implementor.yml

name: Implementor

on:
  schedule:
    - cron: '29 * * * *'
  workflow_dispatch:
    inputs:
      lookback_hours:
        description: Lookback window in hours for recently updated issues
        required: false
        default: '72'
      max_issues:
        description: Maximum number of issues to implement in a single run
        required: false
        default: '5'
      lease_ttl_minutes:
        description: How long an implementor lease stays active before another run may retry
        required: false
        default: '120'
      agent_id:
        description: Agent identity to write into metadata
        required: false
        default: implementor
      command:
        description: Optional shell command for the external implementor backend; falls back to the built-in Codex wrapper or vars.IMPLEMENTOR_COMMAND
        required: false
        default: ''

concurrency:
  group: implementor
  cancel-in-progress: false

jobs:
  implementor:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Setup Codex auth
        id: setup-auth
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          CODEX_AUTH_JSON: ${{ secrets.CODEX_AUTH_JSON }}
        run: |
          if [ -n "$OPENAI_API_KEY" ]; then
            echo "Using OPENAI_API_KEY."
          elif [ -n "$CODEX_AUTH_JSON" ]; then
            (umask 077 && mkdir -p ~/.codex && printf '%s\n' "$CODEX_AUTH_JSON" > ~/.codex/auth.json)
            AUTH_HASH=$(sha256sum ~/.codex/auth.json | cut -d' ' -f1)
            echo "auth_hash=$AUTH_HASH" >> "$GITHUB_OUTPUT"
            echo "Using Codex OAuth auth."
          else
            echo "Warning: neither OPENAI_API_KEY nor CODEX_AUTH_JSON is configured. Codex auth will not be available; ensure IMPLEMENTOR_COMMAND does not require it."
          fi

      - name: Run implementor handoff
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          MCP4_AGENT_ARTIFACT_SIGNING_KEY: ${{ secrets.MCP4_AGENT_ARTIFACT_SIGNING_KEY }}
          MCP4_AGENT_ARTIFACT_KEY_ID: ${{ vars.MCP4_AGENT_ARTIFACT_KEY_ID }}
          MCP4_AGENT_ARTIFACT_ALLOW_UNSIGNED: ${{ vars.MCP4_AGENT_ARTIFACT_ALLOW_UNSIGNED }}
          IMPLEMENTOR_LOOKBACK_HOURS: ${{ github.event.inputs.lookback_hours || '72' }}
          IMPLEMENTOR_MAX_ISSUES: ${{ github.event.inputs.max_issues || '5' }}
          IMPLEMENTOR_LEASE_TTL_MINUTES: ${{ github.event.inputs.lease_ttl_minutes || '120' }}
          IMPLEMENTOR_AGENT_ID: ${{ github.event.inputs.agent_id || 'implementor' }}
          IMPLEMENTOR_COMMAND: ${{ github.event.inputs.command || vars.IMPLEMENTOR_COMMAND || 'node dist/scripts/run-implementor-codex.js' }}
          IMPLEMENTOR_FALLBACK_COMMAND: ${{ vars.IMPLEMENTOR_FALLBACK_COMMAND }}
        run: npm run agent:implementor

      - name: Persist Codex OAuth token if refreshed
        if: always() && steps.setup-auth.outputs.auth_hash != ''
        env:
          GH_TOKEN: ${{ secrets.GH_PAT_FOR_SECRETS }}
          ORIGINAL_HASH: ${{ steps.setup-auth.outputs.auth_hash }}
        run: |
          if [ -z "$GH_TOKEN" ]; then
            echo "GH_PAT_FOR_SECRETS not configured, skipping token persistence."
            exit 0
          fi
          if [ ! -f ~/.codex/auth.json ]; then
            echo "auth.json missing after run, skipping."
            exit 0
          fi
          NEW_HASH=$(sha256sum ~/.codex/auth.json | cut -d' ' -f1)
          if [ "$NEW_HASH" != "$ORIGINAL_HASH" ]; then
            gh secret set CODEX_AUTH_JSON --repo "$GITHUB_REPOSITORY" < ~/.codex/auth.json
            echo "Token refreshed and persisted."
          else
            echo "Token unchanged, skipping."
          fi