A failing main becomes an issue and a build

workflow.yaml is AWML 0.4, as it was pushed. The registry draws, checks and fits it converted to AWML 0.8.

# When the checks fail on main, the repository opens an issue saying so and starts a build of it.
# The build is the issue-to-pull-request workflow, with the same rules: a straightforward fix merges
# by itself and anything else waits for the maintainer. Main can fail even though every change was
# checked, because two changes can each pass alone and break together, or the maintainer can push
# straight to main. Everything is public, so it all sits in one scope.
#
# The repository's app adds the build label, and GitHub starts the build from that label as it
# would from a person's.
#
# The actions implementation is a last job in CI, which runs only when a check has failed on main.
# It runs none of the code it reports on: it reads the failed jobs' log through the API.
awml: "0.4"
title: A failing main becomes an issue and a build
scopes:
  - { id: public, label: "public: anyone who reads the repository", processing: any }
parts:
  - { id: fails, kind: trigger, label: "A check fails on main" }
  - { id: token, kind: connector, label: "The repository, through its own Actions token", in: public }
  - { id: app, kind: connector, label: "The repository, through its own GitHub App", in: public }
  - { id: bring, kind: code, op: bring-in, label: "Bring in the failed jobs' log", in: public }
  - { id: log, kind: context, label: "The failing checks' output", in: public }
  - { id: already, kind: code, op: sort, label: "Sort by rule: is an issue about a failing main already open?", in: public }
  - { id: note, kind: code, op: do, label: "Add this run to the open issue", in: public }
  - { id: file, kind: code, op: do, label: "Open an issue with the failing output, labelled failing-main and build", in: public }
  - { id: issue, kind: outside, label: "Comment on an issue: Allow", in: public }
  - { id: opened, kind: outside, label: "Open an issue labelled build, which starts the build: Allow", in: public }
  - { id: same, kind: comment, label: "The build is drawn at awml.io/chrismdp/issue-to-pull-request. It retries, and merges by the same rules as any other build, once CI passes" }
  - { id: once, kind: comment, label: "One open issue at a time, so a main that fails on several pushes starts one build, not one each" }
  - { id: applabel, kind: comment, label: "GitHub starts the build from a label the app adds, though not from one the Actions token adds. The app's key is a secret only this job is given" }
  - { id: trust, kind: comment, label: "Only the repository's own people and workflows can change main, so its log is the repository's own text" }
lines:
  - { from: fails, to: bring, kind: start, label: "the run" }
  - { from: token, to: bring, kind: data, label: "the failed jobs' log" }
  - { from: bring, to: log, kind: data }
  - { from: bring, to: already, kind: start }
  - { from: token, to: already, kind: data, label: "the open issues" }
  - { from: already, to: note, kind: start, label: "[open]" }
  - { from: already, to: file, kind: start, label: "[none]" }
  - { from: log, to: file, kind: data }
  - { from: note, to: issue, kind: data }
  - { from: file, to: opened, kind: data }
  - { from: opened, to: app, kind: data }
  - { from: issue, to: token, kind: data }
  - { from: same, to: opened, kind: tie }
  - { from: once, to: already, kind: tie }
  - { from: trust, to: log, kind: tie }
  - { from: applabel, to: app, kind: tie }
implementations:
  actions:
    label: GitHub Actions
    blocks:
      - { id: github, label: "GitHub: CI, issues and workflows", parts: [fails, token, app, log, issue, opened] }
      - { id: reportjob, label: "Actions job in CI: report the failure, running none of the code", platform: actions-code, parts: [bring, already, note, file] }