name: Spider Bench Comment

on:
  workflow_run:
    workflows: [Spider Bench]
    types: [completed]

# This trusted workflow runs from the default branch. It never executes code
# from the PR checkout and only renders bounded numeric fields from the artifact.
permissions:
  actions: read
  contents: read
  pull-requests: write

jobs:
  comment:
    name: Update PR benchmark comment
    if: >-
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.conclusion != 'cancelled' &&
      github.event.workflow_run.pull_requests[0].head.repo.id == github.event.repository.id &&
      github.event.workflow_run.actor.login != 'dependabot[bot]'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout trusted comment renderer
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          ref: ${{ github.event.repository.default_branch }}

      - name: Download benchmark evidence
        id: evidence
        continue-on-error: true
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: spider-bench-results
          path: spider-bench-results
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Install Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24.15.0

      - name: Render trusted PR comment
        id: render
        env:
          RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}
          CONCLUSION: ${{ github.event.workflow_run.conclusion }}
          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
        run: |
          if [[ "$EVIDENCE_OUTCOME" == success && -f spider-bench-results/comparison.json ]]; then
            node moli-benchmark/browser-spider-local/compare.mjs comment \
              --input spider-bench-results/comparison.json \
              --run-url "$RUN_URL" \
              --conclusion "$CONCLUSION" \
              --output spider-bench-comment.md
            echo "has_comparison=true" >> "$GITHUB_OUTPUT"
          else
            node moli-benchmark/browser-spider-local/compare.mjs infrastructure-comment \
              --run-url "$RUN_URL" \
              --conclusion "$CONCLUSION" \
              --output spider-bench-comment.md
            echo "has_comparison=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Post PR benchmark comment
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        env:
          COMMENT_PATH: spider-bench-comment.md
          COMPARISON_PATH: spider-bench-results/comparison.json
          HAS_COMPARISON: ${{ steps.render.outputs.has_comparison }}
        with:
          script: |
            const fs = require('fs');
            const run = context.payload.workflow_run;
            const association = run.pull_requests?.[0];
            if (!association) {
              core.notice('No pull request is associated with this workflow run.');
              return;
            }

            const pull = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: association.number,
            });
            if (pull.data.head.sha !== association.head.sha) {
              core.notice('Skipping a stale Spider Bench result for an older PR head.');
              return;
            }

            if (process.env.HAS_COMPARISON === 'true') {
              const comparison = JSON.parse(fs.readFileSync(process.env.COMPARISON_PATH, 'utf8'));
              const compared = await github.rest.repos.compareCommitsWithBasehead({
                owner: context.repo.owner,
                repo: context.repo.repo,
                basehead: `${association.base.sha}...${association.head.sha}`,
              });
              const expectedCommonAncestor = compared.data.merge_base_commit?.sha;
              if (
                comparison.head?.sha !== association.head.sha ||
                comparison.base?.sha !== expectedCommonAncestor
              ) {
                core.setFailed(
                  'Spider Bench artifact identities do not match the PR head and common ancestor.'
                );
                return;
              }
            }

            const body = fs.readFileSync(process.env.COMMENT_PATH, 'utf8');
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: association.number,
              body,
            });