external-plugin-command-router.yml

name: External Plugin Command Router

on:
  issue_comment:
    types: [created]

concurrency:
  group: external-plugin-intake-${{ github.event.issue.number }}
  cancel-in-progress: false

permissions:
  contents: read
  issues: write

jobs:
  approval-command:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    if: >-
      !github.event.issue.pull_request &&
      (startsWith(github.event.comment.body, '/approve') || startsWith(github.event.comment.body, '/reject'))
    steps:
      - name: Checkout main branch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: main
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22
          cache: npm

      - name: Parse decision command
        id: parse
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const path = require('path');
            const { pathToFileURL } = require('url');

            const approval = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-approval.mjs')).href);
            const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
            const reviewBoard = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, '.github', 'extensions', 'external-plugin-review-board', 'lib', 'state.mjs')).href);
            const parsedCommand = approval.parseDecisionCommand(context.payload.comment.body);

            core.setOutput('should-run', 'false');
            if (!parsedCommand) {
              core.info('No supported external plugin approval command was found.');
              return;
            }

            const permission = await github.rest.repos.getCollaboratorPermissionLevel({
              owner: context.repo.owner,
              repo: context.repo.repo,
              username: context.payload.comment.user.login
            });

            const hasWriteAccess = ['admin', 'write', 'maintain'].includes(permission.data.permission);
            if (!hasWriteAccess) {
              core.info(`Ignoring ${parsedCommand.command} because ${context.payload.comment.user.login} does not have write access.`);
              return;
            }

            const currentIssue = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number
            });

            const labelNames = new Set((currentIssue.data.labels || []).map((label) => label.name));
            if (!labelNames.has('external-plugin')) {
              core.info('Ignoring command because the issue is not an external plugin submission.');
              return;
            }

            const evaluation = await intake.evaluateExternalPluginIssue({
              issue: currentIssue.data,
              token: process.env.GITHUB_TOKEN
            });

            const fallbackName = evaluation.plugin?.name ?? `issue-${context.issue.number}`;
            const canApprove = labelNames.has('approved') ||
              reviewBoard.isReadyForApproval([...labelNames]);
            const canReject = !labelNames.has('approved');

            if (parsedCommand.command === 'approve' && !canApprove) {
              core.info('Ignoring /approve because the issue is not ready for review.');
              return;
            }

            if (parsedCommand.command === 'reject' && !canReject) {
              core.info('Ignoring /reject because the issue is already approved.');
              return;
            }

            const reactionByCommand = {
              approve: 'eyes',
              reject: 'eyes'
            };

            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: reactionByCommand[parsedCommand.command] ?? 'eyes'
            });

            core.setOutput('should-run', 'true');
            core.setOutput('command', parsedCommand.command);
            core.setOutput('reason', parsedCommand.reason ?? '');
            core.setOutput('validation-valid', evaluation.valid ? 'true' : 'false');
            core.setOutput('validation-errors', JSON.stringify(evaluation.errors));
            core.setOutput('plugin-name', fallbackName);
            core.setOutput('plugin-slug', approval.slugifyPluginName(fallbackName));
            core.setOutput('source-repo', evaluation.plugin?.source?.repo ?? '');

      - name: Comment blocked approval
        if: steps.parse.outputs.should-run == 'true' && steps.parse.outputs.command == 'approve' && steps.parse.outputs.validation-valid != 'true'
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          VALIDATION_ERRORS: ${{ steps.parse.outputs.validation-errors }}
          PLUGIN_NAME: ${{ steps.parse.outputs.plugin-name }}
        with:
          script: |
            const marker = '<!-- external-plugin-approval-blocked -->';
            const errors = JSON.parse(process.env.VALIDATION_ERRORS || '[]');
            const body = [
              marker,
              '## ⚠️ External plugin approval blocked',
              '',
              `The current issue form for **${process.env.PLUGIN_NAME}** no longer passes automated intake validation, so \`/approve\` was not applied.`,
              '',
              '### Required fixes',
              '',
              ...(errors.length > 0 ? errors.map((error) => `- ${error}`) : ['- Edit the issue details and let intake rerun automatically, or comment `/rerun-intake` to trigger it again on demand.'])
            ].join('\n');

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              per_page: 100
            });

            const existingComment = comments.find((comment) =>
              comment.user?.login === 'github-actions[bot]' &&
              comment.body?.includes(marker)
            );

            if (existingComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingComment.id,
                body
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body
              });
            }

      - name: Install dependencies
        if: steps.parse.outputs.should-run == 'true' && steps.parse.outputs.command == 'approve' && steps.parse.outputs.validation-valid == 'true'
        run: npm ci

      - name: Update external plugin catalog and PR
        id: approval_pr
        if: steps.parse.outputs.should-run == 'true' && steps.parse.outputs.command == 'approve' && steps.parse.outputs.validation-valid == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          result=$(node ./eng/external-plugin-approval.mjs approve "$GITHUB_EVENT_PATH" --file ./plugins/external.json)
          {
            echo 'result<<EOF'
            echo "$result"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"

          plugin_name=$(node -e "const data = JSON.parse(process.argv[1]); process.stdout.write(data.plugin.name);" "$result")
          action=$(node -e "const data = JSON.parse(process.argv[1]); process.stdout.write(data.action);" "$result")
          source_repo=$(node -e "const data = JSON.parse(process.argv[1]); process.stdout.write(data.plugin.source.repo);" "$result")
          plugin_slug='${{ steps.parse.outputs.plugin-slug }}'
          issue_number='${{ github.event.issue.number }}'
          branch="automation/external-plugin-approve-${issue_number}-${plugin_slug}"

          if [ "$action" = "inserted" ]; then
            title_action="Add"
            summary_action="add"
          else
            title_action="Update"
            summary_action="update"
          fi

          npm run build
          bash eng/fix-line-endings.sh

          pr_url=""
          pr_number=""
          if git diff --quiet; then
            pr_number=$(gh pr list --head "$branch" --base main --json number --jq '.[0].number')
            if [ -n "$pr_number" ]; then
              pr_url=$(gh pr view "$pr_number" --json url --jq '.url')
            fi
            echo "changed=false" >> "$GITHUB_OUTPUT"
            echo "plugin-name=$plugin_name" >> "$GITHUB_OUTPUT"
            echo "action=$action" >> "$GITHUB_OUTPUT"
            echo "source-repo=$source_repo" >> "$GITHUB_OUTPUT"
            echo "pr-url=$pr_url" >> "$GITHUB_OUTPUT"
            echo "pr-number=$pr_number" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -B "$branch"
          git add -A
          git commit -m "${title_action} external plugin ${plugin_name}"
          git push --force-with-lease origin "$branch"

          pr_number=$(gh pr list --head "$branch" --base main --json number --jq '.[0].number')
          pr_body=$(cat <<EOF
          ## Summary

          - ${summary_action} \`${plugin_name}\` in \`plugins/external.json\`
          - regenerate marketplace outputs for the approved external plugin submission
          - source repository: \`${source_repo}\`
          - approved from #${issue_number}

          ## Validation

          - npm run build
          EOF
          )

          if [ -n "$pr_number" ]; then
            gh pr edit "$pr_number" \
              --title "[external-plugin] ${title_action} ${plugin_name}" \
              --body "$pr_body"
            pr_url=$(gh pr view "$pr_number" --json url --jq '.url')
          else
            pr_url=$(gh pr create \
              --base main \
              --head "$branch" \
              --title "[external-plugin] ${title_action} ${plugin_name}" \
              --body "$pr_body")
            pr_number=$(gh pr view "$branch" --json number --jq '.number')
          fi

          echo "changed=true" >> "$GITHUB_OUTPUT"
          echo "plugin-name=$plugin_name" >> "$GITHUB_OUTPUT"
          echo "action=$action" >> "$GITHUB_OUTPUT"
          echo "source-repo=$source_repo" >> "$GITHUB_OUTPUT"
          echo "pr-url=$pr_url" >> "$GITHUB_OUTPUT"
          echo "pr-number=$pr_number" >> "$GITHUB_OUTPUT"

      - name: Finalize approval
        if: steps.parse.outputs.should-run == 'true' && steps.parse.outputs.command == 'approve' && steps.parse.outputs.validation-valid == 'true'
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          CHANGED: ${{ steps.approval_pr.outputs.changed }}
          ACTION: ${{ steps.approval_pr.outputs.action }}
          PLUGIN_NAME: ${{ steps.approval_pr.outputs.plugin-name }}
          SOURCE_REPO: ${{ steps.approval_pr.outputs.source-repo }}
          PR_URL: ${{ steps.approval_pr.outputs.pr-url }}
          PR_NUMBER: ${{ steps.approval_pr.outputs.pr-number }}
        with:
          script: |
            async function removeLabel(issueNumber, name) {
              try {
                await github.rest.issues.removeLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: issueNumber,
                  name
                });
              } catch (error) {
                if (error.status !== 404) {
                  throw error;
                }
              }
            }

            async function syncIssueLabels(issueNumber, desiredLabels) {
              const managedLabels = {
                'external-plugin': true,
                'awaiting-review': true,
                'ready-for-review': true,
                'requires-submitter-fixes': true,
                'approved': true,
                'rejected': true
              };

              const currentLabels = await github.paginate(github.rest.issues.listLabelsOnIssue, {
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issueNumber,
                per_page: 100
              });

              const currentManagedLabels = currentLabels
                .map((label) => label.name)
                .filter((name) => Object.prototype.hasOwnProperty.call(managedLabels, name));

              const labelsToAdd = [...desiredLabels].filter((name) => !currentManagedLabels.includes(name));
              const labelsToRemove = currentManagedLabels.filter((name) => !desiredLabels.has(name));

              if (labelsToAdd.length > 0) {
                await github.rest.issues.addLabels({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: issueNumber,
                  labels: labelsToAdd
                });
              }

              for (const name of labelsToRemove) {
                await removeLabel(issueNumber, name);
              }
            }

            const issueNumber = context.issue.number;
            const prNumber = Number(process.env.PR_NUMBER || 0);
            const marker = '<!-- external-plugin-approval -->';
            const action = process.env.ACTION === 'updated' ? 'updated' : 'added';
            const prUrl = process.env.PR_URL;
            const body = [
              marker,
              '## ✅ External plugin approved',
              '',
              `A maintainer approved **${process.env.PLUGIN_NAME}**, and the submission issue has been closed.`,
              '',
              `- **Catalog action:** ${action}`,
              `- **Source repository:** \`${process.env.SOURCE_REPO}\``,
              prUrl
              ? `- **PR against \`main\`:** ${prUrl}`
              : '- **PR against `main`:** No new PR was needed because the approved listing is already present.'
            ].join('\n');

            await syncIssueLabels(issueNumber, new Set(['external-plugin', 'approved']));

            if (prNumber > 0) {
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: prNumber,
                labels: ['external-plugin', 'awaiting-review']
              });
            }

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: issueNumber,
              per_page: 100
            });

            const existingComment = comments.find((comment) =>
              comment.user?.login === 'github-actions[bot]' &&
              comment.body?.includes(marker)
            );

            if (existingComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingComment.id,
                body
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issueNumber,
                body
              });
            }

            if (context.payload.issue.state !== 'closed') {
              await github.rest.issues.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issueNumber,
                state: 'closed'
              });
            }

      - name: Finalize rejection
        if: steps.parse.outputs.should-run == 'true' && steps.parse.outputs.command == 'reject'
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          REASON: ${{ steps.parse.outputs.reason }}
          PLUGIN_NAME: ${{ steps.parse.outputs.plugin-name }}
        with:
          script: |
            async function removeLabel(name) {
              try {
                await github.rest.issues.removeLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: context.issue.number,
                  name
                });
              } catch (error) {
                if (error.status !== 404) {
                  throw error;
                }
              }
            }

            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: ['external-plugin', 'rejected']
            });

            await removeLabel('awaiting-review');
            await removeLabel('ready-for-review');
            await removeLabel('requires-submitter-fixes');
            await removeLabel('approved');

            const marker = '<!-- external-plugin-rejection -->';
            const reason = process.env.REASON || 'No additional reason was provided.';
            const body = [
              marker,
              '## ❌ External plugin rejected',
              '',
              `A maintainer rejected **${process.env.PLUGIN_NAME}**, and the submission issue has been closed.`,
              '',
              '### Reason',
              '',
              reason,
              '',
              'This issue is now closed and `/rerun-intake` will no longer reopen it. If you address the feedback, please open a new external plugin submission issue.'
            ].join('\n');

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              per_page: 100
            });

            const existingComment = comments.find((comment) =>
              comment.user?.login === 'github-actions[bot]' &&
              comment.body?.includes(marker)
            );

            if (existingComment) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existingComment.id,
                body
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body
              });
            }

            if (context.payload.issue.state !== 'closed') {
              await github.rest.issues.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                state: 'closed'
              });
            }

  mark-ready-command:
    runs-on: ubuntu-latest
    if: >-
      !github.event.issue.pull_request &&
      startsWith(github.event.comment.body, '/mark-ready-for-review')
    steps:
      - name: Checkout main branch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: main

      - name: Apply explicit ready-for-review override
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const path = require('path');
            const { pathToFileURL } = require('url');

            const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
            const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);

            const parsed = intake.parseMarkReadyForReviewCommand(context.payload.comment.body);
            if (!parsed) {
              core.info('No supported /mark-ready-for-review command was found.');
              return;
            }

            const actor = context.payload.comment.user?.login;
            if (!actor || context.payload.comment.user?.type === 'Bot' || actor === 'github-actions[bot]') {
              core.info('Ignoring command from a bot or unknown actor.');
              return;
            }

            const permission = await github.rest.repos.getCollaboratorPermissionLevel({
              owner: context.repo.owner,
              repo: context.repo.repo,
              username: actor
            });
            const hasWriteAccess = ['admin', 'write', 'maintain'].includes(permission.data.permission);
            if (!hasWriteAccess) {
              core.info(`Ignoring /mark-ready-for-review because ${actor} does not have write access.`);
              return;
            }

            const { data: currentIssue } = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number
            });

            const labelNames = new Set((currentIssue.labels || []).map((label) => label.name));
            if (!labelNames.has('external-plugin')) {
              core.info('Ignoring command because issue is not an external plugin submission.');
              return;
            }

            if (labelNames.has('approved')) {
              core.info('Ignoring command because issue is already approved.');
              return;
            }

            if (!labelNames.has('requires-submitter-fixes')) {
              core.info('Ignoring command because issue is not currently blocked by submitter-fix gates.');
              return;
            }

            try {
              await github.rest.issues.getLabel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                name: 'intake-manually-overridden'
              });
            } catch (error) {
              if (error.status !== 404) throw error;
              await github.rest.issues.createLabel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                name: 'intake-manually-overridden',
                color: 'BFD4F2',
                description: 'Submission was manually moved to review without passing automated intake gates'
              });
            }

            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: '+1'
            });

            await intakeState.syncExternalPluginIntakeLabels({
              github,
              owner: context.repo.owner,
              repo: context.repo.repo,
              issueNumber: context.issue.number,
              desiredLabels: new Set([
                'external-plugin',
                'ready-for-review',
                'intake-manually-overridden',
                ...(labelNames.has('external-plugin-canvas') ? ['external-plugin-canvas'] : [])
              ])
            });

            const marker = '<!-- external-plugin-mark-ready-override -->';
            const reason = parsed.reason || 'No reason provided.';
            const body = [
              marker,
              '## ✅ External plugin manually moved to ready-for-review',
              '',
              `Maintainer **${actor}** used \`${intake.MARK_READY_FOR_REVIEW_COMMAND}\` to move this submission from \`requires-submitter-fixes\` to \`ready-for-review\`.`,
              '',
              '### Reason',
              '',
              reason
            ].join('\n');

            await intakeState.upsertExternalPluginIntakeComment({
              github,
              owner: context.repo.owner,
              repo: context.repo.repo,
              issueNumber: context.issue.number,
              marker,
              body
            });

            if (currentIssue.state === 'closed') {
              await github.rest.issues.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                state: 'open'
              });
            }

  rerun-intake-parse:
    runs-on: ubuntu-latest
    if: >-
      !github.event.issue.pull_request &&
      startsWith(github.event.comment.body, '/rerun-intake')
    outputs:
      should-run: ${{ steps.evaluate.outputs.should-run }}
      base-result: ${{ steps.evaluate.outputs.base-result }}
      valid: ${{ steps.evaluate.outputs.valid }}
      plugin-json: ${{ steps.evaluate.outputs.plugin-json }}
      issue-state: ${{ steps.evaluate.outputs.issue-state }}
      issue-labels: ${{ steps.evaluate.outputs.issue-labels }}
    steps:
      - name: Checkout main branch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: main

      - name: Validate command and evaluate intake
        id: evaluate
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          script: |
            const path = require('path');
            const { pathToFileURL } = require('url');

            const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);

            core.setOutput('should-run', 'false');

            const commentAuthor = context.payload.comment.user?.login;
            if (!commentAuthor || context.payload.comment.user?.type === 'Bot' || commentAuthor === 'github-actions[bot]') {
              core.info('Ignoring /rerun-intake from a bot or unknown actor.');
              return;
            }

            if (!intake.parseRerunIntakeCommand(context.payload.comment.body)) {
              core.info('No supported /rerun-intake command was found.');
              return;
            }

            const { data: currentIssue } = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number
            });

            const labelNames = new Set((currentIssue.labels || []).map((label) => label.name));
            const isExternalPluginIssue =
              labelNames.has('external-plugin') ||
              String(currentIssue.body || '').includes(intake.ISSUE_FORM_MARKER);
            if (!isExternalPluginIssue) {
              core.info('Ignoring /rerun-intake because the issue is not an external plugin submission.');
              return;
            }

            if (labelNames.has('approved') || labelNames.has('re-review-due') || labelNames.has('re-review-follow-up')) {
              core.info('Ignoring /rerun-intake because the issue is already approved or in the six-month re-review flow.');
              return;
            }

            const issueAuthor = currentIssue.user?.login;
            const isIssueAuthor = Boolean(issueAuthor && commentAuthor === issueAuthor);

            let hasWriteAccess = false;
            if (!isIssueAuthor) {
              const permission = await github.rest.repos.getCollaboratorPermissionLevel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: commentAuthor
              });
              hasWriteAccess = ['admin', 'write', 'maintain'].includes(permission.data.permission);
            }

            if (!isIssueAuthor && !hasWriteAccess) {
              core.info(`Ignoring /rerun-intake because ${commentAuthor} is neither the issue author nor a maintainer.`);
              return;
            }

            if (labelNames.has('rejected')) {
              core.info('Ignoring /rerun-intake because the issue was rejected by a maintainer.');
              const marker = '<!-- external-plugin-rerun-rejected -->';
              const body = [
                marker,
                '`/rerun-intake` cannot reopen a maintainer-rejected submission.',
                '',
                'This issue was rejected and closed, so it is no longer eligible for another intake pass. If you believe the concerns raised in the rejection have been fully addressed, please open a new external plugin submission issue instead.'
              ].join('\n');
              const { data: comments } = await github.rest.issues.listComments({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                per_page: 100
              });
              const existingComment = comments.find((comment) =>
                comment.user?.login === 'github-actions[bot]' &&
                comment.body?.includes(marker)
              );
              if (existingComment) {
                await github.rest.issues.updateComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  comment_id: existingComment.id,
                  body
                });
              } else {
                await github.rest.issues.createComment({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: context.issue.number,
                  body
                });
              }
              return;
            }

            if (currentIssue.state !== 'open') {
              core.info('Ignoring /rerun-intake because the issue is closed.');
              return;
            }

            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: 'eyes'
            });

            const baseResult = await intake.evaluateExternalPluginIssue({
              issue: currentIssue,
              token: process.env.GITHUB_TOKEN,
              runId: context.runId,
              owner: context.repo.owner,
              repo: context.repo.repo
            });

            core.setOutput('should-run', 'true');
            core.setOutput('base-result', JSON.stringify(baseResult));
            core.setOutput('valid', baseResult.valid ? 'true' : 'false');
            core.setOutput('plugin-json', JSON.stringify(baseResult.plugin || {}));
            core.setOutput('issue-state', currentIssue.state);
            core.setOutput('issue-labels', JSON.stringify([...labelNames]));

  rerun-intake-quality-gates:
    needs: rerun-intake-parse
    if: >-
      needs.rerun-intake-parse.outputs.should-run == 'true' &&
      needs.rerun-intake-parse.outputs.valid == 'true'
    uses: ./.github/workflows/external-plugin-quality-gates.yml
    with:
      plugin-json: ${{ needs.rerun-intake-parse.outputs.plugin-json }}

  rerun-intake-apply-state:
    runs-on: ubuntu-latest
    needs: [rerun-intake-parse, rerun-intake-quality-gates]
    if: always() && needs.rerun-intake-parse.outputs.should-run == 'true'
    steps:
      - name: Checkout main branch
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: main

      - name: Apply merged intake evaluation
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          BASE_RESULT_JSON: ${{ needs.rerun-intake-parse.outputs.base-result }}
          BASE_VALID: ${{ needs.rerun-intake-parse.outputs.valid }}
          QUALITY_RESULT_JSON: ${{ needs.rerun-intake-quality-gates.outputs.quality-result }}
          QUALITY_LOG_URL: ${{ needs.rerun-intake-quality-gates.outputs.quality-log-url }}
          QUALITY_JOB_RESULT: ${{ needs.rerun-intake-quality-gates.result }}
          ISSUE_STATE: ${{ needs.rerun-intake-parse.outputs.issue-state }}
          ISSUE_LABELS: ${{ needs.rerun-intake-parse.outputs.issue-labels }}
        with:
          script: |
            const path = require('path');
            const { pathToFileURL } = require('url');

            const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
            const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);

            const baseResult = JSON.parse(process.env.BASE_RESULT_JSON);
            let finalResult = baseResult;

            if (process.env.BASE_VALID === 'true') {
              let qualityResult;
              if (process.env.QUALITY_JOB_RESULT === 'failure' || process.env.QUALITY_JOB_RESULT === 'cancelled') {
                qualityResult = {
                  overall_status: 'infra_error',
                  spec_compliance_status: 'warning',
                  vally_lint_status: 'infra_error',
                  smoke_status: 'infra_error',
                  version_match_status: 'infra_error',
                  canvas_structure_status: 'infra_error',
                  failure_class: 'infra',
                  summary: 'Quality-gate workflow failed unexpectedly. Re-run intake to retry.',
                };
              } else if (process.env.QUALITY_RESULT_JSON) {
                qualityResult = JSON.parse(process.env.QUALITY_RESULT_JSON);
              } else {
                qualityResult = {
                  overall_status: 'infra_error',
                  spec_compliance_status: 'warning',
                  vally_lint_status: 'infra_error',
                  smoke_status: 'infra_error',
                  version_match_status: 'infra_error',
                  canvas_structure_status: 'infra_error',
                  failure_class: 'infra',
                  summary: 'Quality-gate workflow did not return results. Re-run intake to retry.',
                };
              }

              finalResult = intake.applyQualityGateResult(
                baseResult,
                qualityResult,
                context.runId,
                context.repo.owner,
                context.repo.repo,
                process.env.QUALITY_LOG_URL
              );
            }

            await intakeState.applyExternalPluginIntakeEvaluation({
              github,
              owner: context.repo.owner,
              repo: context.repo.repo,
              issueNumber: context.issue.number,
              evaluation: finalResult
            });

            const issueState = process.env.ISSUE_STATE;
            const labels = new Set(JSON.parse(process.env.ISSUE_LABELS || '[]'));
            if (finalResult.intakeState === 'rejected' && issueState === 'open') {
              await github.rest.issues.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                state: 'closed'
              });
              return;
            }

            if (finalResult.intakeState !== 'rejected' && issueState === 'closed' && labels.has('rejected')) {
              await github.rest.issues.update({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                state: 'open'
              });
            }