copilot-setup-steps.yml

# Copilot Setup Steps
# Provisions the toolchain and per-surface dependency closures for GitHub
# Copilot cloud coding agent sessions. The single `copilot-setup-steps` job
# is consumed by Copilot before each agent session; this workflow also runs
# on self-changes and weekly to detect toolchain drift.
#
# Reference:
# https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment
---
name: Copilot Setup Steps

on:
  workflow_dispatch:
  push:
    paths:
      - .github/workflows/copilot-setup-steps.yml
  pull_request:
    paths:
      - .github/workflows/copilot-setup-steps.yml
  # Weekly drift check: surfaces broken action SHAs, yanked packages, or
  # registry outages on a Monday morning instead of mid-Copilot-session.
  schedule:
    - cron: '17 9 * * 1'

permissions:
  contents: read

jobs:
  copilot-setup-steps:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Install apt packages (shellcheck, jq, ffmpeg)
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends shellcheck jq ffmpeg

      - name: Install actionlint
        run: scripts/setup/install-actionlint.sh

      - name: Install OSV-Scanner v2.3.8
        env:
          OSV_SCANNER_VERSION: 2.3.8
          OSV_SCANNER_SHA256: bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc
        run: |
          curl -sSLo /tmp/osv-scanner \
            "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
          echo "${OSV_SCANNER_SHA256}  /tmp/osv-scanner" | sha256sum -c --quiet -
          sudo install -m 0755 /tmp/osv-scanner /usr/local/bin/osv-scanner
          rm -f /tmp/osv-scanner
          osv-scanner --version

      - name: Setup Python 3.12
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.12'

      - name: Setup uv
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1

      - name: Setup Node.js (frontend pin)
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
        with:
          node-version-file: data-management/viewer/frontend/.nvmrc
          cache: npm
          cache-dependency-path: |
            package-lock.json
            data-management/viewer/frontend/package-lock.json

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: infrastructure/terraform/e2e/go.mod
          cache-dependency-path: infrastructure/terraform/e2e/go.mod

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e  # v4.0.1
        with:
          terraform_wrapper: false

      - name: Setup TFLint
        uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a  # v6.3.0

      - name: Install gh-aw CLI extension (v0.81.6)
        run: gh extension install github/gh-aw --pin v0.81.6
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Install PowerShell modules (Pester 5.7.1, powershell-yaml 0.4.12)
        shell: pwsh
        run: |
          Install-Module -Name Pester -RequiredVersion 5.7.1 -Force -SkipPublisherCheck -Scope CurrentUser
          Install-Module -Name powershell-yaml -RequiredVersion 0.4.12 -Force -SkipPublisherCheck -Scope CurrentUser

      - name: Install root Node tooling (markdownlint, cspell, table-formatter, link-check)
        run: npm ci

      - name: Presync root Python dev group
        run: uv sync --group dev

      - name: Presync dataviewer backend Python (dev + analysis + hdf5 + export + auth)
        working-directory: data-management/viewer/backend
        run: uv sync --extra dev --extra analysis --extra hdf5 --extra export --extra auth

      - name: Presync evaluation Python dev group
        working-directory: evaluation
        run: uv sync --only-group dev

      - name: Presync dataviewer frontend
        working-directory: data-management/viewer/frontend
        run: npm ci

      - name: Presync Go modules (terraform e2e)
        working-directory: infrastructure/terraform/e2e
        run: go mod download

      # Run the external-content bootstrap last. A failed Copilot setup step
      # skips later steps but still starts the agent with the completed setup.
      # RPI_SKILLS_REF is pinned to the reviewed skill-consolidation commit because
      # no published hve-core release contains this skill layout. Prefer a release
      # SHA on future upgrades; otherwise review the commit and complete tree.
      - name: Bootstrap hve-core RPI skills
        env:
          GH_TOKEN: ${{ github.token }}
          # microsoft/hve-core derived-files release: hve-core-v3.2.2 (2026-03-23)
          HVE_CORE_DERIVED_FILES_REF: e69486a5f809ede45c63c0a31358c12912bd5168
          RPI_SKILLS_REF: 130ab64338bb77e912e603693672c31f14bc60c6
        run: |
          skills=(
            rpi-quick
            rpi-research
            rpi-plan
            rpi-implement
            rpi-review
            rpi-challenger
            rpi-plan-critique
            rpi-walkthrough
          )
          for skill in "${skills[@]}"; do
            gh skill install microsoft/hve-core \
              ".github/skills/rpi/${skill}/SKILL.md" \
              --pin "$RPI_SKILLS_REF" \
              --dir .github/skills \
              --force
          done

          tracking_instruction=".github/instructions/hve-core/copilot-tracking.instructions.md"
          mkdir -p "$(dirname "$tracking_instruction")"
          gh api \
            "repos/microsoft/hve-core/contents/.github/instructions/hve-core/copilot-tracking.instructions.md?ref=$RPI_SKILLS_REF" \
            --header "Accept: application/vnd.github.raw+json" \
            > "$tracking_instruction"