---
name: KSAI

permissions: {}

on:  # yamllint disable-line rule:truthy
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request:
    types: [review_requested, opened, ready_for_review]
  pull_request_review:
    types: [submitted]
  workflow_dispatch:
    inputs:
      pr:
        description: Pull request number to review
        required: false
      actor:
        description: GitHub username to authorize against CODEOWNERS, matching comment authorization
        required: false
      issue_number:
        description: Issue number for plan continuation; empty when work_ref names the work
        required: false
      work_ref:
        description: The work to do when there is no GitHub issue, as jira/<KEY>
        required: false
      attempt:
        description: Runs already spent by this continuation chain
        required: false
      stall:
        description: Consecutive runs that completed no step
        required: false
      prev_remaining:
        description: Unchecked boxes seen by the predecessor, with empty distinct from zero
        required: false
      comment_id:
        description: Comment a dispatched request answers, read back from GitHub rather than believed
        required: false
      comment_kind:
        description: Which space comment_id came from, issue, review or submitted_review
        required: false
      record_id:
        description: Dispatch record written for this run, read back over the run's own OIDC token
        required: false

jobs:
  authorize:
    name: authorize
    if: >-
      ((github.event_name == 'issue_comment' ||
      github.event_name == 'pull_request_review_comment') &&
      github.event.comment.user.type != 'Bot' &&
      (contains(github.event.comment.body, '/ksai') ||
      (vars.KSAI_TRIGGER_PHRASE != '' &&
      contains(github.event.comment.body, vars.KSAI_TRIGGER_PHRASE)))) ||
      (github.event_name == 'issue_comment' &&
      github.event.comment.user.type != 'Bot' &&
      github.event.issue.pull_request &&
      github.event.issue.user.type == 'Bot') ||
      (github.event_name == 'pull_request_review_comment' &&
      github.event.comment.user.type != 'Bot' &&
      github.event.comment.in_reply_to_id &&
      github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_review' &&
      github.event.action == 'submitted' &&
      github.event.review.user.type != 'Bot' &&
      github.event.pull_request.draft == true &&
      github.event.pull_request.user.type == 'Bot' &&
      github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-latest
    permissions: {}
    outputs:
      writes: ${{ steps.writes.outputs.writes }}
    steps:
      - name: Read whether the author can write to this repository
        id: writes
        env:
          GH_TOKEN: ${{ github.token }}
          LOGIN: ${{ github.event.comment.user.login || github.event.review.user.login }}
        run: |
          level=$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${LOGIN}/permission" --jq .permission)
          case "$level" in admin|write) writes=true ;; *) writes=false ;; esac
          echo "writes=${writes}" >> "$GITHUB_OUTPUT"

  ksai:
    name: run
    needs: authorize
    if: >-
      !cancelled() &&
      ((github.event_name == 'workflow_dispatch' &&
      (inputs.pr != '' || inputs.issue_number != '' || inputs.work_ref != '' ||
      inputs.comment_id != '' || inputs.comment_kind != '')) ||
      needs.authorize.outputs.writes == 'true')
    uses: Kong/ksai-public/.github/workflows/ksai.yml@15f45eae5f0794b4e3f63875e9a8305fc9e60215 # v3.106.0
    permissions:
      contents: write       # checked out by every command, and pushed by one that changes code
      issues: write         # every command answers with a comment, and reacts to the one that asked
      pull-requests: write  # post reviews and maintain draft pull request plans
      id-token: write       # mint the GitHub OIDC token for federation
      checks: read          # read what CI said about the head
      statuses: read        # the older API a build may report through
      actions: write        # old caller review dispatch, successor plan runs and test publication
    with:
      trigger_phrase: ${{ vars.KSAI_TRIGGER_PHRASE }}
      anthropic_base_url: ${{ vars.KSAI_ANTHROPIC_BASE_URL }}
      federation_rule_id: ${{ vars.KSAI_FEDERATION_RULE_ID }}
      organization_id: ${{ vars.KSAI_ORGANIZATION_ID }}
      service_account_id: ${{ vars.KSAI_SERVICE_ACCOUNT_ID }}
      workspace_id: ${{ vars.KSAI_WORKSPACE_ID }}
      push_as_app: false
      pr: ${{ inputs.pr }}
      actor: ${{ inputs.actor }}
      issue_number: ${{ inputs.issue_number }}
      work_ref: ${{ inputs.work_ref }}
      attempt: ${{ inputs.attempt }}
      stall: ${{ inputs.stall }}
      prev_remaining: ${{ inputs.prev_remaining }}
      comment_id: ${{ inputs.comment_id }}
      comment_kind: ${{ inputs.comment_kind }}
      record_id: ${{ inputs.record_id }}

  request:
    if: >-
      (github.event_name == 'pull_request' &&
      github.event.action == 'review_requested' &&
      github.event.requested_team.slug == (vars.KSAI_REVIEW_TEAM || 'ksai') &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      github.event.sender.type != 'Bot') ||
      (github.event_name == 'pull_request' &&
      contains(fromJSON('["opened", "ready_for_review"]'), github.event.action) &&
      github.event.pull_request.head.repo.full_name == github.repository)
    uses: Kong/ksai-public/.github/workflows/ksai-request.yml@15f45eae5f0794b4e3f63875e9a8305fc9e60215 # v3.106.0
    permissions:
      actions: write  # dispatch this workflow onto the default branch
      contents: read  # download the actions this call runs
    with:
      push_as_app: false