sync-github-issues.yml

name: Sync GitHub Issues (NOAA-GSL ↔ zyra-project)

# Syncs issues between upstream (NOAA-GSL/zyra) and downstream (zyra-project/zyra).
# By default, only syncs upstream→downstream (one-way mirror).
# Bidirectional sync (downstream→upstream) requires SYNC_PAT_ORG to have write
# access to the upstream repository's issues.

on:
  schedule:
    - cron: "*/30 * * * *"     # every 30 minutes
  issues:
    types: [closed, reopened]
  workflow_dispatch:
    inputs:
      direction:
        description: "Sync direction (bidirectional requires upstream write access)"
        required: false
        default: "upstream-to-downstream"
        type: choice
        options:
          - upstream-to-downstream
          - both
          - downstream-to-upstream
      dry_run:
        description: "Dry run (no changes made)"
        required: false
        default: false
        type: boolean

permissions:
  contents: read
  issues: write

concurrency:
  group: sync-issues
  cancel-in-progress: false

env:
  UPSTREAM_OWNER: NOAA-GSL
  UPSTREAM_REPO: zyra
  DOWNSTREAM_OWNER: zyra-project
  DOWNSTREAM_REPO: zyra
  SYNC_LABEL: "upstream-sync"
  UPSTREAM_MARKER: "<!-- upstream-issue:"

jobs:
  sync-issues:
    name: Sync issues between repositories
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Sync upstream issues to downstream
        if: >-
          (github.event_name == 'schedule') ||
          (github.event_name == 'workflow_dispatch' && (github.event.inputs.direction == 'both' || github.event.inputs.direction == 'upstream-to-downstream'))
        uses: actions/github-script@v7
        env:
          ORG_TOKEN: ${{ secrets.SYNC_PAT_ORG }}
          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const upstreamOwner = process.env.UPSTREAM_OWNER;
            const upstreamRepo = process.env.UPSTREAM_REPO;
            const downstreamOwner = process.env.DOWNSTREAM_OWNER;
            const downstreamRepo = process.env.DOWNSTREAM_REPO;
            const syncLabel = process.env.SYNC_LABEL;
            const upstreamMarker = process.env.UPSTREAM_MARKER;
            const dryRun = process.env.DRY_RUN === 'true';
            const orgToken = process.env.ORG_TOKEN;

            // Helper to make authenticated requests to upstream repo
            const upstreamAuth = { authorization: `token ${orgToken}` };

            // Helper to avoid secondary rate limits (content creation velocity)
            const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));

            console.log(`🔄 Syncing issues from ${upstreamOwner}/${upstreamRepo} → ${downstreamOwner}/${downstreamRepo}`);
            if (dryRun) console.log('🧪 DRY RUN MODE - no changes will be made');

            // Fetch the 100 most recently updated issues from upstream (single page to avoid rate limits)
            const { data: upstreamIssues } = await github.request('GET /repos/{owner}/{repo}/issues', {
              owner: upstreamOwner,
              repo: upstreamRepo,
              state: 'all',
              per_page: 100,
              sort: 'updated',
              direction: 'desc',
              headers: upstreamAuth
            });

            // Filter out pull requests (they have a pull_request key)
            const issues = upstreamIssues.filter(i => !i.pull_request);
            console.log(`📋 Found ${issues.length} issues in upstream repo`);

            // Fetch existing synced issues in downstream (filter out PRs)
            const downstreamIssues = (await github.paginate(github.rest.issues.listForRepo, {
              owner: downstreamOwner,
              repo: downstreamRepo,
              state: 'all',
              labels: syncLabel,
              per_page: 100
            })).filter(i => !i.pull_request);

            // Build a map of upstream issue number → downstream issue
            const syncedMap = new Map();
            for (const di of downstreamIssues) {
              const match = di.body?.match(new RegExp(`${upstreamMarker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*(\\d+)\\s*-->`));
              if (match) {
                syncedMap.set(parseInt(match[1], 10), di);
              }
            }
            console.log(`📍 Found ${syncedMap.size} already-synced issues in downstream`);

            let created = 0, updated = 0, skipped = 0;

            for (const upIssue of issues) {
              const upNum = upIssue.number;
              const existingDown = syncedMap.get(upNum);

              if (existingDown) {
                // Check if update needed
                const needsUpdate =
                  existingDown.state !== upIssue.state ||
                  existingDown.title !== upIssue.title;

                if (needsUpdate) {
                  console.log(`🔄 Updating downstream #${existingDown.number} from upstream #${upNum}`);
                  if (!dryRun) {
                    await github.rest.issues.update({
                      owner: downstreamOwner,
                      repo: downstreamRepo,
                      issue_number: existingDown.number,
                      title: upIssue.title,
                      state: upIssue.state
                    });
                    // Delay to avoid secondary rate limits
                    await sleep(1000);
                  }
                  updated++;
                } else {
                  skipped++;
                }
              } else {
                // Create new synced issue
                console.log(`➕ Creating downstream issue for upstream #${upNum}: "${upIssue.title}"`);

                // Build the synced issue body
                const upstreamLink = `https://github.com/${upstreamOwner}/${upstreamRepo}/issues/${upNum}`;
                const syncHeader = `> 🔗 **Synced from upstream:** [${upstreamOwner}/${upstreamRepo}#${upNum}](${upstreamLink})\n>\n> _This issue is mirrored from the upstream repository. Status changes here will be synced back._\n\n${upstreamMarker} ${upNum} -->\n\n---\n\n`;
                const syncedBody = syncHeader + (upIssue.body || '_No description provided._');

                // Map upstream labels (exclude some internal ones)
                const upLabels = upIssue.labels
                  .map(l => typeof l === 'string' ? l : l.name)
                  .filter(l => !['good first issue', 'help wanted'].includes(l));
                const labels = [syncLabel, ...upLabels];

                if (!dryRun) {
                  try {
                    await github.rest.issues.create({
                      owner: downstreamOwner,
                      repo: downstreamRepo,
                      title: upIssue.title,
                      body: syncedBody,
                      labels: labels
                    });
                    created++;
                    // Delay to avoid secondary rate limits
                    await sleep(2000);
                  } catch (err) {
                    // Only retry without labels on 422 validation errors (label doesn't exist)
                    if (err.status === 422) {
                      console.log(`⚠️ Label validation failed, retrying with sync label only: ${err.message}`);
                      try {
                        await github.rest.issues.create({
                          owner: downstreamOwner,
                          repo: downstreamRepo,
                          title: upIssue.title,
                          body: syncedBody,
                          labels: [syncLabel]
                        });
                        created++;
                        // Delay to avoid secondary rate limits
                        await sleep(2000);
                      } catch (retryErr) {
                        if (retryErr.status === 422) {
                          console.log(`❌ The '${syncLabel}' label does not exist. Please create it first:`);
                          console.log(`   gh label create "${syncLabel}" --repo ${downstreamOwner}/${downstreamRepo} --description "Issue mirrored from upstream" --color "1d76db"`);
                          throw new Error(`Missing required label '${syncLabel}'. Create it manually and re-run the workflow.`);
                        }
                        throw retryErr;
                      }
                    } else {
                      throw err;
                    }
                  }
                } else {
                  created++;
                }
              }
            }

            console.log(`\n✅ Upstream → Downstream sync complete:`);
            console.log(`   Created: ${created}, Updated: ${updated}, Skipped: ${skipped}`);

      - name: Sync downstream status changes to upstream
        if: >-
          (github.event_name == 'issues' && contains(fromJSON('["closed", "reopened"]'), github.event.action)) ||
          (github.event_name == 'workflow_dispatch' && (github.event.inputs.direction == 'both' || github.event.inputs.direction == 'downstream-to-upstream'))
        uses: actions/github-script@v7
        env:
          ORG_TOKEN: ${{ secrets.SYNC_PAT_ORG }}
          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const upstreamOwner = process.env.UPSTREAM_OWNER;
            const upstreamRepo = process.env.UPSTREAM_REPO;
            const downstreamOwner = process.env.DOWNSTREAM_OWNER;
            const downstreamRepo = process.env.DOWNSTREAM_REPO;
            const syncLabel = process.env.SYNC_LABEL;
            const upstreamMarker = process.env.UPSTREAM_MARKER;
            const dryRun = process.env.DRY_RUN === 'true';
            const orgToken = process.env.ORG_TOKEN;

            // Helper to make authenticated requests to upstream repo
            const upstreamAuth = { authorization: `token ${orgToken}` };

            // Helper to avoid secondary rate limits (content creation velocity)
            const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));

            // If triggered by an issue event, only process that issue
            if (context.eventName === 'issues') {
              const issue = context.payload.issue;
              const action = context.payload.action;

              // Check if this is a synced issue
              if (!issue.labels?.some(l => (typeof l === 'string' ? l : l.name) === syncLabel)) {
                console.log('📌 Issue does not have sync label, skipping');
                return;
              }

              // Security: verify issue was created by the sync bot (prevents forged markers)
              if (issue.user?.login !== 'github-actions[bot]') {
                console.log(`📌 Issue author '${issue.user?.login}' is not github-actions[bot], skipping for security`);
                return;
              }

              // Extract upstream issue number from body
              const match = issue.body?.match(new RegExp(`${upstreamMarker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*(\\d+)\\s*-->`));
              if (!match) {
                console.log('📌 Could not find upstream issue marker in body, skipping');
                return;
              }

              const upstreamNum = parseInt(match[1], 10);
              const newState = action === 'closed' ? 'closed' : 'open';

              // Skip if triggered by github-actions bot (prevents loop from upstream sync)
              const actor = context.payload.sender?.login;
              if (actor === 'github-actions[bot]') {
                console.log('📌 Action triggered by github-actions[bot], skipping to prevent loop');
                return;
              }

              // Fetch upstream issue to check if state already matches
              const { data: upstreamIssue } = await github.request('GET /repos/{owner}/{repo}/issues/{issue_number}', {
                owner: upstreamOwner,
                repo: upstreamRepo,
                issue_number: upstreamNum,
                headers: upstreamAuth
              });

              // Security: verify upstream reference is an issue, not a PR
              if (upstreamIssue.pull_request) {
                console.log(`📌 Upstream #${upstreamNum} is a pull request, skipping`);
                return;
              }

              if (upstreamIssue.state === newState) {
                console.log(`📌 Upstream #${upstreamNum} already ${newState}, skipping`);
                return;
              }

              console.log(`🔄 Syncing status change: downstream #${issue.number} (${action}) → upstream #${upstreamNum}`);

              if (!dryRun) {
                // Update upstream issue state
                await github.request('PATCH /repos/{owner}/{repo}/issues/{issue_number}', {
                  owner: upstreamOwner,
                  repo: upstreamRepo,
                  issue_number: upstreamNum,
                  state: newState,
                  headers: upstreamAuth
                });
                // Delay to avoid secondary rate limits
                await sleep(1000);

                // Add a comment to upstream issue
                const downstreamLink = `https://github.com/${downstreamOwner}/${downstreamRepo}/issues/${issue.number}`;
                await github.request('POST /repos/{owner}/{repo}/issues/{issue_number}/comments', {
                  owner: upstreamOwner,
                  repo: upstreamRepo,
                  issue_number: upstreamNum,
                  body: `🔄 Issue ${action} via downstream mirror: [${downstreamOwner}/${downstreamRepo}#${issue.number}](${downstreamLink})`,
                  headers: upstreamAuth
                });
              }

              console.log(`✅ Upstream issue #${upstreamNum} state updated to: ${newState}`);
              return;
            }

            // Manual/scheduled downstream-to-upstream sync: check for status mismatches
            console.log(`🔄 Checking for status mismatches (downstream → upstream)`);
            if (dryRun) console.log('🧪 DRY RUN MODE - no changes will be made');

            const downstreamIssues = (await github.paginate(github.rest.issues.listForRepo, {
              owner: downstreamOwner,
              repo: downstreamRepo,
              state: 'all',
              labels: syncLabel,
              per_page: 100
            })).filter(i => !i.pull_request);

            let synced = 0;
            for (const di of downstreamIssues) {
              const match = di.body?.match(new RegExp(`${upstreamMarker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*(\\d+)\\s*-->`));
              if (!match) continue;

              const upNum = parseInt(match[1], 10);

              let upIssue;
              try {
                const { data } = await github.request('GET /repos/{owner}/{repo}/issues/{issue_number}', {
                  owner: upstreamOwner,
                  repo: upstreamRepo,
                  issue_number: upNum,
                  headers: upstreamAuth
                });
                upIssue = data;
              } catch (err) {
                console.log(`⚠️ Could not fetch upstream #${upNum}: ${err.message}`);
                continue;
              }

              if (di.state !== upIssue.state) {
                console.log(`🔄 Status mismatch: downstream #${di.number} is ${di.state}, upstream #${upNum} is ${upIssue.state}`);
                // Downstream state takes precedence in this direction
                if (!dryRun) {
                  try {
                    await github.request('PATCH /repos/{owner}/{repo}/issues/{issue_number}', {
                      owner: upstreamOwner,
                      repo: upstreamRepo,
                      issue_number: upNum,
                      state: di.state,
                      headers: upstreamAuth
                    });
                    // Delay to avoid secondary rate limits
                    await sleep(1000);
                    synced++;
                  } catch (err) {
                    console.log(`⚠️ Could not update upstream #${upNum}: ${err.message}`);
                    console.log(`   (This usually means SYNC_PAT_ORG lacks write access to ${upstreamOwner}/${upstreamRepo})`);
                  }
                } else {
                  synced++;
                }
              }
            }

            console.log(`✅ Downstream → Upstream sync complete: ${synced} issues updated`);

      - name: Summary
        if: always()
        run: |
          echo "Issue sync completed at $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
          echo "Event: ${{ github.event_name }}"
          echo "Direction: ${{ github.event.inputs.direction || 'auto' }}"