build.yml

name: build
on:
  pull_request: {}
  workflow_dispatch: {}
permissions:
  actions: none
  attestations: none
  checks: none
  contents: none
  deployments: none
  discussions: none
  id-token: none
  issues: none
  models: none
  packages: none
  pages: none
  pull-requests: none
  repository-projects: none
  security-events: none
  statuses: none
jobs:
  build:
    permissions:
      actions: write # upload-artifact when self-mutation is detected
      contents: read
    runs-on: ubuntu-latest
    strategy:
      matrix:
        compute_type: [agentcore]
    outputs:
      self_mutation_happened: ${{ steps.self_mutation.outputs.self_mutation_happened }}
    env:
      CI: "true"
      MISE_EXPERIMENTAL: "1"
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      AQUA_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      # Keep secret and dependency scanning enabled in CI; only disable the
      # remaining tools that are intentionally skipped here.
      MISE_DISABLE_TOOLS: "aqua:aquasecurity/trivy,grype,semgrep"
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1  # shallow clone
          persist-credentials: false
      - name: Resolve github:* tag values
        id: tags
        env:
          EVENT_NAME: ${{ github.event_name }}
          GH_SHA: ${{ github.sha }}
          GH_REF_NAME: ${{ github.ref_name }}
          GH_REF_TYPE: ${{ github.ref_type }}
          GH_HEAD_REF: ${{ github.head_ref }}
          GH_BASE_REF: ${{ github.base_ref }}
          MG_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
          MG_BASE_REF: ${{ github.event.merge_group.base_ref }}
          MG_HEAD_REF: ${{ github.event.merge_group.head_ref }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          case "$EVENT_NAME" in
            merge_group)
              echo "sha=${MG_HEAD_SHA}" >> "$GITHUB_OUTPUT"
              echo "ref=${MG_BASE_REF}" >> "$GITHUB_OUTPUT"
              echo "ref-type=branch" >> "$GITHUB_OUTPUT"
              echo "head-ref=${MG_HEAD_REF}" >> "$GITHUB_OUTPUT"
              echo "base-ref=${MG_BASE_REF}" >> "$GITHUB_OUTPUT"
              PR_NUM=$(echo "$MG_HEAD_REF" | grep -oP 'pr-\K[0-9]+' || echo "")
              echo "pr-number=${PR_NUM}" >> "$GITHUB_OUTPUT"
              ;;
            pull_request|pull_request_target)
              echo "sha=${PR_HEAD_SHA}" >> "$GITHUB_OUTPUT"
              echo "ref=${GH_HEAD_REF}" >> "$GITHUB_OUTPUT"
              echo "ref-type=branch" >> "$GITHUB_OUTPUT"
              echo "head-ref=${GH_HEAD_REF}" >> "$GITHUB_OUTPUT"
              echo "base-ref=${GH_BASE_REF}" >> "$GITHUB_OUTPUT"
              echo "pr-number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
              ;;
            push)
              echo "sha=${GH_SHA}" >> "$GITHUB_OUTPUT"
              echo "ref=${GH_REF_NAME}" >> "$GITHUB_OUTPUT"
              echo "ref-type=${GH_REF_TYPE}" >> "$GITHUB_OUTPUT"
              echo "head-ref=" >> "$GITHUB_OUTPUT"
              echo "base-ref=" >> "$GITHUB_OUTPUT"
              echo "pr-number=" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "sha=${GH_SHA}" >> "$GITHUB_OUTPUT"
              echo "ref=${GH_REF_NAME}" >> "$GITHUB_OUTPUT"
              echo "ref-type=${GH_REF_TYPE}" >> "$GITHUB_OUTPUT"
              echo "head-ref=" >> "$GITHUB_OUTPUT"
              echo "base-ref=" >> "$GITHUB_OUTPUT"
              echo "pr-number=" >> "$GITHUB_OUTPUT"
              ;;
          esac
      - name: Generate CDK context
        env:
          COMPUTE_TYPE: ${{ matrix.compute_type }}
          TAG_SHA: ${{ steps.tags.outputs.sha }}
          TAG_REF: ${{ steps.tags.outputs.ref }}
          TAG_REF_TYPE: ${{ steps.tags.outputs.ref-type }}
          TAG_ACTOR: ${{ github.actor }}
          TAG_HEAD_REF: ${{ steps.tags.outputs.head-ref }}
          TAG_BASE_REF: ${{ steps.tags.outputs.base-ref }}
          TAG_PR_NUMBER: ${{ steps.tags.outputs.pr-number }}
          TAG_RUN_ID: ${{ github.run_id }}
          TAG_RUN_ATTEMPT: ${{ github.run_attempt }}
          TAG_EVENT: ${{ github.event_name }}
          TAG_WORKFLOW: ${{ github.workflow }}
          TAG_REPOSITORY: ${{ github.repository }}
        run: |
          jq -n \
            --arg compute_type "$COMPUTE_TYPE" \
            --arg stackName "backgroundagent-dev" \
            --arg sha "$TAG_SHA" \
            --arg ref "$TAG_REF" \
            --arg ref_type "$TAG_REF_TYPE" \
            --arg actor "$TAG_ACTOR" \
            --arg head_ref "$TAG_HEAD_REF" \
            --arg base_ref "$TAG_BASE_REF" \
            --arg pr_number "$TAG_PR_NUMBER" \
            --arg run_id "$TAG_RUN_ID" \
            --arg run_attempt "$TAG_RUN_ATTEMPT" \
            --arg event "$TAG_EVENT" \
            --arg workflow "$TAG_WORKFLOW" \
            --arg repository "$TAG_REPOSITORY" \
            '{
              "compute_type": $compute_type,
              "stackName": $stackName,
              "github:sha": $sha,
              "github:ref": $ref,
              "github:ref-type": $ref_type,
              "github:actor": $actor,
              "github:head-ref": $head_ref,
              "github:base-ref": $base_ref,
              "github:pr-number": $pr_number,
              "github:run-id": $run_id,
              "github:run-attempt": $run_attempt,
              "github:event": $event,
              "github:workflow": $workflow,
              "github:repository": $repository,
              "github:clean": "true"
            }' > cdk/cdk.context.json
          cat cdk/cdk.context.json
      - name: Install mise
        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
        with:
          cache: true
      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22.x
      - name: Install dependencies
        run: mise run install
      - name: build
        run: mise run build
      - name: Upload CDK artifact (${{ matrix.compute_type }})
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cdk-${{ matrix.compute_type }}-out
          path: |
            cdk/cdk.out/
            cdk/cdk.context.json
      - name: Find mutations
        id: self_mutation
        run: |-
          git add .
          git diff --staged --patch --exit-code > repo.patch || echo "self_mutation_happened=true" >> $GITHUB_OUTPUT
        shell: bash
        working-directory: ./

      - name: Upload patch
        if: steps.self_mutation.outputs.self_mutation_happened
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: repo.patch
          path: repo.patch
          overwrite: true

      - name: Fail build on mutation
        if: steps.self_mutation.outputs.self_mutation_happened
        run: |-
          echo "::error::Files were changed during build (see build log). Please run the build locally and commit the changes."
          cat repo.patch
          exit 1