name: Pull Sync from Framework

on:
  schedule:
    - cron: '0 */6 * * *'
  workflow_dispatch:

jobs:
  sync-and-isolate:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout Plugin Repository (Target)
        uses: actions/checkout@v4
        with:
          path: plugin-repo

      - name: Check for Framework updates
        id: check-updates
        run: |
          FRAMEWORK_HEAD=$(git ls-remote https://github.com/SuperClaude-Org/SuperClaude_Framework HEAD | cut -f1)
          echo "Current framework HEAD: $FRAMEWORK_HEAD"
          echo "framework-head=$FRAMEWORK_HEAD" >> $GITHUB_OUTPUT

          LAST_SYNCED=""
          if [ -f "plugin-repo/docs/.framework-sync-commit" ]; then
            LAST_SYNCED=$(cat plugin-repo/docs/.framework-sync-commit)
            echo "Last synced commit: $LAST_SYNCED"
          else
            echo "No previous sync state - will run sync"
          fi

          if [ "$FRAMEWORK_HEAD" = "$LAST_SYNCED" ] && [ "${{ github.event_name }}" != "workflow_dispatch" ]; then
            echo "✅ Framework is up to date - skipping sync"
            echo "has-updates=false" >> $GITHUB_OUTPUT
          else
            echo "🔄 Framework has updates - proceeding with sync"
            echo "has-updates=true" >> $GITHUB_OUTPUT
          fi

      - name: Checkout Framework Repository (Source)
        if: steps.check-updates.outputs.has-updates == 'true'
        uses: actions/checkout@v4
        with:
          repository: SuperClaude-Org/SuperClaude_Framework
          path: framework-src

      - name: Set up Python
        if: steps.check-updates.outputs.has-updates == 'true'
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Run Transformation & Sync Logic
        if: steps.check-updates.outputs.has-updates == 'true'
        run: |
          cd plugin-repo
          python3 scripts/sync_from_framework.py

      - name: Verify protected files are unchanged
        if: steps.check-updates.outputs.has-updates == 'true'
        working-directory: plugin-repo
        run: |
          # Note: plugin.json removed from list as it is updated by the MCP merge script
          PROTECTED=(
            "README.md" "README-ja.md" "README-zh.md"
            "BACKUP_GUIDE.md" "MIGRATION_GUIDE.md" "SECURITY.md"
            "CLAUDE.md" "LICENSE" ".gitignore"
            ".claude-plugin/marketplace.json"
            "core/" "modes/"
          )
          VIOLATIONS=()
          for path in "${PROTECTED[@]}"; do
            if git diff --name-only HEAD -- "$path" | grep -q .; then
              VIOLATIONS+=("$path")
            fi
          done
          if [ ${#VIOLATIONS[@]} -gt 0 ]; then
            echo "🚨 PROTECTION VIOLATION: sync modified Plugin-owned files:"
            for v in "${VIOLATIONS[@]}"; do echo "  • $v"; done
            echo ""
            echo "Fix: check SYNC_MAPPINGS in scripts/sync_from_framework.py"
            exit 1
          fi
          echo "🔒 Protection check passed — no Plugin-owned files were modified"

      - name: Save framework sync state
        if: steps.check-updates.outputs.has-updates == 'true'
        run: |
          echo "${{ steps.check-updates.outputs.framework-head }}" > plugin-repo/docs/.framework-sync-commit
          echo "✅ Saved framework commit: ${{ steps.check-updates.outputs.framework-head }}"

      - name: Commit Changes to Sync Branch
        if: steps.check-updates.outputs.has-updates == 'true'
        id: commit-changes
        working-directory: plugin-repo
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

          SYNC_BRANCH="framework-sync/$(date +'%Y-%m-%d-%H%M')"
          git checkout -b "$SYNC_BRANCH"

          git add commands/ agents/ .claude-plugin/plugin.json plugin.json

          if [ -f "docs/.framework-sync-commit" ]; then
            git add -f docs/.framework-sync-commit
          fi

          if ! git diff --cached --quiet; then
            git commit -m "chore: automated sync from framework [${{ steps.check-updates.outputs.framework-head }}]"
            git push origin "$SYNC_BRANCH"
            echo "has-changes=true" >> $GITHUB_OUTPUT
            echo "sync-branch=$SYNC_BRANCH" >> $GITHUB_OUTPUT
          else
            echo "No changes detected."
            echo "has-changes=false" >> $GITHUB_OUTPUT
          fi

      - name: Create Pull Request for Review
        if: steps.commit-changes.outputs.has-changes == 'true'
        working-directory: plugin-repo
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh pr create \
            --title "chore: framework sync ${{ steps.check-updates.outputs.framework-head }}" \
            --body "## Automated Framework Sync

          Synced from upstream framework commit: \`${{ steps.check-updates.outputs.framework-head }}\`

          **Review required before merge.** This PR was created automatically by the framework sync workflow. Please review the changes to ensure no unexpected modifications were introduced.

          ---
          *Auto-generated by pull-sync-framework workflow*" \
            --base main \
            --head "${{ steps.commit-changes.outputs.sync-branch }}"