wizard-ci-trigger.yml

name: Wizard CI Trigger

on:
  pull_request:
    types: [opened]
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'Pull request number to post the hint comment on'
        required: true
        type: number

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  # ============================================================================
  # POST WELCOME: First-time hint with all available apps
  # ============================================================================
  post-welcome:
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Fetch available apps from wizard-workbench
        id: fetch-apps
        run: |
          # Fetch app categories from wizard-workbench repo
          CATEGORIES=$(curl -s "https://api.github.com/repos/PostHog/wizard-workbench/contents/apps" \
            -H "Accept: application/vnd.github.v3+json" \
            | jq -r '[.[] | select(.type == "dir") | .name] | sort | .[]')

          # Only advertise directories whose workflow is CI-capable (apps/manifest.json).
          # Left empty on fetch failure, in which case no filtering is applied.
          CI_CAPABLE=$(curl -s "https://api.github.com/repos/PostHog/wizard-workbench/contents/apps/manifest.json" \
            -H "Accept: application/vnd.github.raw" \
            | jq -r '[.workflows[] | select(.ciCapable == true) | .dir] | .[]' 2>/dev/null || echo "")

          # Build lists by category
          CATEGORY_LIST=""
          APP_LIST_VISIBLE=""
          APP_LIST_COLLAPSED=""
          APP_COUNT=0
          VISIBLE_COUNT=3

          for category in $CATEGORIES; do
            # Skip directories the manifest marks as not CI-capable.
            if [ -n "$CI_CAPABLE" ] && ! echo "$CI_CAPABLE" | grep -qxF "$category"; then
              continue
            fi

            # Fetch apps in this category
            APPS=$(curl -s "https://api.github.com/repos/PostHog/wizard-workbench/contents/apps/$category" \
              -H "Accept: application/vnd.github.v3+json" \
              | jq -r '[.[] | select(.type == "dir") | .name] | sort | .[]' 2>/dev/null || echo "")

            if [ -n "$APPS" ]; then
              # Add to category list
              CATEGORY_LIST="$CATEGORY_LIST- \`/wizard-ci $category\`\n"

              # Add apps to visible or collapsed list
              for app in $APPS; do
                if [ $APP_COUNT -lt $VISIBLE_COUNT ]; then
                  APP_LIST_VISIBLE="$APP_LIST_VISIBLE- \`/wizard-ci $category/$app\`\n"
                else
                  APP_LIST_COLLAPSED="$APP_LIST_COLLAPSED- \`/wizard-ci $category/$app\`\n"
                fi
                APP_COUNT=$((APP_COUNT + 1))
              done
            fi
          done

          # Use heredoc for multiline outputs
          {
            echo "categories<<EOF"
            echo -e "$CATEGORY_LIST"
            echo "EOF"
          } >> $GITHUB_OUTPUT

          {
            echo "apps_visible<<EOF"
            echo -e "$APP_LIST_VISIBLE"
            echo "EOF"
          } >> $GITHUB_OUTPUT

          {
            echo "apps_collapsed<<EOF"
            echo -e "$APP_LIST_COLLAPSED"
            echo "EOF"
          } >> $GITHUB_OUTPUT

      - name: Post wizard-ci hint
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        env:
          CATEGORIES_OUTPUT: ${{ steps.fetch-apps.outputs.categories }}
          APPS_VISIBLE_OUTPUT: ${{ steps.fetch-apps.outputs.apps_visible }}
          APPS_COLLAPSED_OUTPUT: ${{ steps.fetch-apps.outputs.apps_collapsed }}
          PR_NUMBER: ${{ inputs.pr_number }}
        with:
          script: |
            const categories = process.env.CATEGORIES_OUTPUT || '';
            const appsVisible = process.env.APPS_VISIBLE_OUTPUT || '';
            const appsCollapsed = process.env.APPS_COLLAPSED_OUTPUT || '';
            const inputPrNumber = process.env.PR_NUMBER;

            const bodyParts = [
              '## 🧙 Wizard CI',
              '',
              'Run the Wizard CI and test your changes against [wizard-workbench](https://github.com/PostHog/wizard-workbench) example apps by replying with a GitHub comment using one of the following commands:',
              '',
              '**Test all apps:**',
              '- `/wizard-ci all`',
              '',
              '**Test all apps in a directory:**',
              categories.trim(),
              '',
              '**Test an individual app:**',
              appsVisible.trim()
            ];

            if (appsCollapsed.trim()) {
              bodyParts.push('');
              bodyParts.push('<details>');
              bodyParts.push('<summary>Show more apps</summary>');
              bodyParts.push('');
              bodyParts.push(appsCollapsed.trim());
              bodyParts.push('</details>');
            }

            bodyParts.push('');
            bodyParts.push('**Test against a Context Mill branch:**');
            bodyParts.push('- `/wizard-ci all context-mill:my-branch`');
            bodyParts.push('');
            bodyParts.push('Add `context-mill:<branch>` to any command above to pin the Context Mill branch. It defaults to `main`.');
            bodyParts.push('');
            bodyParts.push('Results will be posted here when complete.');

            const body = bodyParts.join('\n');

            const prNumber = context.eventName === 'workflow_dispatch'
              ? parseInt(inputPrNumber, 10)
              : context.payload.pull_request.number;

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
              body
            });

  # ============================================================================
  # HANDLE COMMAND: Parse /wizard-ci and trigger workflow
  # ============================================================================
  handle-command:
    if: |
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) &&
      startsWith(github.event.comment.body, '/wizard-ci') &&
      !startsWith(github.event.comment.body, '/wizard-ci-snapshots')
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
        with:
          app-id: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_APP_ID }}
          private-key: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_PRIVATE_KEY }}
          owner: PostHog
          repositories: wizard-workbench,wizard

      - name: Parse command and trigger
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            // Get PR details first to check state
            const pr = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.issue.number
            });

            // Only allow triggers on open PRs (including drafts)
            if (pr.data.state !== 'open') {
              console.log(`PR is ${pr.data.state}, skipping trigger`);
              return;
            }

            const comment = context.payload.comment.body;
            const match = comment.match(/\/wizard-ci\s+(\S+)/);
            const firstArg = match ? match[1] : 'all';

            // A reviewer can pin the companion repo with `context-mill:<ref>`.
            // A lone pin is not an app name, so fall back to every app.
            const app = firstArg.startsWith('context-mill:') ? 'all' : firstArg;

            // The ref arrives in a PR comment, so treat it as untrusted. Accept
            // git ref characters only. Reject traversal, a leading dash and a
            // trailing slash.
            const isPlausibleRef = (ref) =>
              ref.length <= 200 &&
              /^[A-Za-z0-9._\/-]+$/.test(ref) &&
              !ref.includes('..') &&
              !ref.startsWith('-') &&
              !ref.startsWith('/') &&
              !ref.endsWith('/');

            // Read the pin from the command line only, not from later prose.
            const companion = comment
              .split(/\r?\n/)[0]
              .match(/(?:^|\s)context-mill:(\S+)/);
            const contextMillRef = companion ? companion[1] : null;

            if (contextMillRef && !isPlausibleRef(contextMillRef)) {
              core.setFailed(
                'The context-mill ref is not a valid git ref. ' +
                  'Use `/wizard-ci <app> context-mill:<branch>`.'
              );
              return;
            }

            // React with rocket to show we're processing
            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: 'rocket'
            });

            // Trigger wizard-ci on wizard-workbench
            await github.rest.repos.createDispatchEvent({
              owner: 'PostHog',
              repo: 'wizard-workbench',
              event_type: 'wizard-ci-trigger',
              client_payload: {
                app: app,
                source: 'wizard-pr',
                source_repo: 'wizard',
                source_pr_number: context.payload.issue.number,
                source_pr_url: pr.data.html_url,
                wizard_ref: pr.data.head.ref,
                // Omit the key when unpinned. The workbench then uses `main`.
                ...(contextMillRef ? { context_mill_ref: contextMillRef } : {}),
                notify_slack: 'false',
                notify_pr: 'true'
              }
            });

            const pinNote = contextMillRef ? ` (context-mill ref ${contextMillRef})` : '';
            console.log(`Triggered wizard-ci for app: ${app}${pinNote}`);

  # ============================================================================
  # HANDLE SNAPSHOTS: Parse /wizard-ci-snapshots and trigger the snapshots workflow
  # ============================================================================
  # Same write-access restriction as handle-command above. This job matters more:
  # its positional `[ref]` argument is attacker-chosen, not the PR's own branch.
  handle-snapshots-command:
    if: |
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) &&
      startsWith(github.event.comment.body, '/wizard-ci-snapshots')
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
        with:
          app-id: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_APP_ID }}
          private-key: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_PRIVATE_KEY }}
          owner: PostHog
          repositories: wizard-workbench,wizard

      - name: Parse command and trigger snapshots
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            // Only trigger on open PRs (including drafts).
            const pr = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.issue.number
            });
            if (pr.data.state !== 'open') {
              console.log(`PR is ${pr.data.state}, skipping trigger`);
              return;
            }

            const body = context.payload.comment.body;

            // The ref arrives in a PR comment, so treat it as untrusted. Accept
            // git ref characters only. Reject traversal, a leading dash and a
            // trailing slash.
            const isPlausibleRef = (ref) =>
              ref.length <= 200 &&
              /^[A-Za-z0-9._\/-]+$/.test(ref) &&
              !ref.includes('..') &&
              !ref.startsWith('-') &&
              !ref.startsWith('/') &&
              !ref.endsWith('/');

            // Optional companion pin. Read it from the command line only.
            const companionToken = /(?:^|\s)context-mill:(\S+)/;
            const companion = body.split(/\r?\n/)[0].match(companionToken);
            const contextMillRef = companion ? companion[1] : null;

            if (contextMillRef && !isPlausibleRef(contextMillRef)) {
              core.setFailed(
                'The context-mill ref is not a valid git ref. Use ' +
                  '`/wizard-ci-snapshots <app> context-mill:<branch>`.'
              );
              return;
            }

            // Remove the pin so the positional ref cannot capture it.
            const args = contextMillRef ? body.replace(companionToken, ' ') : body;

            // /wizard-ci-snapshots <app> [wizard_ref] [context-mill:<ref>] —
            // wizard_ref defaults to this PR's branch.
            const m = args.match(/\/wizard-ci-snapshots\s+(\S+)(?:\s+(\S+))?/);
            const app = m ? m[1] : 'basic-integration/javascript-node/express-todo';

            // The positional ref also comes from the comment. Check it too.
            const wizardRefArg = m && m[2] ? m[2] : null;
            if (wizardRefArg && !isPlausibleRef(wizardRefArg)) {
              core.setFailed(
                'The wizard ref is not a valid git ref. Use ' +
                  '`/wizard-ci-snapshots <app> <wizard-branch>`.'
              );
              return;
            }
            const wizardRef = wizardRefArg || pr.data.head.ref;

            await github.rest.reactions.createForIssueComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              comment_id: context.payload.comment.id,
              content: 'rocket'
            });

            // Same wizard-ci-trigger dispatch as /wizard-ci, plus snapshots:true —
            // wizard-ci.yml's one SNAPSHOTS branch runs the real-TUI review instead
            // of the evaluator. It checks out its own trusted ref; no untrusted PR
            // code is checked out here.
            await github.rest.repos.createDispatchEvent({
              owner: 'PostHog',
              repo: 'wizard-workbench',
              event_type: 'wizard-ci-trigger',
              client_payload: {
                app: app,
                source: 'wizard-pr',
                source_repo: 'wizard',
                source_pr_number: context.payload.issue.number,
                source_pr_url: pr.data.html_url,
                wizard_ref: wizardRef,
                // Omit the key when unpinned. The workbench then uses `main`.
                ...(contextMillRef ? { context_mill_ref: contextMillRef } : {}),
                notify_slack: 'false',
                notify_pr: 'true',
                snapshots: true
              }
            });

            const pinNote = contextMillRef ? `, context-mill ref ${contextMillRef}` : '';
            console.log(`Triggered snapshots for app: ${app} (ref ${wizardRef}${pinNote})`);