chore: import upstream snapshot with attribution

2026-07-13 12:23:53 +08:00
commit b3a7f98e5a
3020 changed files with 935484 additions and 0 deletions
@@ -0,0 +1,244 @@
+# Mirrors an issue's triage state onto the "Auto-Triage" Projects v2 board.
+#
+# Reactive and decoupled from the triage bot: it watches label changes and,
+# whenever a `bot:repro` (trigger) or `triage/*` (state) label is added or
+# removed, recomputes the issue's canonical triage state from its CURRENT
+# labels and sets the board's "Triage State" single-select field. The triage
+# workflows just move labels as they always have; this never writes back to
+# them.
+#
+# It also keeps board membership in sync with the issue's open/closed state:
+# closing an issue ARCHIVES its card (it leaves the active board views but
+# stays recoverable in the project's archive, since triage is done once the
+# issue is closed); reopening unarchives and re-syncs it if it still carries
+# triage labels.
+#
+# Auth: mints an emdashbot App installation token (same APP_ID / APP_PRIVATE_KEY
+# secrets the other bot workflows use). The App needs organization "Projects:
+# Read and write" for the project mutations.
+
+name: Triage project sync
+
+on:
+  issues:
+    types: [labeled, unlabeled, closed, reopened]
+  workflow_dispatch: # one-shot backfill of issues already carrying triage labels
+
+concurrency:
+  # Serialize per issue so rapid reproducing -> reproduced transitions don't race.
+  group: triage-project-sync-${{ github.event.issue.number || github.run_id }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    # Skip PRs (issues.labeled fires for PRs too); always run the manual backfill.
+    if: github.event_name == 'workflow_dispatch' || github.event.issue.pull_request == null
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          # owner + repositories: org-scoped for Projects, but limited to this
+          # one repo. permission-*: least privilege, just what the sync needs
+          # (org Projects write; issues read for the workflow_dispatch backfill).
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-organization-projects: write
+          permission-issues: read
+
+      - name: Sync triage state to project
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const PROJECT_NUMBER = 3;
+            const FIELD_NAME = "Triage State";
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Triage label -> board option name.
+            const STATE_BY_LABEL = {
+              "bot:repro": "Queued",
+              "triage/reproducing": "Reproducing",
+              "triage/reproduced": "Reproduced",
+              "triage/by-design": "By design",
+              "triage/awaiting-reporter": "Awaiting reporter",
+              "triage/verified": "Verified",
+              "triage/not-reproduced": "Not reproduced",
+              "triage/failed": "Failed",
+              "triage/skipped": "Skipped",
+            };
+            // When several are present, the most advanced/terminal one wins.
+            const PRECEDENCE = [
+              "triage/verified",
+              "triage/awaiting-reporter",
+              "triage/reproduced",
+              "triage/by-design",
+              "triage/not-reproduced",
+              "triage/failed",
+              "triage/skipped",
+              "triage/reproducing",
+              "bot:repro",
+            ];
+            const pickState = (labels) => {
+              for (const l of PRECEDENCE) if (labels.includes(l)) return STATE_BY_LABEL[l];
+              return null;
+            };
+            const labelNames = (iss) =>
+              (iss.labels || []).map((l) => (typeof l === "string" ? l : l.name));
+
+            // Resolve the project, the single-select field, and its options.
+            const projData = await github.graphql(
+              `query($owner:String!, $num:Int!, $field:String!) {
+                organization(login:$owner) {
+                  projectV2(number:$num) {
+                    id
+                    field(name:$field) {
+                      ... on ProjectV2SingleSelectField { id options { id name } }
+                    }
+                  }
+                }
+              }`,
+              { owner, num: PROJECT_NUMBER, field: FIELD_NAME },
+            );
+            const project = projData.organization.projectV2;
+            if (!project || !project.field) {
+              core.setFailed(`Project #${PROJECT_NUMBER} or field "${FIELD_NAME}" not found`);
+              return;
+            }
+            const fieldId = project.field.id;
+            const optionId = (name) => project.field.options.find((o) => o.name === name)?.id;
+
+            // Archive an issue's card on THIS board, if present. An issue can
+            // belong to several projects; match on the project NODE ID, not the
+            // number -- Projects v2 numbers are per-owner, so a foreign project
+            // could also be #3 and a number match would target the wrong item.
+            // Archiving is reversible (unlike delete) and hides the card from
+            // active board views. Idempotent -- returns false when the issue
+            // has no card here, and re-archiving an archived item is a no-op.
+            const archiveCard = async (number) => {
+              const data = await github.graphql(
+                `query($owner:String!, $repo:String!, $number:Int!) {
+                  repository(owner:$owner, name:$repo) {
+                    issue(number:$number) {
+                      projectItems(first:100) { nodes { id project { id } } }
+                    }
+                  }
+                }`,
+                { owner, repo, number },
+              );
+              const nodes = data.repository?.issue?.projectItems?.nodes || [];
+              const item = nodes.find((n) => n.project?.id === project.id);
+              if (!item) {
+                // first:100 isn't paginated; warn if we hit the cap so a silent
+                // miss on an issue attached to 100+ projects is at least visible.
+                if (nodes.length === 100) {
+                  core.warning(`#${number}: on 100+ projects; could not confirm board membership`);
+                }
+                return false;
+              }
+              await github.graphql(
+                `mutation($project:ID!, $item:ID!) {
+                  archiveProjectV2Item(input:{ projectId:$project, itemId:$item }) { item { id } }
+                }`,
+                { project: project.id, item: item.id },
+              );
+              return true;
+            };
+
+            // Add the issue to the board (idempotent) and set its Triage State.
+            const upsertState = async (iss) => {
+              const stateName = pickState(labelNames(iss));
+              if (!stateName) {
+                core.info(`#${iss.number}: no triage label; skipping`);
+                return;
+              }
+              const optId = optionId(stateName);
+              if (!optId) {
+                core.warning(`#${iss.number}: no board option named "${stateName}"`);
+                return;
+              }
+              // Idempotent: returns the existing item if the issue is already added.
+              const added = await github.graphql(
+                `mutation($project:ID!, $content:ID!) {
+                  addProjectV2ItemById(input:{projectId:$project, contentId:$content}) { item { id } }
+                }`,
+                { project: project.id, content: iss.node_id },
+              );
+              const itemId = added.addProjectV2ItemById.item.id;
+              // addProjectV2ItemById returns an EXISTING item as-is -- including
+              // when it was archived on close -- so unarchive to bring a
+              // reopened issue's card back onto the active board. No-op for
+              // items that are already active.
+              await github.graphql(
+                `mutation($project:ID!, $item:ID!) {
+                  unarchiveProjectV2Item(input:{ projectId:$project, itemId:$item }) { item { id } }
+                }`,
+                { project: project.id, item: itemId },
+              );
+              await github.graphql(
+                `mutation($project:ID!, $item:ID!, $field:ID!, $opt:String!) {
+                  updateProjectV2ItemFieldValue(input:{
+                    projectId:$project, itemId:$item, fieldId:$field,
+                    value:{ singleSelectOptionId:$opt }
+                  }) { projectV2Item { id } }
+                }`,
+                { project: project.id, item: itemId, field: fieldId, opt: optId },
+              );
+              core.info(`#${iss.number} -> ${stateName}`);
+            };
+
+            // Build the work list.
+            let issues = [];
+            if (context.eventName === "workflow_dispatch") {
+              const all = await github.paginate(github.rest.issues.listForRepo, {
+                owner,
+                repo,
+                state: "all",
+                per_page: 100,
+              });
+              issues = all.filter(
+                (iss) =>
+                  !iss.pull_request &&
+                  labelNames(iss).some((l) => l === "bot:repro" || l.startsWith("triage/")),
+              );
+            } else {
+              const iss = context.payload.issue;
+              if (!iss || iss.pull_request) return;
+              issues = [iss];
+            }
+
+            // Per-issue try/catch so the bulk backfill reconciles every issue
+            // even if one fails (e.g. a transient GraphQL error). Single-issue
+            // event runs still fail loudly via setFailed below, since the next
+            // event would otherwise be the only chance to recover.
+            let failures = 0;
+            for (const iss of issues) {
+              try {
+                // Closed issues never belong on the board: triage is finished
+                // once the issue is closed (however it was closed). Handling it
+                // here -- rather than only on the `closed` event -- means label
+                // changes on an already-closed issue, and the dispatch backfill,
+                // also reconcile, so the board self-heals to "open triaged
+                // issues only". Reopening hits the else-branch with state "open"
+                // and is re-added below if it still carries triage labels.
+                if ((iss.state || "").toLowerCase() === "closed") {
+                  const archived = await archiveCard(iss.number);
+                  core.info(`#${iss.number}: closed; ${archived ? "archived" : "not on board"}`);
+                  continue;
+                }
+                await upsertState(iss);
+              } catch (e) {
+                failures++;
+                core.warning(`#${iss.number}: sync failed: ${e.message}`);
+              }
+            }
+            if (failures > 0 && context.eventName !== "workflow_dispatch") {
+              core.setFailed(`${failures} issue(s) failed to sync`);
+            }