mark-ready-when-ready.yml

name: Mark PR Ready When Ready

on:
  pull_request:
    types: [opened, edited, labeled, unlabeled, synchronize]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  mark-ready:
    name: Mark as ready after successful checks
    runs-on: ubuntu-latest
    permissions:
      checks: read
      contents: write
      pull-requests: write
      statuses: read
    if: |
      contains(github.event.pull_request.labels.*.name, 'Mark Ready When Ready') &&
      github.event.pull_request.draft == true
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit
      - name: Mark ready when ready
        uses: kenyonj/mark-ready-when-ready@0ef6176fc2ddef5bab6cb4ab9517a37f0c153ba4 # main (contents:write fix)
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}