# Drift detection for the experimental interceptor SEP pin (ADR-012).
#
# The interceptor surface validates against a schema we vendor locally, derived
# by hand from modelcontextprotocol/experimental-ext-interceptors @ ${PINNED_SHA}
# (SEP-2133). Per ADR-012 we bump that pin on a DELIBERATE cadence, not
# reactively. This scheduled check flags when upstream has moved so a re-pin is a
# planned decision -- it never touches code, it only opens an informational issue.
# PINNED_SHA below is the canonical machine-readable pin; bumping it and
# re-deriving the vendored schema (tests/unit/test_interceptors_list_schema.py)
# go together.
name: interceptor-pin-drift

on:
  schedule:
    - cron: "0 7 * * 1"  # weekly, Monday 07:00 UTC
  workflow_dispatch:

permissions:
  contents: read
  issues: write

env:
  UPSTREAM: modelcontextprotocol/experimental-ext-interceptors
  PINNED_SHA: 2f66b9b4af1106162afc393d16576a77e2866a05

jobs:
  drift:
    runs-on: ubuntu-latest
    steps:
      # The upstream read uses GITHUB_TOKEN, not the App: an installation token
      # is scoped to this organization, and the repository being compared is
      # somebody else's. Only the writes below need to be attributable to the
      # App.
      - name: Compare pinned SHA to upstream HEAD
        id: drift
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          head="$(gh api "repos/${UPSTREAM}/commits/HEAD" --jq '.sha')"
          short="${head:0:7}"
          pinned_short="${PINNED_SHA:0:7}"
          echo "pinned=${pinned_short} upstream_head=${short}"
          if [ "${head}" = "${PINNED_SHA}" ]; then
            echo "No drift; interceptor pin is current."
            exit 0
          fi
          echo "::warning::Interceptor pin ${pinned_short} is behind upstream ${short} (ADR-012)."
          {
            echo "drifted=true"
            echo "short=${short}"
            echo "pinned_short=${pinned_short}"
          } >> "$GITHUB_OUTPUT"

      # Filed as the App, and that is the whole point rather than a detail.
      #
      # An event raised by GITHUB_TOKEN does not start a workflow, so an issue
      # filed with it was invisible to project-add and #1158 sat off the board
      # from 2026-08-31 until it was put there by hand. This job used to carry
      # its own three-call board step to work around that. An App is not
      # GITHUB_TOKEN: the issue it files raises `issues: opened` like any
      # other, project-board reacts, and the workaround is gone.
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        if: steps.drift.outputs.drifted == 'true'
        with:
          client-id: Iv23li8REbSH4JUkiLb7  # mcp-hangar-release-bot, public
          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}

      - name: File or update the drift notice
        if: steps.drift.outputs.drifted == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          SHORT: ${{ steps.drift.outputs.short }}
          PINNED_SHORT: ${{ steps.drift.outputs.pinned_short }}
        run: |
          set -euo pipefail
          if [ -z "${GH_TOKEN}" ]; then
            echo "::warning::The App produced no token; the drift notice was not filed. Pin ${PINNED_SHORT} is behind upstream ${SHORT}."
            exit 0
          fi
          title="interceptor pin drift: upstream moved to ${SHORT}"
          body="The vendored interceptor schema is pinned to \`${PINNED_SHORT}\` (ADR-012), but \`${UPSTREAM}\` HEAD is now \`${SHORT}\`. Per the deliberate-cadence policy, review the upstream diff and decide whether to bump the pin + re-derive the vendored schema (tests/unit/test_interceptors_list_schema.py), or hold. Informational -- not a forced bump."
          existing="$(gh issue list -R "${GITHUB_REPOSITORY}" --state open --search "in:title interceptor pin drift" --json url --jq '.[0].url // ""')"
          if [ -n "${existing}" ]; then
            gh issue comment "${existing}" -R "${GITHUB_REPOSITORY}" --body "Still drifted: upstream HEAD is now \`${SHORT}\`."
          elif gh issue create -R "${GITHUB_REPOSITORY}" --title "${title}" --body "${body}" --label "type/chore"; then
            :
          else
            gh issue create -R "${GITHUB_REPOSITORY}" --title "${title}" --body "${body}"
          fi