pr-comment.yml

name: agent-config-regression

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write

concurrency:
  group: agent-config-comment-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  regression:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: LE0-Lin/AgentConfigScore@v0
        id: acs

      - name: Create or update score comment
        if: >-
          ${{ !cancelled() && steps.acs.outputs.head-score != '' &&
              github.event.pull_request.head.repo.full_name == github.repository }}
        continue-on-error: true
        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
        env:
          ACS_BASE_SCORE: ${{ steps.acs.outputs.base-score }}
          ACS_HEAD_SCORE: ${{ steps.acs.outputs.head-score }}
          ACS_DELTA: ${{ steps.acs.outputs.delta }}
          ACS_NEW_FINDINGS: ${{ steps.acs.outputs.new-findings }}
          ACS_NEW_ERRORS: ${{ steps.acs.outputs.new-errors }}
          ACS_RESOLVED: ${{ steps.acs.outputs.resolved-findings }}
          ACS_OUTCOME: ${{ steps.acs.outcome }}
        with:
          script: |
            const integer = (name, min, max = Number.MAX_SAFE_INTEGER) => {
              const raw = process.env[name] || '';
              if (!/^-?\d+$/.test(raw)) throw new Error(`Invalid ${name}`);
              const value = Number(raw);
              if (!Number.isSafeInteger(value) || value < min || value > max) {
                throw new Error(`Out-of-range ${name}`);
              }
              return value;
            };
            const base = integer('ACS_BASE_SCORE', 0, 100);
            const head = integer('ACS_HEAD_SCORE', 0, 100);
            const delta = integer('ACS_DELTA', -100, 100);
            const added = integer('ACS_NEW_FINDINGS', 0);
            const errors = integer('ACS_NEW_ERRORS', 0);
            const resolved = integer('ACS_RESOLVED', 0);
            if (delta !== head - base || errors > added) {
              throw new Error('Inconsistent AgentConfigScore outputs');
            }
            const outcome = process.env.ACS_OUTCOME;
            if (!['success', 'failure'].includes(outcome)) {
              throw new Error('Missing regression outcome');
            }
            const marker = '<!-- agent-config-score:regression -->';
            const runUrl = `${process.env.GITHUB_SERVER_URL}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            const body = [
              marker,
              '### AgentConfigScore',
              '',
              `**${outcome === 'success' ? 'Passed' : 'Blocked'}** · Score: ${base} → ${head} (${delta > 0 ? '+' : ''}${delta})`,
              '',
              '| New findings | New errors | Resolved |',
              '|---:|---:|---:|',
              `| ${added} | ${errors} | ${resolved} |`,
              '',
              `[View findings and policy result](${runUrl})`,
              '',
              'The score covers detected rule matches; review individual findings.',
            ].join('\n');
            const comments = await github.paginate(github.rest.issues.listComments, {
              ...context.repo,
              issue_number: context.issue.number,
              per_page: 100,
            });
            const existing = comments.find(comment =>
              comment.user?.type === 'Bot' &&
              comment.user?.login === 'github-actions[bot]' &&
              comment.body?.startsWith(marker)
            );
            if (existing) {
              if (existing.body !== body) {
                await github.rest.issues.updateComment({
                  ...context.repo, comment_id: existing.id, body,
                });
              }
            } else {
              await github.rest.issues.createComment({
                ...context.repo, issue_number: context.issue.number, body,
              });
            }