controller.yml

name: Controller (labels only)

# Phase 1 of docs/autonomous-dev.md; see docs/controller.md. A deterministic, label-only controller: no LLM,
# no secrets, only the built-in GITHUB_TOKEN. It never merges, approves, comments on or closes anything and
# never checks out or runs a PR or issue: the issue/PR text is data for a regex, the changed files are read
# through the API. Script and rules come from the default branch.
#
# DRY RUN BY DEFAULT: the `plan` job only reads (read-only token) and writes the proposed label changes to the
# job summary. The `apply` job, the only one with a write permission, runs only when the repository variable
# CONTROLLER_LIVE is exactly `true`. AGENT_PAUSE=true stops everything. Turn it off entirely: disable this
# workflow in the Actions tab or delete the file.
on:
  schedule:
    - cron: '7,37 * * * *'
  workflow_dispatch:

concurrency:
  group: controller
  cancel-in-progress: false

permissions: {}

jobs:
  plan:
    name: plan (read only)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      issues: read
      pull-requests: read
    outputs:
      live: ${{ steps.plan.outputs.live }}
      plan: ${{ steps.plan.outputs.plan }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: 24
      - id: plan
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          CONTROLLER_LIVE: ${{ vars.CONTROLLER_LIVE }}
          AGENT_PAUSE: ${{ vars.AGENT_PAUSE }}
        run: node .github/scripts/controller.mjs plan

  apply:
    name: apply labels (live only)
    needs: plan
    if: needs.plan.outputs.live == 'true' && vars.CONTROLLER_LIVE == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
        with:
          node-version: 24
      - env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          CONTROLLER_LIVE: ${{ vars.CONTROLLER_LIVE }}
          AGENT_PAUSE: ${{ vars.AGENT_PAUSE }}
          PLAN: ${{ needs.plan.outputs.plan }}
        run: node .github/scripts/controller.mjs apply