name: Spider Bench Report

on:
  workflow_run:
    workflows: [CI]
    types: [in_progress]

concurrency:
  group: spider-bench-report-${{ github.event.workflow_run.pull_requests[0].number || github.event.workflow_run.id }}
  cancel-in-progress: true

# This trusted workflow starts with CI, then waits only for the immutable v4
# artifact. It runs from the default branch, never executes PR code, and renders
# only bounded numeric fields into an Actions summary and an upserted PR comment.
permissions:
  actions: read
  contents: read
  pull-requests: write

jobs:
  comment:
    name: Publish benchmark report
    if: >-
      github.event.workflow_run.event == 'pull_request' &&
      github.event.workflow_run.pull_requests[0].head.repo.id == github.event.repository.id &&
      github.event.workflow_run.actor.login != 'dependabot[bot]'
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: Checkout trusted comment renderer
        uses: actions/checkout@v4
        with:
          persist-credentials: false
          ref: ${{ github.event.repository.default_branch }}

      - name: Wait for benchmark evidence
        id: wait
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        env:
          ARTIFACT_NAME: spider-bench-results
        with:
          retries: 3
          script: |
            const waitForWorkflowArtifact = require(
              './.github/scripts/wait-for-workflow-artifact.cjs'
            );
            await waitForWorkflowArtifact({
              github,
              context,
              core,
              artifactName: process.env.ARTIFACT_NAME,
            });

      - name: Download benchmark evidence
        if: steps.wait.outputs.artifact_available == 'true'
        id: evidence
        continue-on-error: true
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: spider-bench-results
          path: spider-bench-results
          github-token: ${{ secrets.GITHUB_TOKEN }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Install Node.js
        if: steps.wait.outputs.conclusion != 'cancelled'
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24.15.0

      - name: Render trusted PR comment
        if: steps.wait.outputs.conclusion != 'cancelled'
        id: render
        env:
          RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}
          CONCLUSION: ${{ steps.wait.outputs.conclusion || 'failure' }}
          EVIDENCE_OUTCOME: ${{ steps.evidence.outcome }}
        run: |
          if [[ "$EVIDENCE_OUTCOME" == success && -f spider-bench-results/comparison.json ]]; then
            node moli-benchmark/browser-spider-local/compare.mjs comment \
              --input spider-bench-results/comparison.json \
              --run-url "$RUN_URL" \
              --conclusion success \
              --output spider-bench-comment.md
            echo "has_comparison=true" >> "$GITHUB_OUTPUT"
          else
            node moli-benchmark/browser-spider-local/compare.mjs infrastructure-comment \
              --run-url "$RUN_URL" \
              --conclusion "$CONCLUSION" \
              --output spider-bench-comment.md
            echo "has_comparison=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish Actions report
        if: steps.wait.outputs.conclusion != 'cancelled'
        run: cat spider-bench-comment.md >> "$GITHUB_STEP_SUMMARY"

      - name: Post PR benchmark comment
        if: steps.wait.outputs.conclusion != 'cancelled'
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        env:
          COMMENT_PATH: spider-bench-comment.md
          COMPARISON_PATH: spider-bench-results/comparison.json
          HAS_COMPARISON: ${{ steps.render.outputs.has_comparison }}
        with:
          script: |
            const fs = require('fs');
            const run = context.payload.workflow_run;
            const association = run.pull_requests?.[0];
            if (!association) {
              core.notice('No pull request is associated with this workflow run.');
              return;
            }

            const pull = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: association.number,
            });
            if (pull.data.head.sha !== association.head.sha) {
              core.notice('Skipping a stale Spider Bench result for an older PR head.');
              return;
            }

            if (process.env.HAS_COMPARISON === 'true') {
              const comparison = JSON.parse(fs.readFileSync(process.env.COMPARISON_PATH, 'utf8'));
              const compared = await github.rest.repos.compareCommitsWithBasehead({
                owner: context.repo.owner,
                repo: context.repo.repo,
                basehead: `${association.base.sha}...${association.head.sha}`,
              });
              const expectedCommonAncestor = compared.data.merge_base_commit?.sha;
              if (
                comparison.head?.sha !== association.head.sha ||
                comparison.base?.sha !== expectedCommonAncestor
              ) {
                core.setFailed(
                  'Spider Bench artifact identities do not match the PR head and common ancestor.'
                );
                return;
              }
            }

            const body = fs.readFileSync(process.env.COMMENT_PATH, 'utf8');
            const marker = '<!-- moli-spider-bench -->';
            if (!body.includes(marker) || Buffer.byteLength(body, 'utf8') > 32 * 1024) {
              core.setFailed('Rendered Spider Bench comment is missing its marker or exceeds 32 KiB.');
              return;
            }
            const comments = await github.paginate(github.rest.issues.listComments, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: association.number,
              per_page: 100,
            });
            const existing = comments.find(
              (comment) =>
                comment.user?.login === 'github-actions[bot]' &&
                comment.body?.includes(marker)
            );
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: association.number,
                body,
              });
            }