name: Query Agent Caller (openobserve)

# Thin caller: watches openobserve (OSS) PRs and forwards to the reusable
# Query Agent engine in o2-enterprise. All real logic (triage, build, test,
# generation) lives in the engine; this file only gates (allowlist + command
# detection) and forwards.
#
# WHY A CALLER (not self-contained): a reusable workflow runs in the CALLER's
# context, so triggering from here makes the run use openobserve's own
# GITHUB_TOKEN / github-actions[bot] — which can comment on OSS PRs, push
# to OSS branches (for Phase B autoqa commits), and create OSS PRs. The
# engine file in o2-enterprise would run in ENT context and could NOT do any
# of these for OSS.
#
# TWO ENTRY POINTS:
#   - issue_comment    → an allowlisted engineer comments /query-agent or
#                        /qa-generate on an OSS PR.
#   - workflow_dispatch → manual "Run workflow" button against a PR number.
#                         Dispatch is inherently restricted to repo write access.
#
# ACCESS CONTROL (comment path): gate on the commenter being in the hardcoded
# engineering-team allowlist. This is checked here AND re-validated in the
# engine's triage job (harmless double-check).
#
# SECRETS: DEEPSEEK_API_KEY_E2E and ORG_ADMIN_TOKEN must exist in
# openobserve secrets. E2E_DEV_CI_TOKEN is forwarded as CROSS_REPO_TOKEN
# for any ENT-side cross-repo operations.

on:
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "OSS PR number to run Query Agent on"
        required: true
      dry_run:
        description: "Triage only — skip tests and generation"
        type: boolean
        default: true
      generation_mode:
        description: "Phase B: generate new SQL queries for this PR"
        type: choice
        required: false
        default: "none"
        options:
          - none
          - full

permissions:
  contents: read
  pull-requests: write
  issues: write

concurrency:
  group: query-agent-openobserve-${{ github.event.issue.number || github.event.inputs.pr_number || github.ref }}
  cancel-in-progress: true

jobs:
  # Validate workflow_dispatch inputs before forwarding to the engine.
  # Skipped for issue_comment events (no inputs to validate).
  validate_inputs:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - name: Validate pr_number is a positive integer
        env:
          PR_NUMBER: ${{ inputs.pr_number }}
        run: |
          if ! echo "$PR_NUMBER" | grep -qE '^[0-9]+$'; then
            echo "::error::pr_number must be a positive integer, got: $PR_NUMBER"
            exit 1
          fi

  call-query-agent:
    needs: [validate_inputs]
    # Manual dispatch: always run (restricted to repo write access by GitHub).
    # Comment: only if the commenter is on the allowlist AND the command matches.
    if: >
      github.event_name == 'workflow_dispatch' ||
      (github.event.issue.pull_request &&
       contains(fromJSON('["/query-agent","/qa-generate"]'), github.event.comment.body) &&
       contains(fromJSON('["bjp232004","hengfeiyang","prabhatsharma","uddhavdave","oasisk","haohuaijin","Subhra264","Loaki07","007harshmahajan","chaitanya-sistla","ktx-kirtan","omkarK06","ktx-vaidehi","ktx-abhay","neha00290","ktx-akshay","ktx-sadhna","nikhilsaikethe","YashodhanJoshi1","ktx-riya","mmosarafO2","Shrinath-O2","ktx-mihir","vamsikarthikr","pr1sm8"]'), github.actor))
    uses: openobserve/o2-enterprise/.github/workflows/query-agent.yml@cb74bab8b9da410f525f7931a9396ec8cd885665
    with:
      source_repo: openobserve
      # dispatch supplies pr_number directly; comment path uses the commented PR number.
      pr_number: ${{ inputs.pr_number || github.event.issue.number }}
      # generation_mode: dispatch uses the typed choice; comment path: /qa-generate → full.
      generation_mode: ${{ github.event_name == 'workflow_dispatch' && (inputs.generation_mode || 'none') || (github.event.comment.body == '/qa-generate' && 'full' || 'none') }}
      # dry_run: dispatch honors the typed boolean; comment path always runs (not dry).
      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
      actor: ${{ github.actor }}
    secrets:
      DEEPSEEK_API_KEY_E2E: ${{ secrets.DEEPSEEK_API_KEY_E2E }}
      ORG_ADMIN_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
      CROSS_REPO_TOKEN: ${{ secrets.E2E_DEV_CI_TOKEN }}