engine-repin.yml

name: Engine re-pin

# Daily check for a new release of any vendored engine (codeindex, webindex).
# If every pin is already on its latest v* tag, this is a green no-op.
# Otherwise it re-pins the stale ones, rebuilds the bundle, and runs the same
# gates as ci.yml:
#   - all green  -> commit + push straight to main, then explicitly trigger
#                   release.yml and ci.yml (a GITHUB_TOKEN push does NOT fire
#                   other workflows, so `gh workflow run` is required).
#   - any gate red -> the run simply fails (no push, no adjudication PR);
#                     the next daily cron retries. A red run is the signal
#                     to investigate locally.
#
# The engine list is NOT duplicated here. `sync-engine.mjs --list` prints one
# `<name> <repo> <pinned-tag>` line per engine, so adding an engine is a
# one-line edit in that script and this workflow follows automatically — the
# automation cannot drift from the list it is supposed to be watching.
#
# All stale engines are re-pinned in ONE commit and gated together: they are
# inlined into the same bundle, so testing them separately would prove less and
# cost two CI runs.
#
# No secrets beyond the built-in GITHUB_TOKEN.
on:
  schedule:
    - cron: "17 6 * * *" # daily; minute offset staggers load across repos
  workflow_dispatch: {}

permissions:
  contents: write
  actions: write
  issues: write

concurrency: engine-repin

jobs:
  repin:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: true

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Re-pin every engine that has a newer release
        id: detect
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          SUMMARY=""
          while read -r NAME REPO PINNED; do
            # NOT releases/latest: a repo may also publish non-engine asset
            # releases (codeindex publishes embed-model-v1), which are not tags
            # this can pin to.
            LATEST=$(gh api "repos/${REPO}/releases" --jq '[.[] | select(.tag_name | test("^v[0-9]")) | .tag_name] | first')
            if [ -z "$LATEST" ] || [ "$LATEST" = "null" ]; then
              echo "::error::could not determine the latest ${NAME} release tag"
              exit 1
            fi
            if [ "$PINNED" = "$LATEST" ]; then
              echo "${NAME}: up to date (${PINNED})"
              continue
            fi
            echo "${NAME}: ${PINNED} -> ${LATEST}"
            node scripts/sync-engine.mjs --engine "$NAME" --ref "$LATEST"
            SUMMARY="${SUMMARY}${NAME} ${PINNED} -> ${LATEST}"$'\n'
          done < <(node scripts/sync-engine.mjs --list)

          if [ -z "$SUMMARY" ]; then
            echo "repin=false" >> "$GITHUB_OUTPUT"
          else
            echo "repin=true" >> "$GITHUB_OUTPUT"
            {
              echo "summary<<EOF"
              printf '%s' "$SUMMARY"
              echo "EOF"
            } >> "$GITHUB_OUTPUT"
          fi

      - name: Verify the vendored engines match their new pins
        if: steps.detect.outputs.repin == 'true'
        run: node scripts/sync-engine.mjs --check

      - name: Typecheck
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run typecheck

      - name: Lint
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run lint

      - name: Rebuild the bundle
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run build

      # check:build's own `git diff --exit-code` compares the working tree to
      # the index. Stage the rebuild here so that internal diff is clean —
      # same as the local flow (rebuild, `git add`, then verify).
      - name: Stage the rebuilt bundle + vendor pins
        if: steps.detect.outputs.repin == 'true'
        run: git add -A src/vendor scripts skills

      - name: Build is reproducible
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run check:build

      - name: Verify skill bundle shape
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run verify:bundle

      - name: Test (with coverage)
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run test:coverage

      - name: Smoke-run the committed bundle (offline render + check)
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run demo

      - name: Assert the SRD was produced and is structurally complete
        if: steps.detect.outputs.repin == 'true'
        run: |
          test -f /tmp/construct-demo/SRD.json
          test -f /tmp/construct-demo/requirements/FUNCTIONAL.md
          test -f /tmp/construct-demo/SRD.md

      # assets/example-srd is ENGINE OUTPUT: its requirements are rendered from
      # evidence the vendored engines gathered, so a bump legitimately moves it.
      # Hard-failing on that diff is how a pin rots — ultrasec's sat seven
      # releases behind because twelve artifacts moved and every nightly re-pin
      # died on them. So regenerate it, and refuse only a LOSS. (`example` also
      # re-checks grounding >= 66, so a collapse fails here too.)
      - name: Regenerate the engine-output artifacts
        if: steps.detect.outputs.repin == 'true'
        run: pnpm run example

      # …but regenerating a regression gate on autopilot destroys the thing it
      # guards, so the regenerated artifacts are compared against the committed
      # ones: enrichment passes, anything that got SHORTER fails the run and
      # nothing is pushed. Losing something stays a human decision.
      - name: Guard — the regenerated artifacts lost nothing
        if: steps.detect.outputs.repin == 'true'
        run: node scripts/check-artifact-recall.mjs

      - name: Commit + push the re-pin to main
        if: steps.detect.outputs.repin == 'true'
        env:
          SUMMARY: ${{ steps.detect.outputs.summary }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add -A
          DIFFSTAT=$(git diff --cached --stat | tail -1)
          git commit -m "feat(engine): re-pin vendored engines" -m "automated re-pin, all gates green, goldens byte-identical" -m "${SUMMARY}
          ${DIFFSTAT}"
          git pull --rebase origin main
          git push origin HEAD:main

      - name: Trigger release + CI on the pushed commit
        if: steps.detect.outputs.repin == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # A push authenticated with GITHUB_TOKEN does not fire other
          # workflows' `on: push` triggers — dispatch them explicitly.
          gh workflow run release.yml --ref main
          gh workflow run ci.yml --ref main

      # A red re-pin means this repo has stopped following the engine. Nothing
      # used to carry that signal out of the Actions tab, so ultrasec failed
      # three nights running in August before a human noticed. One open issue per
      # repo, a comment on each further failure, closed by the first green run.
      - name: Report the failure on the tracking issue
        if: failure()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          RUN="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          gh label create engine-repin --color B60205 --description "This automated pin needs a human" --force >/dev/null 2>&1 || true
          NUM=$(gh issue list --state open --label engine-repin --limit 1 --json number --jq '.[0].number // empty')
          # Built with printf rather than a multi-line literal: this file's own
          # indentation would otherwise be carried into the body and render the
          # whole message as a code block.
          BODY=$(printf '%s\n\n%s\n' \
            "The daily engine-repin run failed: ${RUN}" \
            "Nothing was pushed, so main is not broken — the pin is simply frozen where it was, and this repo stays behind the engine until someone looks.")
          if [ -n "$NUM" ]; then
            gh issue comment "$NUM" --body "$BODY"
          else
            gh issue create --title "${{ github.workflow }} is failing" --label engine-repin --body "$BODY"
          fi

      - name: Close the tracking issue once a run is green
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          NUM=$(gh issue list --state open --label engine-repin --limit 1 --json number --jq '.[0].number // empty')
          if [ -z "$NUM" ]; then exit 0; fi
          gh issue close "$NUM" --comment "Green again: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"