name: Canvas Smoke Test — Comment

# Writer half of the canvas-smoke-test reader/writer split. The reader
# (canvas-smoke-test.yml) runs on untrusted PR code with a read-only
# token; this workflow only reads its artifact and never checks out PR code.

on:
  workflow_run:
    workflows: ["Canvas Smoke Test"]
    types: [completed]

permissions:
  actions: read
  issues: write
  pull-requests: write

jobs:
  comment:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.event == 'pull_request'
    steps:
      - name: Download review artifact
        id: download
        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: canvas-smoke-test-results
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}

      - name: Upsert PR comment
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
        with:
          script: |
            const fs = require('fs');
            const marker = '<!-- canvas-smoke-test -->';

            if (!fs.existsSync('report.md')) {
              core.info('No canvas smoke test report artifact found. Skipping.');
              return;
            }

            let status = 'unknown';
            try {
              status = JSON.parse(fs.readFileSync('results.json', 'utf8')).status || 'unknown';
            } catch {
              core.warning('results.json is missing or invalid.');
            }

            const workflowRun = context.payload.workflow_run;
            const artifactPr = fs.existsSync('pr-number.txt') ? fs.readFileSync('pr-number.txt', 'utf8').trim() : '';
            const prNumber = /^[1-9][0-9]*$/.test(artifactPr) ? Number(artifactPr) : workflowRun.pull_requests?.[0]?.number;
            if (!prNumber) {
              core.warning('Could not determine PR number. Skipping.');
              return;
            }

            // The artifact is untrusted: bind the target PR to the triggering run
            // (base repo, head repo/ref/SHA, and a unique association) before writing.
            const { data: pr } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: prNumber,
            });
            if (pr.state !== 'open') {
              core.info(`Skipping non-open PR #${prNumber}.`);
              return;
            }
            const expectedBaseRepository = `${context.repo.owner}/${context.repo.repo}`.toLowerCase();
            const runHeadRepository = String(workflowRun.head_repository?.full_name || '');
            const runHeadRepositoryParts = runHeadRepository.split('/');
            const runHeadRef = String(workflowRun.head_branch || '');
            if (String(pr.base?.repo?.full_name || '').toLowerCase() !== expectedBaseRepository) {
              core.setFailed(`PR #${prNumber} does not target this repository.`);
              return;
            }
            if (pr.head.sha !== workflowRun.head_sha) {
              core.info(`PR #${prNumber} head ${pr.head.sha} does not match run head ${workflowRun.head_sha}. Skipping stale or mismatched report.`);
              return;
            }
            if (
              runHeadRepositoryParts.length !== 2 ||
              !runHeadRepositoryParts[0] ||
              !runHeadRepositoryParts[1] ||
              !runHeadRef ||
              String(pr.head?.repo?.full_name || '').toLowerCase() !== runHeadRepository.toLowerCase() ||
              String(pr.head?.ref || '') !== runHeadRef
            ) {
              core.setFailed(`PR #${prNumber} head repository/ref did not match workflow_run.`);
              return;
            }
            const workflowRunPullRequests = Array.isArray(workflowRun.pull_requests) ? workflowRun.pull_requests : [];
            if (workflowRunPullRequests.length > 0) {
              if (!workflowRunPullRequests.some((pullRequest) => pullRequest.number === prNumber)) {
                core.setFailed(`PR #${prNumber} was not present in workflow_run.pull_requests.`);
                return;
              }
            } else {
              const candidatePullRequests = await github.paginate(github.rest.pulls.list, {
                owner: context.repo.owner,
                repo: context.repo.repo,
                state: 'open',
                head: `${runHeadRepositoryParts[0]}:${runHeadRef}`,
                per_page: 100,
              });
              const trustedMatches = candidatePullRequests.filter((candidate) =>
                candidate.head?.sha === workflowRun.head_sha &&
                String(candidate.head?.ref || '') === runHeadRef &&
                String(candidate.head?.repo?.full_name || '').toLowerCase() === runHeadRepository.toLowerCase() &&
                String(candidate.base?.repo?.full_name || '').toLowerCase() === expectedBaseRepository
              );
              if (trustedMatches.length !== 1 || trustedMatches[0].number !== prNumber) {
                core.setFailed(`PR #${prNumber} could not be uniquely associated with workflow_run.`);
                return;
              }
            }

            let body = fs.readFileSync('report.md', 'utf8').replace(/@/g, '@\u200b');
            const maxLength = 65000;
            if (body.length > maxLength) {
              body = `${body.slice(0, maxLength)}\n\n_...(truncated)..._`;
            }
            if (!body.includes(marker)) {
              body = `${marker}\n${body}`;
            }

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
              per_page: 100,
            });
            const existing = comments.find((comment) =>
              comment.user?.login === 'github-actions[bot]' && comment.body?.includes(marker));

            if (status === 'skipped' && !existing) {
              core.info('No canvas changes and no previous comment. Nothing to post.');
              return;
            }

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
              core.info(`Updated canvas smoke test comment ${existing.id}`);
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: prNumber,
                body,
              });
              core.info('Created canvas smoke test comment');
            }