          // ── Google Chat: only when a PR actually changed hands ──────────────────────
          // Restricted to the two irreversible-looking outcomes. Setting a milestone or
          // adding a board item happens constantly and is not worth a message; a PR being
          // closed or merged is something the team should hear about without going and
          // looking. `merged` is included now although triage does not merge yet, so the
          // notification needs no change when it starts to.
          //
          // A dry run cannot trigger this: it only ever records `would`, never `closed`
          // or `merged`, so the gate is the status itself rather than a separate check.
          const notable = results.flatMap(r =>
            (r.actions || [])
              .filter(a => a.status === 'closed' || a.status === 'merged')
              .map(a => ({ ...a, repo: r.repo })));

          if (notable.length) {
            const chat = [];
            const closed = notable.filter(a => a.status === 'closed');
            const merged = notable.filter(a => a.status === 'merged');

            const headline = [
              merged.length ? `${merged.length} merged` : '',
              closed.length ? `${closed.length} closed` : '',
            ].filter(Boolean).join(', ');
            chat.push(`🤖 *Dependabot Triage* — ${headline}`);

            // Chat formatting is its own thing (*bold*, <url|text>), as in the report.
            const section = (title, items, render, limit = 15) => {
              if (!items.length) return;
              chat.push('', `*${title}* (${items.length})`);
              for (const a of items.slice(0, limit)) chat.push(`• ${render(a)}`);
              if (items.length > limit) chat.push(`• …and ${items.length - limit} more`);
            };

            section('Merged', merged, a =>
              `${a.repo} <${a.url}|#${a.number}>${a.detail ? ` — ${a.detail}` : ''}`);
            section('Closed — branch no longer maintained', closed, a =>
              `${a.repo} <${a.url}|#${a.number}> — ${a.base}`);

            const delimiter = `ghadelim_${results.length}_${notable.length}`;
            fs.appendFileSync(process.env.GITHUB_OUTPUT,
              `chat-text<<${delimiter}\n${chat.join('\n')}\n${delimiter}\n`);
            console.log(`\nGoogle Chat notification queued (${notable.length} PR(s)).`);
          } else {
            console.log('\nNothing was closed or merged - no Google Chat notification.');
          }
          JSEOF

      # Skipped entirely when nothing was closed or merged: chat-text is only written in
      # that case, so a routine run that just set milestones stays silent.
      - name: Send Google Chat notification
        if: steps.write-summary.outputs.chat-text != ''
        env:
          WEBHOOK_URL: ${{ secrets.SPRING_CLOUD_CORE_CI_GCHAT_WEBHOOK_URL }}
          CHAT_TEXT: ${{ steps.write-summary.outputs.chat-text }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail

          if [[ -z "${WEBHOOK_URL}" ]]; then
            echo "SPRING_CLOUD_CORE_CI_GCHAT_WEBHOOK_URL is not set - skipping Google Chat notification."
            exit 0
          fi

          TEXT=$(printf '%s\n\n<%s|View run>' "$CHAT_TEXT" "$RUN_URL")
          jq -n --arg text "$TEXT" '{text: $text}' > chat-message.json

          curl --fail --silent --show-error \
            -X POST \
            -H 'Content-Type: application/json; charset=UTF-8' \
            -d @chat-message.json \
            "${WEBHOOK_URL}"