# Manually refresh the committed package locks and the pinned Codex installer
# checksum after deliberately changing a direct version in the source files.
#
# The job uploads the generated files for review; it never commits or pushes.

name: refresh-image-locks

on:
  workflow_dispatch:
  push:
    paths:
      - 'requirements.gateway.in'
      - 'bot_bottle/contrib/claude/package.json'
      - 'bot_bottle/contrib/pi/package.json'
      - 'bot_bottle/contrib/codex/Dockerfile'
      - 'image-build-args.json'
      - '.gitea/workflows/refresh-image-locks.yml'

permissions:
  code: read

jobs:
  refresh:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Resolve image runtime versions
        id: runtimes
        run: |
          python3 - <<'PY' >> "$GITHUB_OUTPUT"
          import json
          import re
          inputs = json.load(open("image-build-args.json"))
          for output, name in (
              ("python-version", "PYTHON_BASE_IMAGE"),
              ("node-version", "NODE_BASE_IMAGE"),
          ):
              match = re.search(r":(\d+\.\d+\.\d+)-", inputs[name])
              if match is None:
                  raise SystemExit(f"cannot resolve runtime version from {name}")
              print(f"{output}={match.group(1)}")
          PY

      - name: Use the image Python version
        uses: actions/setup-python@v5
        with:
          python-version: '${{ steps.runtimes.outputs.python-version }}'

      - name: Use the image Node version
        uses: actions/setup-node@v4
        with:
          node-version: '${{ steps.runtimes.outputs.node-version }}'

      - name: Compile gateway Python lock
        run: |
          python3 -m venv /tmp/image-lock-tools
          /tmp/image-lock-tools/bin/python -m pip install \
            pip==25.2 \
            pip-tools==7.5.1
          /tmp/image-lock-tools/bin/python -m piptools compile \
            --generate-hashes \
            --output-file requirements.gateway.lock \
            requirements.gateway.in

      - name: Resolve provider npm locks
        run: |
          for provider in claude pi; do
            (
              cd "bot_bottle/contrib/$provider"
              npm install --package-lock-only --ignore-scripts --no-audit --no-fund
            )
          done
          python3 scripts/complete_npm_lock_integrity.py \
            bot_bottle/contrib/claude/package-lock.json \
            bot_bottle/contrib/pi/package-lock.json

      - name: Refresh pinned Codex archive checksums
        run: |
          CODEX_VERSION=$(
            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
          )
          test -n "$CODEX_VERSION"
          curl -fsSL \
            "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/codex-package_SHA256SUMS" \
            -o bot_bottle/contrib/codex/codex-package_SHA256SUMS

      - name: Upload refreshed inputs
        uses: actions/upload-artifact@v3
        with:
          name: image-input-locks
          path: |
            requirements.gateway.lock
            bot_bottle/contrib/claude/package-lock.json
            bot_bottle/contrib/pi/package-lock.json
            bot_bottle/contrib/codex/codex-package_SHA256SUMS