name: "Loop: Security"

# Generated by `micro loop init`. A dispatch role of the autonomous loop: on a
# cadence it opens a fresh tracking issue and posts the instruction in
# .github/loop/prompts/security.md to the agent (@codex).
#
# The workflow is the MECHANISM; that prompt file is the editable POLICY —
# change what this role does by editing the prompt, not this YAML. A FRESH
# issue per run is deliberate: agents derive the PR branch name from the
# triggering issue, so reusing one tracker collapses every run onto one branch.
#
# Gated on CODEX_TRIGGER_TOKEN: the agent ignores @mentions from the
# github-actions bot, so dispatch posts as a real user (a PAT). No token → no-op.

on:
  workflow_dispatch: {}
  # PAUSED 2026-07-12: automatic schedule disabled while the team does focused
  # 1:1 fixes. Still runnable on demand via workflow_dispatch. Re-enable by
  # uncommenting the schedule below.
  # schedule:
  #   - cron: "0 6 * * 1"

permissions:
  issues: write

concurrency:
  group: loop-security
  cancel-in-progress: false

jobs:
  dispatch:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4 # needed to read the prompt file
      - name: Dispatch security
        env:
          GH_TOKEN: ${{ secrets.CODEX_TRIGGER_TOKEN || github.token }}
          HAS_TOKEN: ${{ secrets.CODEX_TRIGGER_TOKEN != '' }}
          REPO: ${{ github.repository }}
          RUN_NUMBER: ${{ github.run_number }}
        run: |
          if [ "$HAS_TOKEN" != "true" ]; then
            echo "CODEX_TRIGGER_TOKEN is not set — skipping (the agent ignores bot @mentions)."
            exit 0
          fi
          PROMPT=".github/loop/prompts/security.md"
          if [ ! -f "$PROMPT" ]; then
            echo "missing $PROMPT — run 'micro loop init'." >&2
            exit 1
          fi
          ISSUE_URL=$(gh issue create --repo "$REPO" \
            --title "Loop: security review #$RUN_NUMBER" \
            --body "Autonomous security pass. Direction: .github/loop/NORTH_STAR.md; queue: .github/loop/PRIORITIES.md.")
          ISSUE_NUM="${ISSUE_URL##*/}"
          echo "Opened issue #$ISSUE_NUM — dispatching security."
          # The prompt file is the policy; strip its editorial <!-- --> header and
          # substitute the tracking issue number (__ISSUE__) at runtime.
          {
            echo "@codex"
            echo
            sed -e '/<!--/,/-->/d' -e "s/__ISSUE__/$ISSUE_NUM/g" "$PROMPT"
          } > "$RUNNER_TEMP/loop-body.md"
          gh issue comment "$ISSUE_NUM" --repo "$REPO" --body-file "$RUNNER_TEMP/loop-body.md"
