# Example: thin caller for the reddb-io/red-skills AFK Actions lane
#
# Copy this file into your repo at
# `.github/workflows/rs-afk-attempt.yml` (the `rs-*`
# installed-name convention — only the filename changes; the `uses:` ref
# below keeps the `reusable-` source name), then edit:
#   1. `allowlist_authors` and `allowlist_label_actors` — the GitHub
#      logins whose issues + label-applications you trust to drive an
#      autonomous run. Adopters: keep these short. Public repos: lean
#      toward 0 or 1 entry (you and your automation bot only).
#   2. `runner` — defaults to `opencode` (the third runner, ADR 0059).
#   3. The `secrets:` block — wire whichever of the three API-key
#      secrets your org provisions. The env-precedence resolver in
#      `opencode-env.ts` picks the first set; the others are ignored.
#
# This file calls the published reusable workflow
# `reddb-io/red-skills/.github/workflows/reusable-afk-attempt.yml@v1` and
# is the only piece of YAML your repo needs to enable the AFK Actions
# lane. The reusable itself also auto-triggers on `issues: labeled`
# when this caller does NOT route through it (e.g. an external
# automation applies `ready-for-agent` directly), so the trigger
# surface is covered from both sides.
#
# If you don't want this caller to exist at all (i.e. you only want
# auto-trigger), you don't need this file: install
# `reddb-io/red-skills/.github/workflows/reusable-afk-attempt.yml@v1`
# directly into your `.github/workflows/` and edit the
# `allowlist_*` inputs there. The `if:` gate on that workflow
# filters to the `ready-for-agent` label automatically.
#
# Trust gate: rigorous by default. The reusable refuses to claim an
# issue whose author (`issue.user.login`) is NOT in
# `allowlist_authors` OR whose label-applier (`sender.login` from the
# labeled event) is NOT in `allowlist_label_actors`. Both checks
# pass → claim proceeds. Either fails → logged, no claim, no PR.
# (See #621 for the runtime predicate; the gh-script in the reusable
# is the source of truth.)
#
# Permission scope (recommended minimum): contents: write, issues:
# write, pull-requests: write. No id-token (no OIDC), no actions:
# write (the workflow does not publish actions).

name: rs-afk-attempt

on:
  # Manual trigger from the Actions UI; the reusable's `if:` filter
  # also auto-triggers on `issues: labeled` regardless of whether
  # this caller exists.
  workflow_dispatch:
    inputs:
      issue_number:
        description: "Issue number to process (e.g. 631). Leave EMPTY to auto-pick the oldest open ready-for-agent issue."
        required: false
        type: string
        default: ""

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  # A reusable workflow is invoked at the JOB level via `uses:` (NOT as a step) —
  # `with:`/`secrets:` are siblings of `uses:`, and the job has no `runs-on`/`steps`.
  attempt:
    uses: reddb-io/red-skills/.github/workflows/reusable-afk-attempt.yml@v1
    with:
      issue_number: ${{ inputs.issue_number }}
      runner: opencode
      enforce_trust_gate: "true"
      allowlist_authors: "filipeforattini"          # EDIT — your trusted author logins
      allowlist_label_actors: "filipeforattini"     # EDIT — your trusted label-applier logins
    secrets:
      openrouter_api_key: ${{ secrets.OPENROUTER_API_KEY }}
      minimax_api_key:    ${{ secrets.MINIMAX_API_KEY }}
      openai_api_key:     ${{ secrets.OPENAI_API_KEY }}