copilot-maintenance.yml

---
name: Copilot Maintenance

on:
  schedule:
    - cron: "0 2 * * *"  # Daily at 2:00 AM UTC
  workflow_dispatch:
    inputs:
      delete_branches:
        description: 'Delete branches (if false, only preview)'
        required: false
        type: boolean
        default: false
      max_branches:
        description: 'Maximum number of branches to delete'
        required: false
        type: number
        default: 10

permissions:
  contents: write

jobs:
  delete-old-copilot-branches:
    name: Delete Old Copilot Branches
    runs-on: ubuntu-latest
    if: github.repository == 'github/gh-aw'
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        # v4.2.2
        with:
          fetch-depth: 0  # Fetch all history for all branches
          persist-credentials: true  # Required for git push operations

      - name: Setup Scripts
        uses: ./actions/setup

      - name: Check admin permissions
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        env:
          GH_AW_REQUIRED_ROLES: "admin"
        with:
          script: |
            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
            setupGlobals(core, github, context, exec, io, getOctokit);
            const { checkRepositoryPermission } = require('${{ runner.temp }}/gh-aw/actions/check_permissions_utils.cjs');
            
            const actor = context.actor;
            const { owner, repo } = context.repo;
            
            // Only check permissions for workflow_dispatch events (manual triggers)
            // Schedule events are trusted
            if (context.eventName === 'workflow_dispatch') {
              core.info(`Checking if user '${actor}' has admin permissions for branch deletion`);
              
              const result = await checkRepositoryPermission(actor, owner, repo, ['admin']);
              
              if (result.error) {
                core.setFailed(`Permission check failed: ${result.error}`);
                return;
              }
              
              if (!result.authorized) {
                core.setFailed(`Access denied: Only repository administrators can delete branches. User '${actor}' has '${result.permission}' permission but requires 'admin'.`);
                return;
              }
              
              core.info(`✅ User '${actor}' has admin access - authorized to delete branches`);
            } else {
              core.info(`✅ Scheduled event - permission check skipped`);
            }

      - name: Run copilot branch cleanup script
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MAX_BRANCHES: ${{ github.event.inputs.max_branches || '10' }}
        run: |
          echo "Running copilot branch cleanup script..."
          ./scripts/delete-old-copilot-branches.sh

      - name: Execute deletion commands
        if: github.event.inputs.delete_branches == 'true' || github.event_name == 'schedule'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MAX_BRANCHES: ${{ github.event.inputs.max_branches || '10' }}
        run: |
          echo "Executing deletion commands..."
          ./scripts/delete-old-copilot-branches.sh | \
            grep "git push origin --delete copilot/" | \
            while read -r cmd; do
              echo "Executing: $cmd"
              eval "$cmd" || \
                echo "Failed to delete branch (may already be deleted)"
            done
          echo "✓ Copilot branch cleanup completed"

      - name: Preview mode notice
        if: github.event.inputs.delete_branches != 'true' && github.event_name != 'schedule'
        run: |
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo "⚠️  PREVIEW MODE - No branches were deleted"
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
          echo ""
          echo "To delete branches, re-run this workflow with:"
          echo "  delete_branches: true"
          echo ""
          echo "See the 'Run copilot branch cleanup script' step"
          echo "for the list of branches that would be deleted."
          echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"