pr-artifacts.yml

---
name: PR Artifacts

on:
    workflow_dispatch: # Manual trigger for testing
    pull_request_target:
        types: [opened, synchronize, reopened, closed]
        branches: [main]
    pull_request_review:
        types: [submitted]

jobs:
  # Auto-remove .pr/ directory from same-repository PRs when approved.
    cleanup-on-approval:
        concurrency:
            group: cleanup-pr-artifacts-${{ github.event.pull_request.number }}
            cancel-in-progress: false
        if: >-
            github.event_name == 'pull_request_review' &&
            github.event.review.state == 'approved' &&
            github.event.pull_request.head.repo.full_name == github.repository
        runs-on: ubuntu-latest
        permissions:
            contents: write
            pull-requests: write
        steps:
            # Use PAT so the push triggers CI workflows that will complete and
            # satisfy branch protection. We can't use [skip ci] because the Vercel
            # GitHub App creates stuck checks that block merging.
            - uses: actions/checkout@v7
              with:
                  ref: ${{ github.event.pull_request.head.ref }}
                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}

            - name: Remove .pr/ directory
              id: remove
              run: |
                  if [ -d ".pr" ]; then
                    git config user.name "allhands-bot"
                    git config user.email "allhands-bot@users.noreply.github.com"
                    git rm -rf .pr/
                    git commit -m "chore: Remove PR-only artifacts [automated]"
                    git push || {
                      echo "::error::Failed to push cleanup commit. Check branch protection rules."
                      exit 1
                    }
                    echo "removed=true" >> "$GITHUB_OUTPUT"
                    echo "::notice::Removed .pr/ directory"
                  else
                    echo "removed=false" >> "$GITHUB_OUTPUT"
                    echo "::notice::No .pr/ directory to remove"
                  fi

            - name: Update PR comment after cleanup
              if: steps.remove.outputs.removed == 'true'
              uses: actions/github-script@v9
              with:
                  script: |
                      const marker = '<!-- pr-artifacts-notice -->';
                      const body = `${marker}
                      ✅ **PR Artifacts Cleaned Up**

                      The \`.pr/\` directory has been automatically removed.
                      `;

                      const comments = await github.paginate(
                        github.rest.issues.listComments,
                        {
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: context.issue.number,
                          per_page: 100,
                        },
                      );

                      const existing = comments.find(c => c.body.includes(marker));
                      if (existing) {
                        await github.rest.issues.updateComment({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          comment_id: existing.id,
                          body: body,
                        });
                      }

  # Inspect the fork through the API; never check out untrusted code with a write token.
    check-pr-artifacts:
        if: >-
            github.event_name == 'pull_request_target' &&
            github.event.action != 'closed'
        runs-on: ubuntu-latest
        permissions:
            contents: read
            pull-requests: write
        steps:
            - name: Post or update PR comment
              uses: actions/github-script@v9
              with:
                  script: |
                      const marker = '<!-- pr-artifacts-notice -->';
                      const pullRequest = context.payload.pull_request;
                      const headRepository = pullRequest.head.repo;
                      let exists = true;

                      try {
                        await github.rest.repos.getContent({
                          owner: headRepository.owner.login,
                          repo: headRepository.name,
                          path: '.pr',
                          ref: pullRequest.head.sha,
                        });
                      } catch (error) {
                        if (error.status === 404) {
                          exists = false;
                        } else {
                          throw error;
                        }
                      }

                      const comments = await github.paginate(
                        github.rest.issues.listComments,
                        {
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: context.issue.number,
                          per_page: 100,
                        },
                      );
                      const existing = comments.find(c => c.body.includes(marker));

                      if (!exists) {
                        if (existing) {
                          await github.rest.issues.updateComment({
                            owner: context.repo.owner,
                            repo: context.repo.repo,
                            comment_id: existing.id,
                            body: `${marker}
                            ✅ **PR Artifacts Cleaned Up**

                            The \`.pr/\` directory is no longer present.
                            `,
                          });
                        }
                        return;
                      }

                      const isFork = headRepository.full_name !== context.payload.repository.full_name;
                      const cleanup = isFork
                        ? 'Because this is a fork PR, the workflow will **open or update a cleanup PR against `main` after merge**.'
                        : 'The directory will be **automatically removed when the PR is approved**.';
                      const body = `${marker}
                      📁 **PR Artifacts Notice**

                      This PR contains a \`.pr/\` directory with temporary PR-specific documents. ${cleanup}
                      `;

                      core.warning('.pr/ directory contains temporary PR-only artifacts');
                      if (existing) {
                        await github.rest.issues.updateComment({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          comment_id: existing.id,
                          body: body,
                        });
                      } else {
                        await github.rest.issues.createComment({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: context.issue.number,
                          body: body,
                        });
                      }

  # Fork branches cannot be modified reliably. If artifacts reach the trusted base,
  # remove them through a pull request so branch protections remain enforced.
    cleanup-after-merge:
        concurrency:
            group: cleanup-pr-artifacts-${{ github.event.pull_request.base.ref }}
            cancel-in-progress: false
        if: >-
            github.event_name == 'pull_request_target' &&
            github.event.action == 'closed' &&
            github.event.pull_request.merged == true
        runs-on: ubuntu-latest
        permissions:
            contents: write
            pull-requests: write
        steps:
            - uses: actions/checkout@v7
              with:
                  ref: ${{ github.event.pull_request.base.ref }}
                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}

            - name: Create or update cleanup PR
              id: cleanup
              env:
                  BASE_REF: ${{ github.event.pull_request.base.ref }}
                  CLEANUP_BRANCH: automation/remove-pr-artifacts
                  GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
              run: |
                  if [ ! -d ".pr" ]; then
                    echo "created=false" >> "$GITHUB_OUTPUT"
                    echo "::notice::No .pr/ directory to remove from $BASE_REF"
                    exit 0
                  fi

                  git config user.name "allhands-bot"
                  git config user.email "allhands-bot@users.noreply.github.com"
                  git fetch origin \
                    "+refs/heads/$CLEANUP_BRANCH:refs/remotes/origin/$CLEANUP_BRANCH" || true
                  git checkout -B "$CLEANUP_BRANCH"
                  git rm -rf .pr/
                  git commit \
                    -m "chore: remove merged PR artifacts" \
                    -m "Co-authored-by: openhands <openhands@all-hands.dev>"
                  git push --force-with-lease origin "HEAD:$CLEANUP_BRANCH"

                  cleanup_pr_url=$(gh pr list \
                    --base "$BASE_REF" \
                    --head "$CLEANUP_BRANCH" \
                    --state open \
                    --json url \
                    --jq '.[0].url')

                  if [ -z "$cleanup_pr_url" ]; then
                    cleanup_pr_url=$(gh pr create \
                      --base "$BASE_REF" \
                      --head "$CLEANUP_BRANCH" \
                      --title "chore: remove merged PR artifacts" \
                      --body-file - <<EOF
                  ## Why

                  Temporary \`.pr/\` artifacts reached \`$BASE_REF\` through one or more merged PRs.

                  ## Summary

                  - Remove the temporary \`.pr/\` directory from \`$BASE_REF\`.

                  ## How to Test

                  - Confirm this PR only deletes files under \`.pr/\`.
                  - Let the required checks validate the cleanup commit.

                  ---

                  _This PR was automatically created by the PR Artifacts workflow._
                  EOF
                    )
                  fi

                  echo "created=true" >> "$GITHUB_OUTPUT"
                  echo "pr_url=$cleanup_pr_url" >> "$GITHUB_OUTPUT"
                  echo "::notice::Cleanup PR ready: $cleanup_pr_url"

            - name: Update source PR comment
              if: steps.cleanup.outputs.created == 'true'
              uses: actions/github-script@v9
              env:
                  CLEANUP_PR_URL: ${{ steps.cleanup.outputs.pr_url }}
              with:
                  script: |
                      const marker = '<!-- pr-artifacts-notice -->';
                      const body = `${marker}
                      🧹 **PR Artifact Cleanup Queued**

                      The \`.pr/\` directory reached \`${context.payload.pull_request.base.ref}\` after merge. A cleanup PR has been opened or updated: ${process.env.CLEANUP_PR_URL}
                      `;

                      const comments = await github.paginate(
                        github.rest.issues.listComments,
                        {
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: context.issue.number,
                          per_page: 100,
                        },
                      );
                      const existing = comments.find(c => c.body.includes(marker));

                      if (existing) {
                        await github.rest.issues.updateComment({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          comment_id: existing.id,
                          body: body,
                        });
                      } else {
                        await github.rest.issues.createComment({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: context.issue.number,
                          body: body,
                        });
                      }