name: Bot agents
description: Run a coding agent for approved Gitea issue/PR automation

inputs:
  master-key:
    description: >-
      Base64url-encoded 256-bit key used to decrypt the central bot profiles
      and reviewer credential.
    required: true
runs:
  using: composite
  steps:
    # The agent works on the event's commit with full history, as the author.
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ gitea.token }}
    # This step assumes this is `node:24-bookworm` container.
    - name: Install dependencies
      shell: bash
      run: npm install -g @openai/codex @anthropic-ai/claude-code deno
    # A local action lives inside the writable checkout. Execute a root-owned
    # copy so an agent changing this repository cannot replace a later phase.
    - name: Protect action source
      id: source
      shell: bash
      env:
        ACTION_PATH: ${{ gitea.action_path }}
        RUNNER_TEMP: ${{ runner.temp }}
      run: bash "${{ gitea.action_path }}/scripts/protect-source.sh"
    - name: Allow isolated profiles to edit the checkout
      shell: bash
      run: chmod -R a+rwX "${GITHUB_WORKSPACE}"
    - name: Prepare credentials
      id: prepare
      shell: bash
      run: deno run -A "${{ steps.source.outputs.path }}/src/prepare.ts"
      env:
        ACTION_PATH: ${{ steps.source.outputs.path }}
        BOT_AGENTS_MASTER_KEY: ${{ inputs.master-key }}
        RUNNER_TEMP: ${{ runner.temp }}
    - name: Run bot
      id: agent
      shell: bash
      run: deno run -A "${{ steps.source.outputs.path }}/src/run.ts"
      env:
        BOT_AGENTS_MANIFEST: ${{ steps.prepare.outputs.manifest }}
        GITEA_TOKEN: ${{ gitea.token }}
        GITEA_API_URL: ${{ gitea.api_url }}
        GITEA_REPOSITORY: ${{ gitea.repository }}
        EVENT_NAME: ${{ gitea.event_name }}
        ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}
        COMMENT: ${{ toJSON(gitea.event.comment || gitea.event.review) }}
    - name: Post result and remove credentials
      id: post
      if: always() && steps.prepare.outputs.manifest != ''
      shell: bash
      run: deno run -A "${{ steps.source.outputs.path }}/src/post.ts"
      env:
        BOT_AGENTS_MANIFEST: ${{ steps.prepare.outputs.manifest }}
        GITEA_API_URL: ${{ gitea.api_url }}
        GITEA_REPOSITORY: ${{ gitea.repository }}
        EVENT_NAME: ${{ gitea.event_name }}
        ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}