needs_response_author_reply.yml

# Clear `needs-response` after an author reply recorded by needs_response.yml.
#
# `workflow_run` executes this definition from the default branch and receives
# a write-capable token for fork-origin events. The artifact is untrusted input:
# this workflow uses it only as an opaque response ID, then fetches the comment
# or review and the current item directly from GitHub before removing a label.
# It never checks out or executes contributor-controlled code.

name: Clear Needs Response After Author Reply

on:
  workflow_run:
    workflows: ["Needs Response"]
    types: [completed]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.workflow_run.id }}
  cancel-in-progress: false

jobs:
  remove-label:
    if: >-
      github.repository == 'langchain-ai/deepagents' &&
      github.event.workflow_run.conclusion == 'success' &&
      contains(
        fromJSON('["issue_comment", "pull_request_review", "pull_request_review_comment"]'),
        github.event.workflow_run.event
      )
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      actions: read
      issues: write
      pull-requests: write

    steps:
      - name: Download response identifier
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: author-response
          path: response
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}

      - name: Verify author response and remove label
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const fs = require('fs');
            const response = JSON.parse(
              fs.readFileSync('response/author-response.json', 'utf8'),
            );
            const { owner, repo } = context.repo;

            function numberFromUrl(url, resource) {
              const match = new URL(url).pathname.match(
                new RegExp(`/${resource}/(\\d+)$`),
              );
              return match ? Number(match[1]) : undefined;
            }

            let item;
            let responseData;
            let responseTime;
            let issueNumber;

            if (response.eventName === 'issue_comment') {
              responseData = (
                await github.rest.issues.getComment({
                  owner,
                  repo,
                  comment_id: response.responseId,
                })
              ).data;
              issueNumber = numberFromUrl(responseData.issue_url, 'issues');
              responseTime = responseData.created_at;
            } else if (response.eventName === 'pull_request_review_comment') {
              responseData = (
                await github.rest.pulls.getReviewComment({
                  owner,
                  repo,
                  comment_id: response.responseId,
                })
              ).data;
              issueNumber = numberFromUrl(
                responseData.pull_request_url,
                'pulls',
              );
              responseTime = responseData.created_at;
            } else if (
              response.eventName === 'pull_request_review' &&
              Number.isInteger(response.pullNumber)
            ) {
              responseData = (
                await github.rest.pulls.getReview({
                  owner,
                  repo,
                  pull_number: response.pullNumber,
                  review_id: response.responseId,
                })
              ).data;
              issueNumber = response.pullNumber;
              responseTime = responseData.submitted_at;
            } else {
              core.warning('Ignoring an artifact with an unsupported response.');
              return;
            }

            if (!issueNumber || !responseTime) {
              core.warning('Ignoring a response with no item number or timestamp.');
              return;
            }

            item = (
              await github.rest.issues.get({
                owner,
                repo,
                issue_number: issueNumber,
              })
            ).data;

            if (
              item.state !== 'open' ||
              !item.labels.some((label) => label.name === 'needs-response') ||
              item.user.type === 'Bot' ||
              responseData.user.type === 'Bot' ||
              responseData.user.login !== item.user.login
            ) {
              console.log(`Response on #${issueNumber} is not eligible.`);
              return;
            }

            // Do not clear a label that was applied after this response. The
            // event history is the source of truth rather than the untrusted
            // artifact or a race-prone current-label-only check.
            const events = await github.paginate(github.rest.issues.listEvents, {
              owner,
              repo,
              issue_number: issueNumber,
              per_page: 100,
            });
            const latestLabelEvent = events
              .filter(
                (event) =>
                  event.event === 'labeled' &&
                  event.label?.name === 'needs-response' &&
                  event.created_at,
              )
              .sort((a, b) => Date.parse(b.created_at) - Date.parse(a.created_at))[0];

            if (!latestLabelEvent) {
              core.warning(
                `No needs-response label event found for #${issueNumber}; leaving it intact.`,
              );
              return;
            }

            if (Date.parse(responseTime) <= Date.parse(latestLabelEvent.created_at)) {
              console.log(
                `Response on #${issueNumber} predates its current needs-response label.`,
              );
              return;
            }

            try {
              await github.rest.issues.removeLabel({
                owner,
                repo,
                issue_number: issueNumber,
                name: 'needs-response',
              });
            } catch (error) {
              if (error.status !== 404) throw error;
              console.log(`needs-response was already absent from #${issueNumber}.`);
              return;
            }

            console.log(`Removed needs-response from #${issueNumber}.`);