sync-microsoft-foundry.yml

name: Sync microsoft-foundry canvas

on:
  workflow_dispatch:
    inputs:
      source_ref:
        description: "Branch, tag, or commit from SmallBlackHole/foundry-agent-canvas"
        required: true
        default: "main"
        type: string
      marketplace_version:
        description: "Optional new marketplace version using stable X.Y.Z format"
        required: false
        type: string

permissions:
  contents: read

env:
  CANVAS_SOURCE_REF: ${{ inputs.source_ref || 'main' }}
  MARKETPLACE_VERSION: ${{ inputs.marketplace_version || '' }}

concurrency:
  group: sync-microsoft-foundry
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      source_sha: ${{ steps.source.outputs.sha }}
      source_short_sha: ${{ steps.source.outputs.short_sha }}

    steps:
      - name: Checkout canvas source
        uses: actions/checkout@v4
        with:
          repository: SmallBlackHole/foundry-agent-canvas
          ref: ${{ env.CANVAS_SOURCE_REF }}
          path: source
          persist-credentials: false

      - name: Resolve source commit
        id: source
        working-directory: source
        shell: bash
        run: |
          set -euo pipefail
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
          echo "short_sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20.19"

      - name: Install dependencies
        working-directory: source
        run: npm ci

      - name: Run tests
        working-directory: source
        run: npm test

      - name: Build package
        working-directory: source
        shell: bash
        env:
          FOUNDRY_CANVAS_APPINSIGHTS_CONNECTION_STRING: ${{ secrets.FOUNDRY_CANVAS_APPINSIGHTS_CONNECTION_STRING }}
        run: |
          set -euo pipefail

          if [[ -z "$FOUNDRY_CANVAS_APPINSIGHTS_CONNECTION_STRING" ]]; then
            echo "::error::FOUNDRY_CANVAS_APPINSIGHTS_CONNECTION_STRING is not configured"
            exit 1
          fi

          npm run package

          node <<'NODE'
          const { readFileSync } = require("node:fs");

          const connectionString =
            process.env.FOUNDRY_CANVAS_APPINSIGHTS_CONNECTION_STRING || "";
          const encoded = Buffer.from(connectionString, "utf8").toString("base64");
          const bundle = readFileSync("dist/pkg/extension.mjs", "utf8");

          if (!encoded || !bundle.includes(encoded)) {
            throw new Error("Packaged extension is missing the bundled telemetry configuration");
          }
          if (bundle.includes(connectionString)) {
            throw new Error("Packaged extension contains the raw telemetry connection string");
          }
          NODE

      - name: Validate package
        working-directory: source
        shell: bash
        run: |
          set -euo pipefail
          test -f dist/pkg/extension.mjs
          test -f dist/pkg/package.json
          test -d dist/pkg/public
          test -d dist/pkg/inspector-ui
          node --check dist/pkg/extension.mjs

      - name: Upload runtime package
        uses: actions/upload-artifact@v4
        with:
          name: microsoft-foundry-${{ steps.source.outputs.short_sha }}
          path: |
            source/dist/pkg/extension.mjs
            source/dist/pkg/package.json
            source/dist/pkg/public
            source/dist/pkg/inspector-ui
          if-no-files-found: error
          retention-days: 3

  publish:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout workflow automation
        uses: actions/checkout@v4
        with:
          ref: ${{ github.sha }}
          path: automation
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20.19"

      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.SYNC_APP_ID }}
          private-key: ${{ secrets.SYNC_APP_PRIVATE_KEY }}

      - name: Checkout foundry-toolkit
        uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
          ref: main
          fetch-depth: 0
          path: target
          persist-credentials: false

      - name: Download runtime package
        uses: actions/download-artifact@v4
        with:
          name: microsoft-foundry-${{ needs.build.outputs.source_short_sha }}
          path: bundle

      - name: Sync runtime package
        run: |
          node automation/.github/scripts/sync_microsoft_foundry.mjs \
            bundle \
            target/microsoft-foundry/extensions/microsoft-foundry \
            target/microsoft-foundry/.github/plugin/plugin.json \
            "$MARKETPLACE_VERSION"

      - name: Resolve pull request metadata
        id: metadata
        shell: bash
        env:
          SOURCE_SHORT_SHA: ${{ needs.build.outputs.source_short_sha }}
        run: |
          set -euo pipefail

          if [[ -n "$MARKETPLACE_VERSION" ]]; then
            branch_suffix="v$MARKETPLACE_VERSION"
            title="chore: sync microsoft-foundry v$MARKETPLACE_VERSION"
            version_label="$MARKETPLACE_VERSION"
          else
            branch_suffix="$SOURCE_SHORT_SHA"
            title="chore: sync microsoft-foundry ($SOURCE_SHORT_SHA)"
            version_label="unchanged"
          fi

          {
            echo "branch_suffix=$branch_suffix"
            echo "title=$title"
            echo "version_label=$version_label"
          } >> "$GITHUB_OUTPUT"

      - name: Detect package changes
        id: diff
        shell: bash
        run: |
          set -euo pipefail

          git -C target add -- \
            microsoft-foundry/.github/plugin/plugin.json \
            microsoft-foundry/extensions/microsoft-foundry/extension.mjs \
            microsoft-foundry/extensions/microsoft-foundry/package.json \
            microsoft-foundry/extensions/microsoft-foundry/public \
            microsoft-foundry/extensions/microsoft-foundry/inspector-ui

          if git -C target diff --cached --quiet -- microsoft-foundry; then
            echo "No package changes detected."
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          git -C target diff --cached --stat -- microsoft-foundry
          echo "has_changes=true" >> "$GITHUB_OUTPUT"

          {
            echo "## Sync microsoft-foundry canvas"
            echo
            echo "- Source: \`SmallBlackHole/foundry-agent-canvas@${{ needs.build.outputs.source_sha }}\`"
            echo "- Marketplace version: \`${{ steps.metadata.outputs.version_label }}\`"
            echo
            echo "### Changed files"
            echo
            echo '```text'
            git -C target diff --cached --name-status -- microsoft-foundry
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Create draft pull request
        if: steps.diff.outputs.has_changes == 'true'
        id: cpr
        uses: peter-evans/create-pull-request@v8
        with:
          token: ${{ steps.app-token.outputs.token }}
          path: target
          base: main
          branch: bot/sync-microsoft-foundry-${{ steps.metadata.outputs.branch_suffix }}
          delete-branch: true
          draft: always-true
          commit-message: ${{ steps.metadata.outputs.title }}
          title: ${{ steps.metadata.outputs.title }}
          body: |
            ## Summary
            This automated draft PR updates the bundled Microsoft Foundry runtime.

            ## Source
            - Repository: `SmallBlackHole/foundry-agent-canvas`
            - Requested ref: `${{ env.CANVAS_SOURCE_REF }}`
            - Resolved commit: `${{ needs.build.outputs.source_sha }}`
            - Marketplace version: `${{ steps.metadata.outputs.version_label }}`
            - Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            ## Validation
            - `npm ci`
            - `npm test`
            - Telemetry-enabled `npm run package`
            - `node --check dist/pkg/extension.mjs`
          add-paths: |
            microsoft-foundry/.github/plugin/plugin.json
            microsoft-foundry/extensions/microsoft-foundry/extension.mjs
            microsoft-foundry/extensions/microsoft-foundry/package.json
            microsoft-foundry/extensions/microsoft-foundry/public
            microsoft-foundry/extensions/microsoft-foundry/inspector-ui

      - name: Report pull request
        if: steps.diff.outputs.has_changes == 'true'
        shell: bash
        env:
          PR_OPERATION: ${{ steps.cpr.outputs.pull-request-operation }}
          PR_URL: ${{ steps.cpr.outputs.pull-request-url }}
          PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
        run: |
          {
            echo
            echo "## Pull Request"
            echo
            echo "- Operation: \`${PR_OPERATION:-unknown}\`"
            echo "- PR: [#${PR_NUMBER:-?}](${PR_URL})"
          } >> "$GITHUB_STEP_SUMMARY"