mortgage.yaml

name: Company Town — Record Mortgage

# Fires when a `[registration]` PR merges. The clerk can't write to a
# contributor's fork, so the purchase price (carried in a hidden marker on the
# bill-of-sale comment) is booked onto debt.yaml on the base branch now, via an
# auto-merging PR. It then catches up paystubs and clears the registration holds
# on the new employee's other open PRs.
#
# This runs entirely against the base repo, so there is no fork checkout and none
# of the gh-repo / local-remote pitfalls of the registration job.
on:
  pull_request_target:
    types: [closed]

permissions:
  contents: write
  pull-requests: write
  issues: read

concurrency:
  group: mortgage-${{ github.event.pull_request.number }}
  cancel-in-progress: false

jobs:
  record:
    if: ${{ github.event.pull_request.merged == true && contains(github.event.pull_request.title, '[registration]') }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      GH_REPO: ${{ github.repository }}
      PR_NUMBER: ${{ github.event.pull_request.number }}
      USERNAME: ${{ github.event.pull_request.user.login }}

    steps:
      - name: Mint the clerk's GitHub App token
        id: clerk
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.AGENTPIPE_CLERK_APP_ID }}
          private-key: ${{ secrets.AGENTPIPE_CLERK_PRIVATE_KEY }}

      - name: Authenticate gh as the clerk
        run: echo "GH_TOKEN=${{ steps.clerk.outputs.token }}" >> "$GITHUB_ENV"

      - name: Checkout the base branch (latest)
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.ref }}
          token: ${{ steps.clerk.outputs.token }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install PyYAML
        run: python -m pip install --quiet pyyaml

      - name: Read the mortgage price from the clerk's bill of sale
        id: bill
        run: |
          set -euo pipefail
          # Only trust the marker on a comment the clerk itself authored. Reading
          # any comment would let an agent forge their own mortgage amount.
          AMOUNT="$(gh api --paginate "repos/${GH_REPO}/issues/${PR_NUMBER}/comments" \
            --jq '.[] | select(.user.login == "agentpipe-clerk[bot]") | .body' \
            | sed -nE 's/.*AGENTPIPE-MORTGAGE amount=(-?[0-9]+).*/\1/p' | tail -1)"
          if [ -z "$AMOUNT" ]; then
            echo "::warning::No clerk mortgage marker found on PR #${PR_NUMBER}; nothing to book."
          fi
          echo "amount=$AMOUNT" >> "$GITHUB_OUTPUT"

      - name: Book the mortgage on the base ledger
        if: steps.bill.outputs.amount != ''
        env:
          DEBT: ${{ steps.bill.outputs.amount }}
        run: |
          set -euo pipefail
          CLERK_ID="$(gh api '/users/agentpipe-clerk[bot]' --jq .id)"
          git config user.name 'agentpipe-clerk[bot]'
          git config user.email "${CLERK_ID}+agentpipe-clerk[bot]@users.noreply.github.com"

          DEBT_FILE=debt.yaml python .github/scripts/record_debt.py
          if git diff --quiet -- debt.yaml; then
            echo "debt.yaml already records @${USERNAME}; nothing to do."
            exit 0
          fi

          BRANCH="auto/mortgage-${USERNAME}-${{ github.run_id }}"
          TITLE="🏚️ Issue mortgage for @${USERNAME} (registration #${PR_NUMBER})"
          BODY="Recording the purchase price for newly-registered @${USERNAME}, deeded in #${PR_NUMBER}."
          git checkout -b "$BRANCH"
          git add debt.yaml
          git commit -m "$TITLE"
          git push origin "$BRANCH"
          gh pr create \
            --title "$TITLE" --body "$BODY" \
            --base "${{ github.event.pull_request.base.ref }}" --head "$BRANCH" \
            --label "automated" \
          || gh pr create \
            --title "$TITLE" --body "$BODY" \
            --base "${{ github.event.pull_request.base.ref }}" --head "$BRANCH"
          gh pr merge "$BRANCH" --squash --delete-branch
          echo "Booked @${USERNAME}'s ${DEBT} ETH mortgage. 🏚️"

      - name: Catch up paystubs and clear registration holds on the new employee's open PRs
        # Now that they're on the payroll, post a paystub on each of their other
        # open PRs and dismiss the clerk's stale registration-hold reviews. The
        # working tree carries the just-booked debt.yaml, so paystub balances are
        # correct; employees.yaml is the merged base, so paystub.py recognises them.
        env:
          EMPLOYEES_FILE: employees.yaml
          DEBT_FILE: debt.yaml
        run: |
          set -uo pipefail
          prs=$(gh pr list --state open --author "$USERNAME" --json number --jq '.[].number')
          for pr in $prs; do
            echo "Posting catch-up paystub on PR #$pr for @${USERNAME}"
            PR_NUMBER="$pr" PR_AUTHOR="$USERNAME" python .github/scripts/paystub.py \
              || echo "::warning::could not post paystub on PR #$pr"

            review_ids=$(gh api --paginate "repos/${GH_REPO}/pulls/${pr}/reviews" \
              --jq '.[] | select(.state == "CHANGES_REQUESTED" and .user.login == "agentpipe-clerk[bot]") | .id')
            for rid in $review_ids; do
              echo "Dismissing registration hold (review $rid) on PR #$pr"
              gh api --method PUT \
                "repos/${GH_REPO}/pulls/${pr}/reviews/${rid}/dismissals" \
                -f message="Welcome aboard, @${USERNAME} — you're now a registered employee, so this registration hold is dismissed." \
                -f event=DISMISS \
                || echo "::warning::could not dismiss review $rid on PR #$pr"
            done
          done