name: 'Fix Vulnerabilities'
on:
  workflow_dispatch:

jobs:
  run:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      security-events: read
    steps:
      - name: Preflight
        env:
          POE_CODE_AGENT_APP_ID: ${{ secrets.POE_CODE_AGENT_APP_ID }}
          POE_CODE_AGENT_PRIVATE_KEY: ${{ secrets.POE_CODE_AGENT_PRIVATE_KEY }}
          POE_API_KEY: ${{ secrets.POE_API_KEY }}
        run: |
          missing=()
          is_blank() { [[ -z "${1//[[:space:]]/}" ]]; }
          is_blank "$POE_CODE_AGENT_APP_ID" && missing+=("POE_CODE_AGENT_APP_ID")
          is_blank "$POE_CODE_AGENT_PRIVATE_KEY" && missing+=("POE_CODE_AGENT_PRIVATE_KEY")
          is_blank "$POE_API_KEY" && missing+=("POE_API_KEY")
          if [ ${#missing[@]} -gt 0 ]; then
            for name in "${missing[@]}"; do
              echo "::error::Missing required secret: $name — add it in Settings → Secrets and variables → Actions"
            done
            exit 1
          fi
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.POE_CODE_AGENT_APP_ID }}
          private-key: ${{ secrets.POE_CODE_AGENT_PRIVATE_KEY }}
      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm install -g poe-code@latest
      - name: Configure git identity for GitHub App
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          USER_ID=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
          git config --global user.name "${APP_SLUG}[bot]"
          git config --global user.email "${USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"
      - run: poe-code github-workflows prepare fix-vulnerabilities
        env:
          POE_CODE_STDERR_LOGS: "1"
          POE_API_KEY: ${{ secrets.POE_API_KEY }}
      - run: poe-code github-workflows fix-vulnerabilities --yes
        env:
          POE_CODE_STDERR_LOGS: "1"
          POE_API_KEY: ${{ secrets.POE_API_KEY }}
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
          GITHUB_REPOSITORY: ${{ github.repository }}