# Triggered by rerun.yml on PR approval.
name: rerun-workflow-run
on:
  workflow_run:
    workflows: [rerun]
    types: [completed]

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.workflow_run.head_branch }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

permissions: {}

jobs:
  rerun:
    if: github.event.workflow_run.conclusion == 'success'
    runs-on: ubuntu-slim
    timeout-minutes: 5
    permissions:
      actions: write # to rerun github action workflows
    steps:
      - name: Rerun failed checks
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          RUN_ID: ${{ github.event.workflow_run.id }}
        run: |
          gh run download "$RUN_ID" -n pr_number -D /tmp/pr
          pr_number=$(cat /tmp/pr/pr_number)

          head_sha=$(gh pr view "$pr_number" --json headRefOid --jq .headRefOid)

          # Rerun failed github-actions check runs on the PR head, excluding the
          # rerun workflow itself (to prevent recursion). Always rerun "protect";
          # otherwise only rerun jobs that took <= 60s (e.g. the approval check).
          run_ids=$(
            gh api --paginate "repos/$GH_REPO/commits/$head_sha/check-runs?per_page=100" \
              --jq '.check_runs[]
                | select(.app.slug == "github-actions")
                | select(.status == "completed")
                | select(.conclusion == "failure")
                | select((.name | ascii_downcase) != "rerun")
                | select(
                    (.name | ascii_downcase) == "protect"
                    or ((.completed_at | fromdateiso8601) - (.started_at | fromdateiso8601)) <= 60
                  )
                | .html_url
                | capture("/actions/runs/(?<id>[0-9]+)").id' \
              | sort -u
          )

          for id in $run_ids; do
            echo "Rerunning https://github.com/$GH_REPO/actions/runs/$id"
            gh run rerun "$id" --failed --repo "$GH_REPO" || echo "Failed to rerun $id"
          done