deepseek-harness/.github/workflows/issue-policy.yml

name: Issue policy

on:
  pull_request:
    types: [opened, edited, synchronize, reopened, labeled, unlabeled, ready_for_review, review_requested]
  pull_request_review:
    types: [submitted]

permissions:
  contents: read
  issues: read
  pull-requests: read

jobs:
  policy:
    name: Issue policy
    runs-on: ubuntu-latest
    steps:
      - name: Check out trusted policy
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          ref: ${{ github.event.repository.default_branch }}
          persist-credentials: false
      - name: Determine policy eligibility
        id: preflight
        env:
          GITHUB_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          if [ -f .github/issue-management/selective-preflight.json ]; then
            node .github/issue-management/policy.mjs pr-preflight
          else
            node --input-type=module <<'NODE'
          import fs from 'node:fs'
          const event = JSON.parse(fs.readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))
          const automated = ['Bot', 'App'].includes(event.pull_request.user.type)
          fs.appendFileSync(process.env.GITHUB_OUTPUT, `legacy-automated=${automated}\nneeds-project=${!automated}\n`)
          console.log('Trusted policy has no selective preflight; preserving legacy policy enforcement.')
          NODE
          fi
      - name: Create Project read token
        id: app-token
        if: ${{ steps.preflight.outputs.needs-project == 'true' }}
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
        with:
          client-id: ${{ vars.DSH_ISSUE_APP_CLIENT_ID }}
          private-key: ${{ secrets.DSH_ISSUE_APP_PRIVATE_KEY }}
          owner: deepseek-harness
          repositories: deepseek-harness
          permission-issues: read
          permission-organization-projects: read
      # Re-read current state even after an exempt preflight; never replace a failure with an edit skip.
      - name: Validate pull request
        if: ${{ steps.preflight.outputs.legacy-automated != 'true' }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
          PROJECT_TOKEN: ${{ steps.app-token.outputs.token }}
        run: node .github/issue-management/policy.mjs pr