name: labels
# Ceremony's own caller for the labels automation — the dogfood of issue
# #11, wearing the same local-`uses:` deviation as self-release.yml and the
# same warning: consumers must NEVER copy the local form (it rides main,
# unpinned — correct only for the repo that IS the source). Consumers write:
#   uses: heavy-duty/ceremony/.github/workflows/labels.yml@<pinned-tag>
#
# Since #209 this caller carries the PR/issue event surface only. The
# reconcile sweep no longer rides these runs — the reusable's trigger job
# dispatches the sweep caller (self-labels-sweep.yml here), which owns the
# hourly cron and the manual/bootstrap workflow_dispatch. Issue events and
# same-repository PR events below still yield a sweep within seconds, one
# dispatch hop later. Fork-headed PRs carry a read-only token on this Forgejo,
# so their successful labels run leaves state, blocker, and handoff
# reconciliation to the hourly sweep; path-derived scope labels are not
# applied to those heads (#241).
on:
  # Narrowed (#199) to the actions that carry a queue-state change the hourly
  # cron cannot wait one cadence for — dropping only labeled/unlabeled/assigned/
  # unassigned, which feed validation and the 48h claim clock (caught within one
  # cadence) and were the dominant issues-churn source. Kept: `opened` (the
  # mint→needs-triage check, issueflow's opened-only path), `closed` (the
  # blocker-closes→ready self-heal, crew#96/#98), `edited` (a body rewrite of the
  # `Blocked by #N` declaration the sweep parses — issueflow-reconcile.sh:179),
  # `reopened` (a closed issue re-entering the queue wearing labels derived when
  # it closed). The must-fail in #199 is exactly "a queue-state transition waits
  # on the schedule when an event could have carried it", so edited/reopened stay
  # on events. The PR handoff wake is pull_request_target:labeled, NOT issues, so
  # this does not touch the handoff.
  issues:
    types: [opened, closed, edited, reopened]
  pull_request_target:
    # These carry the head/draft/review facts the sweep derives state:* from.
    # Same-repository heads wake that sweep in seconds; fork heads cannot write
    # with this Forgejo's read-only token, so state, blocker, and handoff
    # reconciliation waits for the scheduled cadence. The sweep does not apply
    # path-derived scope labels to those heads (#241).
    # labeled/unlabeled are the same-repository handoff wake — the author's
    # optimistic state:needs-human write, confirmed or corrected here in
    # seconds (#11); synchronize re-derives on every push; review_requested/
    # review_request_removed clear (or restore) blocker:unrequested on that
    # same instant path (#137).
    types: [opened, reopened, ready_for_review, converted_to_draft, synchronize, labeled, unlabeled, review_requested, review_request_removed]
permissions:
  contents: read
  checks: read          # mergeability/check-rollup read for PR state
  statuses: read        # commit-status rollup read for PR state
  actions: write        # the trigger job's dispatch of the sweep caller (#209, #205)
  issues: write
  pull-requests: write
jobs:
  labels:
    uses: ./.github/workflows/labels.yml
    with:
      # Dogfood filename deviation only — consumers keep the default,
      # labels-sweep.yml, and pass nothing.
      sweep_workflow: self-labels-sweep.yml