release-beat.yml

# Release beat watchdog (#1209, second half). The daily release is a timer on a workstation: when that
# box is offline at 02:00 Asia/Shanghai, DSH runs only the latest missed occurrence, so the beat is gone
# and nothing anywhere says so. This job is the outside observer. Its metric is the newest `v*` **tag**,
# never a workflow run: release.yml triggers on `push: tags: ['v*']` and has no cron, so a missing tag
# produces no run at all and "the last run was green" would watch nothing.
#
# One issue per day (`Release beat missing: <CST date>`): the day is searched first, open or closed, and
# an existing alert is reported in the summary instead of filing a second one. A `Release v...` pull
# request still open means a release is in flight, so that day gets a summary line and no issue — slow CI
# is not a missed beat. An API failure goes red without filing, so a GitHub hiccup cannot leave a false
# alert behind. Nothing here touches release.yml or the release process itself.

name: Release beat

on:
  schedule:
    - cron: "30 18 * * *" # daily 02:30 Asia/Shanghai (the previous day's 18:30 UTC)
  workflow_dispatch:
    inputs:
      date:
        description: 'Date to judge, YYYY-MM-DD (default: today in Asia/Shanghai)'
        required: false
        type: string
      dry_run:
        description: 'true: decide and write the summary, file nothing'
        required: true
        default: 'true'
        type: choice
        options:
          - 'true'
          - 'false'

permissions:
  contents: read

concurrency:
  group: release-beat
  cancel-in-progress: false

jobs:
  beat:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      issues: write
    env:
      GH_TOKEN: ${{ github.token }}
      GH_REPO: ${{ github.repository }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Decide, and file at most one alert
        env:
          BEAT_DATE: ${{ inputs.date }}
          BEAT_DRY: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || 'false' }}
        run: |
          set -euo pipefail
          args=()
          if [[ -n "${BEAT_DATE:-}" ]]; then
            [[ "$BEAT_DATE" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]] || { echo "bad date: $BEAT_DATE" >&2; exit 1; }
            args+=(--date "$BEAT_DATE")
          fi
          # A scheduled run is always a real run; only workflow_dispatch defaults to a dry run.
          if [[ "${BEAT_DRY:-false}" == "false" ]]; then args+=(--open); fi
          node .github/scripts/release-beat.mjs "${args[@]}"