name: Draft release notes

# At release CUT (a vX.Y.Z tag is pushed → the "GitHub Release" workflow creates
# the draft), prepare everything the release coordinator needs before they hit
# Publish:
#
#   1. Open a PR to omnigent/main updating the granular CHANGELOG.md (harvested
#      from each merged PR's "## Changelog" section), so the draft's
#      "Full Changelog" link resolves before the release goes public.
#   2. Synthesize concise, curated release notes (an Omnigent agent collapses the
#      merged PRs into ~4-5 themed highlights per section) and drop them into the
#      GitHub Release DRAFT body for the coordinator to edit.
#
# Why `workflow_run` (not extending github-release.yml): that workflow is
# deliberately minimal — it runs NO project code, only `gh release create`, so a
# malicious tagged commit can't execute anything. We keep that guarantee by
# running the heavy work (LLM + git harvest) in this SEPARATE workflow, which
# runs from the trusted default branch (workflow_run always does), never from the
# tagged commit. Same "harvester runs from main" posture as autoformat-pr.yml.
#
# The LLM machinery (creds gate, Claude Code CLI, provider config, secret-scan,
# token-minted-after-agent, artifact redaction) mirrors doc-sync.yml. The agent
# only ever sees already-merged, released history.

on:
  workflow_run:
    workflows: ["GitHub Release"]
    types: [completed]
  workflow_dispatch:
    inputs:
      tag:
        description: Release tag/ref to (re)draft (head of the range), e.g. v0.3.0
        required: true
        type: string
      base:
        description: >-
          Optional range-start override (tag/branch/sha). Needed when `tag` is not
          a final vX.Y.Z. Providing it makes the run a preview unless dry_run=false.
        required: false
        type: string
      dry_run:
        description: >-
          Preview only:
          auto (default) - preview for dev/rc tags, real PR for final versions;
          true - print the generated notes, don't open a PR;
          false - open a real PR to CHANGELOG.md
        required: false
        type: choice
        options: [auto, "true", "false"]
        default: auto

permissions:
  contents: read

concurrency:
  group: draft-release-notes-${{ github.event.workflow_run.head_branch || inputs.tag }}
  cancel-in-progress: false

env:
  SOURCE_REPO: omnigent-ai/omnigent
  OMNIGENT_SKIP_WEB_UI: "true"
  UV_INDEX_URL: https://pypi.org/simple
  PIP_INDEX_URL: https://pypi.org/simple

jobs:
  draft:
    name: Harvest CHANGELOG and draft release notes
    if: >-
      github.repository == 'omnigent-ai/omnigent' &&
      (github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success')
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      # --- Resolve the tag and decide whether to proceed (no code run yet) ---
      - name: Resolve tag and guard
        id: guard
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT_NAME: ${{ github.event_name }}
          # On tag push, workflow_run.head_branch is the tag name (v0.3.0).
          RUN_BRANCH: ${{ github.event.workflow_run.head_branch }}
          INPUT_TAG: ${{ inputs.tag }}
          INPUT_BASE: ${{ inputs.base }}
          INPUT_DRY_RUN: ${{ inputs.dry_run }}
        run: |
          set -euo pipefail
          tag="${INPUT_TAG:-$RUN_BRANCH}"
          base="${INPUT_BASE:-}"
          proceed=false; dry_run=false

          # Does the tag look like a final release (vX.Y.Z, not rc/dev/alpha/beta)?
          is_version=true
          case "$tag" in
            v[0-9]*.[0-9]*.[0-9]*) ;;
            *) is_version=false ;;
          esac
          case "$tag" in
            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_version=false ;;
          esac

          if [ "$EVENT_NAME" = "workflow_run" ]; then
            # Real release cut: strict — only a final version tag proceeds.
            [ "$is_version" = "true" ] && proceed=true
          else
            # Manual dispatch: proceed for a final version tag OR when a base
            # override is given (arbitrary-ref preview/real run).
            if [ "$is_version" = "true" ] || [ -n "$base" ]; then
              proceed=true
            fi
            # dry_run: `auto` previews for a non-version tag or a base override,
            # and does a real run for a plain version tag; true/false force it.
            case "$INPUT_DRY_RUN" in
              true)  dry_run=true ;;
              false) dry_run=false ;;
              *)     if [ "$is_version" != "true" ] || [ -n "$base" ]; then dry_run=true; fi ;;
            esac
          fi

          # NOTE: we do NOT probe for the draft release here. This step runs with
          # the read-only GITHUB_TOKEN, and GitHub hides DRAFT releases from tokens
          # without push access — the probe would always come back empty and wrongly
          # report "no draft". Draft detection happens after the App token is minted
          # (see "Resolve draft release"), which can see drafts.

          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
          echo "base=${base}" >> "$GITHUB_OUTPUT"
          echo "proceed=${proceed}" >> "$GITHUB_OUTPUT"
          echo "dry_run=${dry_run}" >> "$GITHUB_OUTPUT"
          echo "Resolved tag=${tag} base=${base:-<none>} proceed=${proceed} dry_run=${dry_run}" \
            | tee -a "$GITHUB_STEP_SUMMARY"

      # Trusted default branch, full history + tags for the range computation.
      - name: Checkout omnigent (main)
        if: steps.guard.outputs.proceed == 'true'
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: main
          fetch-depth: 0
          fetch-tags: true
          persist-credentials: false

      - name: Set up Python
        if: steps.guard.outputs.proceed == 'true'
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"

      # --- 1) Harvest CHANGELOG.md + the mechanical scaffold + agent input ---
      - name: Harvest changelog and PR material
        id: harvest
        if: steps.guard.outputs.proceed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.guard.outputs.tag }}
          BASE: ${{ steps.guard.outputs.base }}
          DRY_RUN: ${{ steps.guard.outputs.dry_run }}
        run: |
          set -euo pipefail
          # generate.py orders CHANGELOG.md by PEP 440 (packaging). This step runs
          # bare python3 (before uv sync), so ensure packaging is importable.
          python3 -m pip install --quiet --disable-pip-version-check packaging
          args=(--tag "$TAG" --repo "$SOURCE_REPO"
                --draft-notes-out /tmp/mechanical_notes.md
                --pr-list-out /tmp/pr_list.txt
                --section-out /tmp/section.md)
          [ -n "${BASE:-}" ] && args+=(--base "$BASE")
          if [ "$DRY_RUN" = "true" ]; then
            # Preview only — render, don't touch CHANGELOG.md.
            args+=(--no-changelog-update)
          else
            args+=(--changelog-file CHANGELOG.md)
          fi
          python3 .github/scripts/changelog/generate.py "${args[@]}"
          # The mechanical scaffold is the fallback release-notes body.
          cp /tmp/mechanical_notes.md /tmp/release_notes.md

          if [ "$DRY_RUN" = "true" ]; then
            {
              echo "## Preview — CHANGELOG.md section for \`${TAG}\`"
              echo '```markdown'; cat /tmp/section.md; echo '```'
              echo "## Preview — mechanical draft notes"
              echo '```markdown'; cat /tmp/mechanical_notes.md; echo '```'
            } >> "$GITHUB_STEP_SUMMARY"
          fi

      # --- 2) AI synthesis (primary; degrades to the mechanical scaffold) ---
      - name: Check LLM credentials
        id: creds
        if: steps.guard.outputs.proceed == 'true'
        env:
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: |
          if [ -z "${LLM_API_KEY:-}" ]; then
            echo "::warning::No LLM credentials — using the mechanical draft scaffold."
            echo "available=false" >> "$GITHUB_OUTPUT"
          else
            echo "::add-mask::${LLM_API_KEY}"
            echo "available=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up uv
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true

      - name: Cache virtualenv
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}

      - name: Install dependencies
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        run: uv sync --extra all --extra dev

      - name: Install Claude Code CLI
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        env:
          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
          node node_modules/@anthropic-ai/claude-code/install.cjs
          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"

      - name: Write Omnigent provider config
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        env:
          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
        run: |
          mkdir -p "$HOME/.omnigent"
          python3 -c "
          import pathlib, os, json
          gw = os.environ['GATEWAY_BASE_URL']
          cfg = {'providers': {'databricks-gateway': {
              'kind': 'gateway', 'default': ['anthropic'],
              'anthropic': {
                  'base_url': gw + '/anthropic',
                  'api_key_ref': 'env:LLM_API_KEY',
                  'models': {'default': 'databricks-claude-opus-4-8'},
              }}}}
          pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
          "

      - name: Build drafter prompt
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        env:
          TAG: ${{ steps.guard.outputs.tag }}
        run: |
          set -euo pipefail
          python3 -u <<'PYEOF'
          import os, pathlib
          tag = os.environ["TAG"]
          # The agent is tools-less, so its input must be inline — but `omnigent run
          # -p` passes the whole prompt as one argv string, capped at ~128 KiB on
          # Linux (MAX_ARG_STRLEN). Cap the PR list well under that; the mechanical
          # scaffold already covers everything, so a partial list still drafts.
          MAX = 100_000
          pr_list = pathlib.Path("/tmp/pr_list.txt").read_text(encoding="utf-8", errors="replace")
          mech = pathlib.Path("/tmp/mechanical_notes.md").read_text(encoding="utf-8", errors="replace")
          truncated = len(pr_list) > MAX
          pr_list = pr_list[:MAX]
          note = ("\n> NOTE: the PR list was truncated — theme what's visible and keep the "
                  "mechanical draft's coverage.\n" if truncated else "")
          prompt = f"""Draft the curated release notes for {tag}.
          {note}
          ## Merged PRs (number, title, and author changelog entries)
          {pr_list}

          ## Mechanical draft (raw material — curate, don't copy verbatim)
          {mech}

          Produce the RELEASE_NOTES block per your instructions."""
          pathlib.Path("/tmp/draft_prompt.txt").write_text(prompt)
          PYEOF

      - name: Run release-notes drafter
        id: draft
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        env:
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: |
          set -euo pipefail
          prompt="$(cat /tmp/draft_prompt.txt)"
          uv run --project "${GITHUB_WORKSPACE}" omnigent run \
            "${GITHUB_WORKSPACE}/.github/agents/release-notes-drafter" \
            -p "$prompt" --no-session \
            2>draft-stderr.log | tee /tmp/draft_out.txt \
            || { echo "::warning::drafter exited non-zero — keeping mechanical draft"; cat draft-stderr.log; }

      - name: Scan drafter output for secrets
        if: steps.draft.outcome == 'success'
        env:
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: |
          set -euo pipefail
          if [ -n "${LLM_API_KEY:-}" ] && grep -qF "$LLM_API_KEY" /tmp/draft_out.txt 2>/dev/null; then
            echo "::error::Drafter output contains LLM_API_KEY — aborting."
            exit 1
          fi

      - name: Extract synthesized notes (fall back to mechanical)
        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        run: |
          set -euo pipefail
          python3 -u <<'PYEOF'
          import pathlib, re
          raw = pathlib.Path("/tmp/draft_out.txt").read_text(encoding="utf-8", errors="replace") \
              if pathlib.Path("/tmp/draft_out.txt").is_file() else ""
          m = re.search(r"<!--\s*RELEASE_NOTES\s*-->(.*?)<!--\s*/RELEASE_NOTES\s*-->", raw, re.DOTALL)
          notes = (m.group(1).strip() if m else "")
          if notes:
              pathlib.Path("/tmp/release_notes.md").write_text(notes + "\n")
              print("Using AI-synthesized release notes.")
          else:
              print("::warning::No RELEASE_NOTES block parsed — keeping mechanical draft.")
          PYEOF

      # --- 3) Mint the write-token — ONLY now, after the agent has run ---
      - name: Mint App token (omnigent)
        id: app-token
        if: steps.guard.outputs.proceed == 'true' && steps.guard.outputs.dry_run != 'true' && vars.OMNIGENT_BOT_APP_ID != ''
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: omnigent

      # Find the DRAFT release for this tag using the App token (push access) — a
      # read-only token can't see drafts. Match by tag_name over the release list:
      # GitHub's get-by-tag REST endpoint 404s on drafts (their tag isn't "real"
      # until published), so only a list-and-filter finds them. Sets:
      #   is_draft   — true only when a matching UNPUBLISHED draft exists (so we
      #                never clobber notes a maintainer already published).
      #   release_id — numeric id to edit by (editing by tag would 404 on a draft).
      - name: Resolve draft release
        id: release
        if: steps.guard.outputs.proceed == 'true' && steps.guard.outputs.dry_run != 'true' && steps.app-token.outputs.token != ''
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ steps.guard.outputs.tag }}
        run: |
          set -euo pipefail
          # Read TAG via jq's `env`, not by interpolating it into the jq program —
          # a tag containing `"` or jq syntax would otherwise alter the filter.
          # (gh api's built-in --jq has no --arg; env keeps the value as data.)
          match="$(gh api "repos/${SOURCE_REPO}/releases" --paginate \
            --jq 'map(select(.tag_name == env.TAG)) | first // empty')"
          is_draft=false; release_id=""
          if [ -n "$match" ]; then
            is_draft="$(printf '%s' "$match" | jq -r '.draft')"
            release_id="$(printf '%s' "$match" | jq -r '.id')"
          fi
          if [ "$is_draft" != "true" ]; then
            echo "::notice::No unpublished draft release found for ${TAG} — leaving release notes untouched (the CHANGELOG PR still runs)."
          fi
          echo "is_draft=${is_draft}" >> "$GITHUB_OUTPUT"
          echo "release_id=${release_id}" >> "$GITHUB_OUTPUT"
          echo "Draft release for ${TAG}: is_draft=${is_draft} release_id=${release_id:-<none>}" \
            | tee -a "$GITHUB_STEP_SUMMARY"

      # --- 4) Open/update the CHANGELOG.md PR ---
      - name: Open or update the CHANGELOG.md PR
        if: steps.guard.outputs.proceed == 'true' && steps.guard.outputs.dry_run != 'true' && steps.app-token.outputs.token != ''
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          SITE_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ steps.guard.outputs.tag }}
        run: |
          set -euo pipefail
          if [ -z "$(git status --porcelain -- CHANGELOG.md)" ]; then
            echo "CHANGELOG.md already up to date for ${TAG} — nothing to do." \
              | tee -a "$GITHUB_STEP_SUMMARY"
            exit 0
          fi
          BRANCH="auto/changelog/${TAG}"
          git config user.name "omnigent-ci[bot]"
          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
          # No credentials persisted in .git/config (the unsandboxed agent ran
          # earlier); push via the token URL, which GitHub masks in logs.
          PUSH_URL="https://x-access-token:${SITE_TOKEN}@github.com/${SOURCE_REPO}.git"
          git switch -C "$BRANCH"
          git add CHANGELOG.md
          git commit -m "docs(changelog): record ${TAG}"
          git push --force "$PUSH_URL" "$BRANCH"

          if [ -n "$(gh pr list --repo "$SOURCE_REPO" --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
            echo "CHANGELOG PR already open for ${BRANCH} — force-push updated it."
            exit 0
          fi
          body="$(printf 'Records **%s** in `CHANGELOG.md`, harvested from the `## Changelog` section of each merged PR. Merge as part of cutting the release so the draft notes '"'"'Full Changelog'"'"' link resolves.\n\nGenerated by `.github/workflows/draft-release-notes.yml`.' "$TAG")"
          gh pr create \
            --repo "$SOURCE_REPO" \
            --base main \
            --head "$BRANCH" \
            --title "docs(changelog): record ${TAG}" \
            --body "$body"

      # --- 5) Enrich the GitHub Release DRAFT body (only while still a draft) ---
      - name: Enrich the release draft body
        if: steps.guard.outputs.proceed == 'true' && steps.release.outputs.is_draft == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          TAG: ${{ steps.guard.outputs.tag }}
          RELEASE_ID: ${{ steps.release.outputs.release_id }}
        run: |
          set -euo pipefail
          # Always end the notes with the community thanks. The AI drafter curates
          # freely (and can drop a hand-added line), so this is appended here rather
          # than via the prompt — every release, AI-drafted or mechanical fallback,
          # gets it. Idempotent, and placed just before the trailing "Full Changelog:"
          # link to match the layout of prior releases.
          python3 - <<'PYEOF'
          import pathlib
          NOTE = (
              "### 💜 Thanks to our community\n\n"
              "This release was shaped by the people who filed issues, opened PRs, and "
              "talked through feature requests with us on our Discord! Thank you for "
              "building omnigent with us, keep the bug reports, ideas and contributions "
              "coming :)"
          )
          path = pathlib.Path("/tmp/release_notes.md")
          text = path.read_text(encoding="utf-8").rstrip("\n")
          if "Thanks to our community" not in text:
              idx = text.find("\nFull Changelog:")
              if idx != -1:
                  head, tail = text[:idx].rstrip("\n"), text[idx:].lstrip("\n")
                  text = f"{head}\n\n{NOTE}\n\n{tail}"
              else:
                  text = f"{text}\n\n{NOTE}"
              path.write_text(text + "\n", encoding="utf-8")
          PYEOF
          # github-release.yml seeds only a short placeholder body (no
          # auto-generated notes), so replace it wholesale with the curated notes.
          # Edit by release ID: a draft release can't be addressed by tag (the
          # get/edit-by-tag REST endpoint 404s until the release is published).
          gh api --method PATCH "repos/${SOURCE_REPO}/releases/${RELEASE_ID}" \
            --field body=@/tmp/release_notes.md > /dev/null
          echo "Enriched the ${TAG} release draft with curated notes + community note." \
            | tee -a "$GITHUB_STEP_SUMMARY"

      # ::add-mask:: redacts rendered logs, not artifact files — scrub the key
      # from artifacts (incl. the unscanned stderr) before upload.
      - name: Redact secrets from artifacts
        if: always() && steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
        env:
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: |
          set -euo pipefail
          [ -n "${LLM_API_KEY:-}" ] || exit 0
          python3 - <<'PYEOF'
          import os, pathlib
          key = os.environ.get("LLM_API_KEY", "")
          for f in ["draft-stderr.log", "/tmp/draft_out.txt", "/tmp/draft_prompt.txt",
                    "/tmp/release_notes.md"]:
              p = pathlib.Path(f)
              if not p.is_file() or not key:
                  continue
              t = p.read_text(encoding="utf-8", errors="replace")
              if key in t:
                  p.write_text(t.replace(key, "***REDACTED***"), encoding="utf-8")
                  print(f"redacted key from {f}")
          PYEOF

      - name: Upload logs on failure
        if: always() && steps.guard.outputs.proceed == 'true'
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: draft-release-notes-${{ steps.guard.outputs.tag }}-${{ github.run_id }}
          path: |
            draft-stderr.log
            /tmp/draft_out.txt
            /tmp/release_notes.md
            /tmp/mechanical_notes.md
          retention-days: 7
          if-no-files-found: ignore