name: labels
# Ceremony's own caller for the labels automation — the dogfood of issue
# #11, wearing the same local-`uses:` deviation as self-release.yml and the
# same warning: consumers must NEVER copy the local form (it rides main,
# unpinned — correct only for the repo that IS the source). Consumers write:
#   uses: heavy-duty/ceremony/.github/workflows/labels.yml@<pinned-tag>
on:
  # Hourly, not */15 (#199): the cron is a BACKSTOP, not the wake. Events below
  # carry every real state change in seconds; the cron only catches a FORGOTTEN
  # handoff, so a quiet repo loses at most the forgotten case, and only by ≤1h —
  # while */15 fired a full-board sweep four times an hour at GitHub's 1-minute
  # billing floor, 52% of one private consumer's runs for near-zero real work.
  schedule: [{cron: "0 * * * *"}]
  workflow_dispatch:                 # bootstraps missing labels on a fresh repo
  # Narrowed to the two actions with promptness-critical reconcile behavior
  # (#199): `opened` drives the mint→needs-triage check (issueflow's opened-only
  # path), `closed` drives the blocker-closes→ready self-heal (crew#96/#98). The
  # dropped actions — labeled/unlabeled/assigned/unassigned/edited/reopened —
  # only feed validation and the 48h claim clock, which the hourly cron catches
  # within one cadence; labeled/unlabeled were also the dominant issues-churn
  # source. The PR handoff wake is pull_request_target:labeled, NOT issues, so
  # this does not touch the handoff.
  issues:
    types: [opened, closed]
  pull_request_target:
    # Every PR arrives from a fork, so these carry the head/draft/review facts
    # the sweep derives state:* from. labeled/unlabeled are the handoff wake —
    # the author's optimistic state:needs-human write, confirmed or corrected
    # here in seconds (#11); synchronize re-derives on every push;
    # review_requested/review_request_removed wake the sweep that clears (or
    # restores) blocker:unrequested — without them the one event that makes
    # the label false could not clear it, and a quiet repo wore the red flag
    # until the advisory cron (#137).
    types: [opened, reopened, ready_for_review, converted_to_draft, synchronize, labeled, unlabeled, review_requested, review_request_removed]
permissions:
  contents: read
  checks: read          # mergeability/check-rollup read for PR state
  statuses: read        # commit-status rollup read for PR state
  issues: write
  pull-requests: write
jobs:
  labels:
    uses: ./.github/workflows/labels.yml