name: Claude Branch Automation

# Trigger when Claude pushes commits to its branches
# Using push event is more reliable than create event
on:
  push:
    branches:
      - 'claude/**'

jobs:
  complete-release-prep:
    # SECURITY: Run automation ONLY for Claude-generated branches
    # Prevents malicious collaborators from abusing this workflow
    # Claude commits have actor: github-actions[bot] or triggering_actor: github-actions[bot]
    # Branch pattern: claude/issue-{number}-{timestamp} or claude/{type}-{timestamp}
    if: |
      startsWith(github.ref_name, 'claude/') &&
      (github.actor == 'github-actions[bot]' || github.triggering_actor == 'github-actions[bot]')
    runs-on: ubuntu-latest
    permissions:
      contents: write      # Need write to commit uv.lock
      pull-requests: write # Need write to create PR
      issues: write        # Need write to comment on issues

    steps:
      - name: Security Verification
        run: |
          echo "=== Security Check ==="
          echo "Branch: ${{ github.ref_name }}"
          echo "Actor: ${{ github.actor }}"
          echo "Triggering Actor: ${{ github.triggering_actor }}"
          echo "Event Name: ${{ github.event_name }}"

          # Verify this is a Claude-generated branch
          if [[ "${{ github.actor }}" != "github-actions[bot]" ]] && [[ "${{ github.triggering_actor }}" != "github-actions[bot]" ]]; then
            echo "ERROR: Workflow triggered by unauthorized user"
            echo "Only Claude (github-actions[bot]) can trigger this workflow"
            exit 1
          fi

          echo "✅ Security check passed - Claude-generated branch confirmed"

      - name: Checkout branch
        uses: actions/checkout@v4
        with:
          ref: ${{ github.ref_name }}
          fetch-depth: 0  # Full history for proper git operations

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install uv
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.cargo/bin" >> $GITHUB_PATH

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Run uv lock
        id: uv_lock
        run: |
          # Run uv lock and capture if changes were made
          uv lock

          # Check if uv.lock was modified
          if git diff --quiet uv.lock; then
            echo "changed=false" >> $GITHUB_OUTPUT
            echo "✅ uv.lock is already up to date"
          else
            echo "changed=true" >> $GITHUB_OUTPUT
            echo "📝 uv.lock has been updated"
          fi

      - name: Commit uv.lock
        if: steps.uv_lock.outputs.changed == 'true'
        run: |
          git add uv.lock

          # Extract version from branch name or use generic message
          VERSION=$(echo "${{ github.ref_name }}" | grep -oP 'v\d+\.\d+\.\d+' || echo "")

          if [ -n "$VERSION" ]; then
            git commit -m "chore: update uv.lock for $VERSION"
          else
            git commit -m "chore: update uv.lock"
          fi

          git push origin ${{ github.ref_name }}

      - name: Run Quality Checks
        id: quality_check
        continue-on-error: true  # Don't fail workflow, just capture result
        run: |
          echo "=== Running Quality Gate Checks ==="

          # Get list of changed Python files compared to main
          git diff origin/main...HEAD --name-only --diff-filter=ACMR > /tmp/changed_files.txt

          echo "Changed files:"
          cat /tmp/changed_files.txt
          echo ""

          # Run quality checks on changed files
          # Note: GROQ_API_KEY or Gemini CLI required
          # Exit codes: 0=pass, 1=warnings, 2=critical
          if bash scripts/pr/run_quality_checks_on_files.sh --files-from /tmp/changed_files.txt; then
            echo "quality_passed=true" >> $GITHUB_OUTPUT
            echo "quality_status=passed" >> $GITHUB_OUTPUT
            echo "blocking=false" >> $GITHUB_OUTPUT
            exit 0
          else
            EXIT_CODE=$?
            if [ $EXIT_CODE -eq 2 ]; then
              echo "quality_passed=false" >> $GITHUB_OUTPUT
              echo "quality_status=failed" >> $GITHUB_OUTPUT
              echo "blocking=true" >> $GITHUB_OUTPUT
              echo "::error::Quality gate FAILED - Security vulnerabilities detected"
              exit 1  # Fail the step
            else
              echo "quality_passed=false" >> $GITHUB_OUTPUT
              echo "quality_status=warnings" >> $GITHUB_OUTPUT
              echo "blocking=false" >> $GITHUB_OUTPUT
              echo "::warning::Quality gate has warnings but is non-blocking"
              exit 0  # Don't fail the step
            fi
          fi
        env:
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}

      - name: Extract issue number from branch name
        id: extract_issue
        run: |
          # Extract issue number from branch name like "claude/issue-254-20251129-2139"
          ISSUE_NUM=$(echo "${{ github.ref_name }}" | grep -oP 'issue-\K\d+' || echo "")
          echo "number=$ISSUE_NUM" >> $GITHUB_OUTPUT
          echo "Found issue number: $ISSUE_NUM"

      - name: Check if PR already exists
        id: check_pr
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Check if PR from this branch already exists
          PR_EXISTS=$(gh pr list --head "${{ github.ref_name }}" --json number --jq 'length')
          echo "exists=$PR_EXISTS" >> $GITHUB_OUTPUT

          if [ "$PR_EXISTS" -gt 0 ]; then
            echo "⚠️ PR already exists for this branch"
          else
            echo "✅ No PR exists yet"
          fi

      - name: Read version from pyproject.toml
        id: read_version
        run: |
          if [ ! -f "pyproject.toml" ]; then
            echo "ERROR: pyproject.toml not found"
            exit 1
          fi

          VERSION=$(grep '^version = ' pyproject.toml | cut -d'"' -f2)

          if [ -z "$VERSION" ]; then
            echo "ERROR: Could not extract version from pyproject.toml"
            exit 1
          fi

          echo "version=$VERSION" >> $GITHUB_OUTPUT
          echo "Detected version: $VERSION"

      - name: Read CHANGELOG entry
        id: changelog
        run: |
          if [ ! -f "CHANGELOG.md" ]; then
            echo "WARNING: CHANGELOG.md not found, using generic entry"
            echo "See commit history for details." > /tmp/changelog.md
          else
            # Extract the latest version entry from CHANGELOG.md
            # Gets everything from first version header until the next one
            awk '/^## \[[0-9]/ {p++} p==1' CHANGELOG.md > /tmp/changelog.md

            if [ ! -s /tmp/changelog.md ]; then
              echo "WARNING: Could not extract CHANGELOG entry, using generic"
              echo "See CHANGELOG.md for details." > /tmp/changelog.md
            fi
          fi

          echo "CHANGELOG entry to use:"
          cat /tmp/changelog.md

      - name: Create Pull Request
        if: |
          steps.check_pr.outputs.exists == '0' &&
          steps.quality_check.outputs.blocking != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION="${{ steps.read_version.outputs.version }}"
          ISSUE_NUM="${{ steps.extract_issue.outputs.number }}"
          BRANCH="${{ github.ref_name }}"

          # Determine PR type from branch name
          if echo "$BRANCH" | grep -q "fix"; then
            PR_TYPE="fix"
          elif echo "$BRANCH" | grep -q "feat"; then
            PR_TYPE="feat"
          else
            PR_TYPE="chore"
          fi

          # Build PR title
          if [ -n "$ISSUE_NUM" ]; then
            PR_TITLE="${PR_TYPE}: release v${VERSION} (fixes #${ISSUE_NUM})"
          else
            PR_TITLE="${PR_TYPE}: release v${VERSION}"
          fi

          # Get quality check status for PR body
          QUALITY_STATUS="${{ steps.quality_check.outputs.quality_status }}"
          QUALITY_EMOJI="✅"
          QUALITY_TEXT="All quality checks passed"

          if [ "$QUALITY_STATUS" = "warnings" ]; then
            QUALITY_EMOJI="⚠️"
            QUALITY_TEXT="Quality checks passed with warnings (see workflow logs)"
          elif [ "$QUALITY_STATUS" = "failed" ]; then
            QUALITY_EMOJI="🔴"
            QUALITY_TEXT="Quality checks failed (PR should not have been created)"
          fi

          # Build PR body
          cat > /tmp/pr-body.md << EOF
          ## 🤖 Automated Release Preparation

          This PR was automatically created by the Claude Branch Automation workflow.

          ## Changes
          - Version bump to v${VERSION}
          - Updated \`__init__.py\`, \`pyproject.toml\`, \`README.md\`
          - Updated \`uv.lock\` (automated)
          - Updated \`CHANGELOG.md\`

          ## Quality Checks
          ${QUALITY_EMOJI} **${QUALITY_TEXT}**

          - Code complexity: Analyzed
          - Security scan: Completed
          - Status: \`${QUALITY_STATUS}\`

          ## CHANGELOG Entry

          $(cat /tmp/changelog.md)

          ## Checklist
          - [x] Version bumped in all required files
          - [x] \`uv.lock\` updated (automated by workflow)
          - [x] CHANGELOG.md updated
          - [x] README.md updated
          - [x] Quality checks completed

          ## Related
          EOF

          # Add issue reference if exists
          if [ -n "$ISSUE_NUM" ]; then
            echo "- Fixes #${ISSUE_NUM}" >> /tmp/pr-body.md
          fi

          echo "" >> /tmp/pr-body.md
          echo "---" >> /tmp/pr-body.md
          echo "🤖 Generated by Claude Branch Automation workflow" >> /tmp/pr-body.md

          # Create PR
          gh pr create \
            --title "$PR_TITLE" \
            --body-file /tmp/pr-body.md \
            --base main \
            --head "$BRANCH"

          echo "✅ Pull Request created successfully"

      - name: Comment on issue (Quality Check Blocked)
        if: |
          steps.extract_issue.outputs.number != '' &&
          steps.quality_check.outputs.blocking == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ISSUE_NUM="${{ steps.extract_issue.outputs.number }}"
          VERSION="${{ steps.read_version.outputs.version }}"

          cat > /tmp/quality-block-comment.md << EOF
          ## 🔴 Quality Gate Failed - PR Creation Blocked

          The automated release preparation for **v${VERSION}** was blocked due to critical quality issues.

          **Branch created:** \`${{ github.ref_name }}\`

          **Critical Issues Detected:**
          - Security vulnerabilities found in code changes
          - PR creation was blocked to prevent merging vulnerable code

          **Action Required:**
          1. Review the [workflow logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for detailed security scan results
          2. Fix all security vulnerabilities in the branch
          3. Push fixes to \`${{ github.ref_name }}\`
          4. This workflow will re-run automatically and create the PR if checks pass

          **Quality Gate Details:**
          - Status: ${{ steps.quality_check.outputs.quality_status }}
          - Blocking: ${{ steps.quality_check.outputs.blocking }}

          🤖 Automated by Claude Branch Automation workflow with quality enforcement
          EOF

          gh issue comment "$ISSUE_NUM" --body-file /tmp/quality-block-comment.md

          echo "✅ Quality block notification added to issue #${ISSUE_NUM}"

      - name: Comment on issue
        if: steps.extract_issue.outputs.number != '' && steps.check_pr.outputs.exists == '0' && steps.quality_check.outputs.blocking != 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          ISSUE_NUM="${{ steps.extract_issue.outputs.number }}"
          VERSION="${{ steps.read_version.outputs.version }}"

          # Get PR number
          PR_NUM=$(gh pr list --head "${{ github.ref_name }}" --json number --jq '.[0].number')

          # Determine quality check status message
          QUALITY_STATUS="${{ steps.quality_check.outputs.quality_status }}"
          if [ "$QUALITY_STATUS" = "passed" ]; then
            QUALITY_MSG="✅ Quality checks passed (complexity + security)"
          elif [ "$QUALITY_STATUS" = "warnings" ]; then
            QUALITY_MSG="⚠️  Quality checks passed with warnings (see PR for details)"
          else
            QUALITY_MSG="✅ Quality checks completed"
          fi

          cat > /tmp/issue-comment.md << EOF
          ## 🚀 Release Preparation Complete

          I've automatically completed the release preparation for **v${VERSION}**:

          ✅ Branch created: \`${{ github.ref_name }}\`
          ✅ Version bumped in all files
          ✅ \`uv.lock\` updated automatically
          ${QUALITY_MSG}
          ✅ Pull Request created: #${PR_NUM}

          **Next Steps:**
          1. Review the PR: #${PR_NUM}
          2. Once approved, merge to complete the release
          3. Tag and GitHub release will follow standard workflow

          🤖 Automated by Claude Branch Automation workflow with quality enforcement
          EOF

          gh issue comment "$ISSUE_NUM" --body-file /tmp/issue-comment.md

          echo "✅ Comment added to issue #${ISSUE_NUM}"
