name: Model-policy freshness

on:
  schedule:
    - cron: '0 11 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: model-policy-freshness
  cancel-in-progress: false

jobs:
  advisory:
    runs-on: ubuntu-24.04
    timeout-minutes: 8
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
        with:
          bun-version: 1.4.2
      - name: Install dependencies
        run: bun install --frozen-lockfile
      - name: Check and publish main advisory
        if: github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MODEL_FRESHNESS_REPORT: ${{ runner.temp }}/model-policy-freshness.json
        run: bun scripts/model-policy-freshness.ts --publish
      - name: Check non-main without publication
        if: github.ref != 'refs/heads/main'
        env:
          MODEL_FRESHNESS_REPORT: ${{ runner.temp }}/model-policy-freshness.json
        run: bun scripts/model-policy-freshness.ts
      - name: Preserve evidence report
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: model-policy-freshness-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/model-policy-freshness.json
          if-no-files-found: error
          retention-days: 90