name: Refresh Lockfile

on:
  push:
    branches:
      - master
  workflow_dispatch:

concurrency:
  group: refresh-lockfile-master
  cancel-in-progress: false

jobs:
  refresh:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          version: 9.15.4
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: 24
          # Resolution-only installs do not populate the package store. Do not
          # claim the shared cache key with an empty archive before full installs.
          package-manager-cache: false

      - name: Refresh pnpm lockfile
        run: pnpm install --resolution-only --ignore-scripts --no-frozen-lockfile

      - name: Refresh reviewed eval report dependency proof
        run: node tests/runner-e2e/prepare-report-lock.mjs --refresh

      - name: Fail on unexpected file changes
        run: |
          changed="$(git status --porcelain)"
          if [ -z "$changed" ]; then
            echo "Lockfile is already up to date."
            exit 0
          fi
          unexpected="$(printf '%s\n' "$changed" | awk '$2 != "pnpm-lock.yaml" && $2 != "tests/runner-e2e/report-lock.json" && $2 != "tests/runner-e2e/report-lock.patch" { print }')"
          if [ -n "$unexpected" ]; then
            echo "Unexpected files changed during lockfile refresh:"
            echo "$changed"
            exit 1
          fi

      - name: Create or update pull request
        id: upsert-pr
        env:
          GH_TOKEN: ${{ github.token }}
          REPO_OWNER: ${{ github.repository_owner }}
        run: |
          if git diff --quiet -- pnpm-lock.yaml; then
            echo "Lockfile unchanged, nothing to do."
            echo "pr_url=" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          BRANCH="chore/refresh-lockfile"
          git config user.name "lockfile-bot"
          git config user.email "lockfile-bot@users.noreply.github.com"

          git checkout -B "$BRANCH"
          git add pnpm-lock.yaml tests/runner-e2e/report-lock.json tests/runner-e2e/report-lock.patch
          git commit -m "chore(lockfile): refresh pnpm-lock.yaml"
          git push --force origin "$BRANCH"

          # Only reuse an open PR from this repository owner, not a fork with the same branch name.
          pr_url="$(
            gh pr list --state open --head "$BRANCH" --json url,headRepositoryOwner \
              --jq ".[] | select(.headRepositoryOwner.login == \"$REPO_OWNER\") | .url" |
            head -n 1
          )"
          if [ -z "$pr_url" ]; then
            pr_body_file="$RUNNER_TEMP/lockfile-pr-body.md"
            cat > "$pr_body_file" <<'PR_BODY'
          ## Thinking Path

          > - Paperclip uses a dependency lock for reproducible builds.
          > - Dependency changes on master need matching lock entries.
          > - Paid eval reports also pin a reviewed offline correction.
          > - Reports must install before paid model work starts.
          > - This automated PR keeps the lock and report proof together.

          ## Linked Issues or Issue Description

          **What happened?**

          Dependency manifests on master changed after the last committed lock refresh.

          **Expected behavior**

          Frozen installs must match those manifests. Eval reports must retain matching offline lock proof.

          **Steps to reproduce**

          Run a frozen install before and after this lock refresh.

          ## What Changed

          - Refresh the dependency lock from the manifests on master.
          - Include the matching offline report correction and hashes.

          ## Verification

          - Pinned pnpm resolution completed with lifecycle scripts disabled.
          - The report proof refresh accepted the reviewed committed baseline.
          - Required PR checks and reviews must pass before merge.

          ## Risks

          Dependency changes require review. Unknown report lock baselines remain blocked. This update changes no permissions or paid enable gates.

          ## Model Used

          None — generated by pnpm and the deterministic report-lock updater.

          ## Checklist

          - [x] Thinking path and problem description included
          - [x] Generated lock and matching report proof included
          - [ ] Required CI checks and reviews pass
          PR_BODY
            pr_url="$(gh pr create \
              --head "$BRANCH" \
              --title "chore(lockfile): refresh pnpm-lock.yaml" \
              --body-file "$pr_body_file")"
            echo "Created new PR: $pr_url"
          else
            echo "PR already exists: $pr_url"
          fi
          echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"

      - name: Enable auto-merge for lockfile PR
        if: steps.upsert-pr.outputs.pr_url != ''
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh pr merge --auto --squash --delete-branch "${{ steps.upsert-pr.outputs.pr_url }}"