name: Watch upstream OpenCode

on:
  schedule:
    - cron: "23 */6 * * *"
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: opencode-upstream-watcher
  cancel-in-progress: false

jobs:
  open-compatibility-pr:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Resolve latest release
        id: release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          release="$(gh api repos/anomalyco/opencode/releases/latest)"
          tag="$(jq -r .tag_name <<<"$release")"
          current="$(jq -r .release_tag manifests/upstream.json)"
          echo "tag=$tag" >> "$GITHUB_OUTPUT"
          echo "published_at=$(jq -r .published_at <<<"$release")" >> "$GITHUB_OUTPUT"
          echo "release_url=$(jq -r .html_url <<<"$release")" >> "$GITHUB_OUTPUT"
          if [ "$tag" = "$current" ]; then
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Stop when a PR already exists
        if: steps.release.outputs.changed == 'true'
        id: existing
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.release.outputs.tag }}
        run: |
          branch="compat/upstream-${TAG#v}"
          count="$(gh pr list --state open --head "$branch" --json number --jq length)"
          echo "branch=$branch" >> "$GITHUB_OUTPUT"
          if [ "$count" -gt 0 ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Resolve immutable image and update manifests
        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
        env:
          TAG: ${{ steps.release.outputs.tag }}
          PUBLISHED_AT: ${{ steps.release.outputs.published_at }}
          RELEASE_URL: ${{ steps.release.outputs.release_url }}
        run: |
          digest="$(docker buildx imagetools inspect "ghcr.io/anomalyco/opencode:${TAG#v}" --format '{{json .Manifest}}' | jq -r .digest)"
          ruby scripts/record_upstream_candidate.rb "$TAG" "$PUBLISHED_AT" "$RELEASE_URL" "$digest"
          ruby test/repository_test.rb
      - name: Open compatibility PR
        if: steps.release.outputs.changed == 'true' && steps.existing.outputs.skip == 'false'
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ steps.release.outputs.tag }}
          BRANCH: ${{ steps.existing.outputs.branch }}
        run: |
          git config user.name "opencode-compat-bot"
          git config user.email "opencode-compat-bot@users.noreply.github.com"
          git switch -c "$BRANCH"
          git add manifests/image-matrix.json manifests/upstream.json
          git commit -m "Test OpenCode ${TAG} compatibility"
          git push --set-upstream origin "$BRANCH"
          gh pr create \
            --base main \
            --head "$BRANCH" \
            --title "Test OpenCode ${TAG} compatibility" \
            --body "Upstream watcher detected ${TAG}, resolved its immutable OCI digest, and added it as a pending compatibility target. This PR only runs certification checks; promotion and consumer rollout remain manual."