ci-feedback-events.yml

name: CI feedback

on:
  # Trusted publisher reads completed-run metadata only; source-run code and
  # artifacts are never executed. Its code is fixed by the reviewed caller/ref.
  workflow_run: # zizmor: ignore[dangerous-triggers]
    workflows: ["codeql", "dependabot-projection-convergence", "gds-ci", "platforms", "gds-release-bundle"]
    types: [completed]

permissions: {}

concurrency:
  group: ci-feedback-events-${{ github.repository_id }}-${{ github.run_id }}
  cancel-in-progress: false

jobs:
  feedback:
    if: ${{ contains(fromJSON('["failure","timed_out","action_required","stale","startup_failure","cancelled"]'), github.event.workflow_run.conclusion) }}
    permissions:
      actions: read # Read exact completed run and job metadata.
      issues: write # Publish bounded failure evidence in this repository.
    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # commit:a7b90bdf1ac12465cbd07072e3360442cfc8eec6
    with:
      run-id: ${{ format('{0}', github.event.workflow_run.id) }}
      run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}