source-audit.yml

name: Audit source health

on:
  schedule:
    # Sunday 06:37 Asia/Shanghai, before the weekly refresh.
    - cron: "37 22 * * 6"
  workflow_dispatch:

permissions:
  actions: write
  contents: write
  issues: write

concurrency:
  group: agent-pulse-repository-data-main
  cancel-in-progress: false

jobs:
  audit:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      DATABASE_URL: sqlite:./var/source-audit.db
      COLLECTOR_CONCURRENCY: 4
    steps:
      - name: Check out main
        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Install locked dependencies
        run: npm ci

      - name: Restore auditable repository snapshot
        run: npm run db:snapshot -- restore

      - name: Capture the current public source fingerprint
        shell: bash
        run: |
          set -euo pipefail
          npm run export -- --skip-seed
          npm run --silent public:fingerprint -- --include-sources > "$RUNNER_TEMP/public-before.sha256"

      - name: Audit every configured source
        run: npm run sources:audit -- --concurrency=4 --report=data/reports/source-health.json

      - name: Reconcile unstable sources and radar
        run: npm run ops:reconcile

      - name: Reconcile eligible shadow observation
        run: npm run observe:sources -- --confirm

      - name: Activate only qualified observation sources
        run: npm run activate:auto

      - name: Merge latest remote repository snapshot
        shell: bash
        run: |
          set -euo pipefail
          git fetch origin main
          git show origin/main:data/snapshot/v1.json > "$RUNNER_TEMP/remote-snapshot.json"
          npm run db:snapshot -- merge --file="$RUNNER_TEMP/remote-snapshot.json"

      - name: Export converged source state and detect a material public change
        id: public
        shell: bash
        run: |
          set -euo pipefail
          npm run export -- --skip-seed
          npm run --silent public:validate -- --output="$RUNNER_TEMP/public-integrity.json"
          npm run --silent public:fingerprint -- --include-sources > "$RUNNER_TEMP/public-after.sha256"
          if cmp -s "$RUNNER_TEMP/public-before.sha256" "$RUNNER_TEMP/public-after.sha256"; then
            echo "No material public source changes."
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "Material public source state changed."
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload public integrity evidence
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: source-audit-public-integrity-${{ github.run_id }}
          path: ${{ runner.temp }}/public-integrity.json
          if-no-files-found: ignore
          retention-days: 14

      - name: Write privacy-safe snapshot with accumulated checks
        run: npm run db:snapshot -- write

      - name: Validate report privacy and shape
        shell: bash
        run: |
          set -euo pipefail
          test -s data/reports/source-health.json
          test -s data/snapshot/v1.json
          git diff --check -- data/reports/source-health.json data/snapshot/v1.json
          if grep -E 'gh[opsu]_[A-Za-z0-9_]{20,}|-----BEGIN .*PRIVATE KEY-----|/Users/[^/]+/|/home/runner/|"(token|secret|password|cookie|authorization|api[_-]?key)"[[:space:]]*:' data/reports/source-health.json data/snapshot/v1.json; then
            echo "Private material detected in source health output" >&2
            exit 1
          fi

      - name: Render compact source health summary
        run: npm run --silent sources:health:issue -- --report data/reports/source-health.json > "$RUNNER_TEMP/source-health-summary.md"

      - name: Update the single automated source health issue
        id: health_issue
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          gh label create "source:health" --color fbca04 --description "Source health and maintenance" --force
          existing="$(gh issue list --state all --label "source:health" --limit 100 --json number,body,state \
            --jq '.[] | select(.body | contains("agent-pulse-source-health-summary:v1")) | [.number, .state] | @tsv' | head -n 1)"
          if [[ -n "$existing" ]]; then
            issue_number="${existing%%$'\t'*}"
            issue_state="${existing##*$'\t'}"
            gh issue edit "$issue_number" --body-file "$RUNNER_TEMP/source-health-summary.md"
            if [[ "$issue_state" == "CLOSED" ]]; then gh issue reopen "$issue_number"; fi
          else
            issue_url="$(gh issue create --title "[Source health] Automated source health summary" \
              --label "source:health" --body-file "$RUNNER_TEMP/source-health-summary.md")"
            issue_number="${issue_url##*/}"
          fi
          echo "issue_number=$issue_number" >> "$GITHUB_OUTPUT"

      - name: Verify source health issue freshness
        env:
          GH_TOKEN: ${{ github.token }}
          ISSUE_NUMBER: ${{ steps.health_issue.outputs.issue_number }}
        shell: bash
        run: |
          set -euo pipefail
          test -n "$ISSUE_NUMBER"
          issue_state="$(gh issue view "$ISSUE_NUMBER" --json state --jq '.state')"
          test "$issue_state" = "OPEN"
          gh issue view "$ISSUE_NUMBER" --json body --jq '.body' > "$RUNNER_TEMP/source-health-issue.md"
          grep -F '<!-- agent-pulse-source-health-summary:v1 -->' "$RUNNER_TEMP/source-health-issue.md" >/dev/null
          finished_at="$(jq -r '.finishedAt' data/reports/source-health.json)"
          test -n "$finished_at"
          grep -F "$finished_at" "$RUNNER_TEMP/source-health-issue.md" >/dev/null

      - name: Commit report when changed
        id: commit
        shell: bash
        run: |
          set -euo pipefail
          git add -- data/reports/source-health.json data/snapshot/v1.json
          if git diff --cached --quiet; then
            echo "No report changes."
            echo "changed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -m "chore(data): refresh source health report"
          git rebase origin/main
          git push origin HEAD:main
          echo "changed=true" >> "$GITHUB_OUTPUT"

      - name: Dispatch Pages deployment for material public source changes
        if: steps.commit.outputs.changed == 'true' && steps.public.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run pages.yml --ref main