name: Upstream Health

# Weekly check that every external pointer (skills/agents/teams entry.json)
# still resolves upstream. Results go to one tracking issue labelled
# `upstream-health`, which is updated in place and closed once nothing is
# actionable. Fixing an entry stays a normal reviewed PR; this workflow never
# rewrites catalog files.

on:
  schedule:
    - cron: "23 1 * * 1" # Mondays 01:23 UTC
  workflow_dispatch:

permissions:
  contents: read
  issues: write

concurrency:
  group: upstream-health
  cancel-in-progress: false

jobs:
  check:
    if: github.repository == 'desirecore/market'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v3

      - name: Check upstreams
        id: check
        run: |
          set +e
          uv run --quiet scripts/catalog/check_upstream_health.py --format markdown --summary-file summary.json > report.md
          code=$?
          set -e
          if [ "$code" -gt 1 ]; then
            echo "health check crashed with exit code $code" >&2
            exit "$code"
          fi
          python3 - <<'PY' >> "$GITHUB_OUTPUT"
          import json
          from pathlib import Path
          summary = json.loads(Path("summary.json").read_text())
          for key in ("broken", "actionable", "unknown"):
              print(f"{key}={str(summary[key]).lower()}")
          PY
          cat report.md >> "$GITHUB_STEP_SUMMARY"

      - name: Update tracking issue
        env:
          GH_TOKEN: ${{ github.token }}
          ACTIONABLE: ${{ steps.check.outputs.actionable }}
          UNKNOWN: ${{ steps.check.outputs.unknown }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail
          label=upstream-health
          gh label create "$label" --color D93F0B \
            --description "Upstream availability of external catalog entries" 2>/dev/null || true

          {
            echo "_Updated by [Upstream Health]($RUN_URL) on $(date -u +%Y-%m-%d)._"
            echo
            echo "Fix entries through a normal PR: repoint or remove \`gone\` entries, correct \`bad-*\` paths, and review upstream changes before bumping \`source.ref\` for \`outdated\` entries (rerun \`scripts/gen-collection-children.py\` for collections). \`unreachable\` means a network error, not a confirmed failure."
            echo
            cat report.md
          } > body.md

          issue=$(gh issue list --label "$label" --state open --limit 1 --json number --jq '.[0].number // empty')
          if [ "$ACTIONABLE" = "true" ] || [ "$UNKNOWN" = "true" ]; then
            if [ -n "$issue" ]; then
              gh issue edit "$issue" --body-file body.md
            else
              gh issue create --title "Upstream health report" --label "$label" --body-file body.md
            fi
          elif [ -n "$issue" ]; then
            gh issue comment "$issue" --body "All external entries resolve upstream and are current as of $RUN_URL. Closing."
            gh issue close "$issue"
          fi

      - name: Fail when an entry is broken
        if: steps.check.outputs.broken == 'true'
        run: |
          echo "::error::At least one external entry no longer resolves upstream; see the upstream-health issue."
          exit 1