name: Advanced-search change reminder

on:
  # pull_request (not pull_request_target) — fork PRs get a read-only
  # token, so the label call 403s; the script catches that and stays
  # green (the original comment claimed the 403 was silent, but nothing
  # caught it, so fork PRs got a red check — e.g. #4872). Intentional
  # no-op on forks: the advisory label is only meaningful for
  # internal-branch PRs anyway.
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - 'src/local_deep_research/advanced_search_system/**'

# No concurrency group — intentionally omitted.
# Previous attempt (#3554, reverted #3599) used cancel-in-progress which
# killed in-progress PR runs before they produced useful results.
# Future iteration could safely add concurrency for scheduled/push-only
# triggers (where head_ref is empty and runs get unique groups).

permissions: {}  # Minimal top-level for OSSF Scorecard Token-Permissions

jobs:
  label:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      pull-requests: write
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - name: Apply benchmark-needed label
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      with:
        script: |
          // Advisory only — asks reviewers to consider running
          // src/local_deep_research/benchmarks/compare_configurations()
          // before merging changes that can affect research quality.
          // The label's description (set on the label itself in repo
          // settings) carries the reminder text so reviewers see it
          // on hover without needing an inline comment.
          try {
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['benchmark-needed']
            });
          } catch (err) {
            // Fork PRs get a read-only token — the call 403s ("Resource
            // not accessible by integration"). Advisory label only, so
            // log and stay green (same pattern as pr-triage.yml).
            if (err.status !== 403) throw err;
            console.log('Label call returned 403 (read-only fork token). Skipping.');
          }