aicode-agent.yml

name: AICODE Agent

on:
  repository_dispatch:
    types: [aicode-enhanced]
  # workflow_run:
#    workflows: ["AICODE Preprocess"]
#    types: [completed]

jobs:
  agent:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout develop
        uses: actions/checkout@v4
        with:
          ref: develop
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install agent dependencies
        working-directory: .github/agent
        run: npm install

      - name: Log task information
        run: |
          echo "Original task: ${{ github.event.client_payload.original_task || github.event.client_payload.task }}"
          echo "Enhanced task: ${{ github.event.client_payload.task }}"
          echo "Preprocessing run: ${{ github.event.client_payload.preprocessing_run_id || 'N/A' }}"
          echo "Confluence page: ${{ github.event.client_payload.confluence_url || 'N/A' }}"

      - name: Run AI Agent
        id: agent
        env:
          # AI Provider selection (claude, openai, or gemini)
          AI_PROVIDER: ${{ secrets.AI_PROVIDER || 'claude' }}
          # Claude/Anthropic (default, FREE tier available)
          # Model names: claude-sonnet-4-5 (recommended), claude-haiku-4-5, claude-opus-4-5
          # See: https://platform.claude.com/docs/en/about-claude/models/overview
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          CLAUDE_API_KEY: ${{ secrets.CLAUDE_API_KEY }}
          CLAUDE_MODEL: ${{ secrets.CLAUDE_MODEL || 'claude-sonnet-4-5' }}
          # OpenAI (fallback)
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          OPENAI_MODEL: ${{ secrets.OPENAI_MODEL || 'gpt-4o' }}
          # Google Gemini (alternative, FREE tier available)
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
          GEMINI_MODEL: ${{ secrets.GEMINI_MODEL || 'gemini-1.5-pro' }}
          # Other
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          GITHUB_RUN_ID: ${{ github.run_id }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          # Use enhanced task from preprocessing if available, otherwise use original
          TASK: ${{ github.event.client_payload.task || github.event.client_payload.original_task }}
          ORIGINAL_TASK: ${{ github.event.client_payload.original_task || github.event.client_payload.task }}
          REQUESTER: ${{ github.event.client_payload.requester }}
          PREPROCESSING_RUN_ID: ${{ github.event.client_payload.preprocessing_run_id || '' }}
          DEBUG: ${{ vars.DEBUG || 'false' }}
        run: node .github/agent/agent.mjs
        continue-on-error: true

      - name: Notify Slack on agent failure
        if: steps.agent.outcome != 'success'
        run: |
          # Write event payload to JSON file to avoid shell quoting issues
          echo '${{ toJSON(github.event.client_payload) }}' > /tmp/event_payload.json
          
          # Extract values using jq (handles all escaping automatically)
          TASK=$(jq -r '.task // .original_task // "Unknown task"' /tmp/event_payload.json)
          REQUESTER=$(jq -r '.requester // "unknown"' /tmp/event_payload.json)
          RUN_ID="${{ github.run_id }}"
          
          PAYLOAD=$(jq -n \
            --arg text "❌ AICODE Agent failed before tests" \
            --arg task "$TASK" \
            --arg requester "$REQUESTER" \
            --arg run_url "https://github.com/htilly/SlackONOS/actions/runs/$RUN_ID" \
            '{
              text: $text,
              blocks: [
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("❌ *AICODE Agent Failed*\n\n*Task:* " + $task + "\n*Requested by:* " + $requester + "\n*Stage:* Agent execution\n\nCheck the logs for detailed error information.")
                  }
                },
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("<" + $run_url + "|View GitHub Actions logs>")
                  }
                }
              ]
            }')
          
          curl -X POST "${{ secrets.SLACK_WEBHOOK_URL }}" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"

      - name: Validate diff format
        id: validate
        if: steps.agent.outcome == 'success'
        run: |
          if [ -f /tmp/aicode.patch ]; then
            echo "Checking diff format..."
            git apply --check /tmp/aicode.patch 2>&1 || echo "Diff validation check completed"
          else
            echo "No patch file found - validation skipped"
          fi
        continue-on-error: true

      - name: Check for secrets in diff
        id: secrets-check
        if: steps.agent.outcome == 'success'
        run: |
          if [ -f /tmp/aicode.patch ]; then
            echo "Checking for potential secrets..."
            # Check for common secret patterns (basic check)
            if grep -iE "(sk-|ghp_|xoxb-|api[_-]?key|password|token)\s*[:=]\s*['\"][^'\"]{10,}" /tmp/aicode.patch; then
              echo "⚠️ Potential secrets detected in diff - review required"
              exit 1
            else
              echo "✅ No obvious secrets detected"
            fi
          fi
        continue-on-error: true

      - name: Run tests
        id: tests
        if: steps.agent.outcome == 'success' && steps.secrets-check.outcome == 'success'
        run: npm test
        continue-on-error: true

      - name: Create PR if tests pass
        id: cpr
        if: steps.agent.outcome == 'success' && steps.tests.outcome == 'success' && steps.secrets-check.outcome == 'success'
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          commit-message: "AI: ${{ github.event.client_payload.task || github.event.client_payload.original_task }}"
          branch: aicode-${{ github.run_number }}
          base: develop
          title: "AICODE: ${{ github.event.client_payload.task || github.event.client_payload.original_task }}"
          body: |
            Autonomous code changes requested by @${{ github.event.client_payload.requester }}

            **Task:** ${{ github.event.client_payload.task || github.event.client_payload.original_task }}
            **Original Task:** ${{ github.event.client_payload.original_task || 'N/A' }}
            **Requirements:** ${{ github.event.client_payload.confluence_url != 'N/A' && github.event.client_payload.confluence_url || 'Not documented' }}
            **Tests:** ✅ Passed
            **Validation:** ✅ Passed
            **Secrets Check:** ✅ Passed
            **Agent Run:** ${{ github.run_id }}
            **Preprocessing Run:** ${{ github.event.client_payload.preprocessing_run_id || 'N/A' }}

            This PR will be automatically merged.

            ---
            *Generated by AICODE Agent - Review changes carefully before merging*

      - name: Auto-merge PR
        if: steps.agent.outcome == 'success' && steps.tests.outcome == 'success' && steps.secrets-check.outcome == 'success' && steps.cpr.outputs.pull-request-number != ''
        run: |
          gh pr merge ${{ steps.cpr.outputs.pull-request-number }} --squash --auto
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Get changed files
        id: changed-files
        if: steps.agent.outcome == 'success'
        run: |
          # We're already on develop, so show changes from HEAD (uncommitted changes)
          if git diff --name-only HEAD 2>/dev/null | head -5 > /tmp/changed-files.txt; then
            CHANGED_FILES=$(cat /tmp/changed-files.txt | tr '\n' ',' | sed 's/,$//')
            echo "files=$CHANGED_FILES" >> $GITHUB_OUTPUT
          else
            # If no uncommitted changes, check what was committed
            if git diff --name-only HEAD~1 HEAD 2>/dev/null | head -5 > /tmp/changed-files.txt; then
              CHANGED_FILES=$(cat /tmp/changed-files.txt | tr '\n' ',' | sed 's/,$//')
              echo "files=$CHANGED_FILES" >> $GITHUB_OUTPUT
            else
              echo "files=unknown" >> $GITHUB_OUTPUT
            fi
          fi

      - name: Notify Slack on success
        if: steps.agent.outcome == 'success' && steps.tests.outcome == 'success' && steps.secrets-check.outcome == 'success'
        run: |
          # Write event payload to JSON file to avoid shell quoting issues
          echo '${{ toJSON(github.event.client_payload) }}' > /tmp/event_payload.json
          
          # Extract values using jq (handles all escaping automatically)
          CHANGED_FILES="${{ steps.changed-files.outputs.files }}"
          TASK=$(jq -r '.task // .original_task // "Unknown task"' /tmp/event_payload.json)
          ORIGINAL_TASK=$(jq -r '.original_task // .task // "N/A"' /tmp/event_payload.json)
          REQUESTER=$(jq -r '.requester // "unknown"' /tmp/event_payload.json)
          PR_NUMBER="${{ steps.cpr.outputs.pull-request-number }}"
          RUN_ID="${{ github.run_id }}"
          
          PAYLOAD=$(jq -n \
            --arg text "✅ AICODE PR created: <https://github.com/htilly/SlackONOS/pull/$PR_NUMBER|#$PR_NUMBER>" \
            --arg task "$TASK" \
            --arg original_task "$ORIGINAL_TASK" \
            --arg requester "$REQUESTER" \
            --arg pr_number "$PR_NUMBER" \
            --arg changed_files "$CHANGED_FILES" \
            --arg run_id "$RUN_ID" \
            '{
              text: $text,
              blocks: [
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("✅ *AICODE Agent Success*\n\n*Task:* " + $task + "\n*Original:* " + $original_task + "\n*Requested by:* " + $requester + "\n*PR:* <https://github.com/htilly/SlackONOS/pull/" + $pr_number + "|#" + $pr_number + ">\n*Files changed:* " + $changed_files)
                  }
                },
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("<https://github.com/htilly/SlackONOS/actions/runs/" + $run_id + "|View workflow run>")
                  }
                }
              ]
            }')
          
          curl -X POST "${{ secrets.SLACK_WEBHOOK_URL }}" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"

      - name: Notify Slack on validation failure
        if: steps.agent.outcome == 'success' && steps.secrets-check.outcome != 'success'
        run: |
          # Write event payload to JSON file to avoid shell quoting issues
          echo '${{ toJSON(github.event.client_payload) }}' > /tmp/event_payload.json
          
          # Extract values using jq (handles all escaping automatically)
          TASK=$(jq -r '.task // .original_task // "Unknown task"' /tmp/event_payload.json)
          REQUESTER=$(jq -r '.requester // "unknown"' /tmp/event_payload.json)
          RUN_ID="${{ github.run_id }}"
          
          PAYLOAD=$(jq -n \
            --arg text "🔒 AICODE failed: Security validation failed" \
            --arg task "$TASK" \
            --arg requester "$REQUESTER" \
            --arg run_id "$RUN_ID" \
            '{
              text: $text,
              blocks: [
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("🔒 *AICODE Security Validation Failed*\n\n*Task:* " + $task + "\n*Requested by:* " + $requester + "\n*Issue:* Potential secrets detected in generated code\n\nReview the changes manually before proceeding.")
                  }
                },
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("<https://github.com/htilly/SlackONOS/actions/runs/" + $run_id + "|View GitHub Actions logs>")
                  }
                }
              ]
            }')
          
          curl -X POST "${{ secrets.SLACK_WEBHOOK_URL }}" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"

      - name: Notify Slack on test failure
        if: steps.agent.outcome == 'success' && steps.secrets-check.outcome == 'success' && steps.tests.outcome != 'success'
        run: |
          # Write event payload to JSON file to avoid shell quoting issues
          echo '${{ toJSON(github.event.client_payload) }}' > /tmp/event_payload.json
          
          # Extract values using jq (handles all escaping automatically)
          TASK=$(jq -r '.task // .original_task // "Unknown task"' /tmp/event_payload.json)
          REQUESTER=$(jq -r '.requester // "unknown"' /tmp/event_payload.json)
          RUN_ID="${{ github.run_id }}"
          
          PAYLOAD=$(jq -n \
            --arg text "❌ AICODE failed: Tests didn't pass" \
            --arg task "$TASK" \
            --arg requester "$REQUESTER" \
            --arg run_id "$RUN_ID" \
            '{
              text: $text,
              blocks: [
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("❌ *AICODE Test Failure*\n\n*Task:* " + $task + "\n*Requested by:* " + $requester + "\n*Issue:* Generated code failed tests\n\nReview the test output and adjust the changes.")
                  }
                },
                {
                  type: "section",
                  text: {
                    type: "mrkdwn",
                    text: ("<https://github.com/htilly/SlackONOS/actions/runs/" + $run_id + "|View GitHub Actions logs>")
                  }
                }
              ]
            }')
          
          curl -X POST "${{ secrets.SLACK_WEBHOOK_URL }}" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"