agent_fix-obi.yml

name: Fix OBI submodule CI

on:
  pull_request:
    types: [labeled]

permissions: {}

concurrency:
  group: "fix-obi-${{ github.event.pull_request.number || github.ref }}"
  cancel-in-progress: true

jobs:
  wait-for-ci:
    name: Wait for CI completion
    if: >
      github.event.action == 'labeled' &&
      github.event.label.name == 'agent/fix-obi' &&
      github.event.pull_request.head.repo.id == github.repository_id
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: read
      id-token: write
    timeout-minutes: 150
    steps:
      - name: Get GitHub App token
        id: get-github-app-token
        uses: grafana/shared-workflows/actions/create-github-app-token@ae92934a14a48b94494dbc06d74a81d47fe08a40 # create-github-app-token/v0.2.2
        with:
          github_app: grafana-beyla-bot

      - name: Wait for all CI checks to complete
        env:
          GH_TOKEN: ${{ steps.get-github-app-token.outputs.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail

          # Exact names to exclude (our own workflow and the supervisor)
          EXCLUDED_NAMES='["Fix OBI submodule CI","CI Supervisor: Rerun flaky failures","Wait for CI completion","Triage CI failures","Plan fixes","Implement and push","Remove agent label","Evaluate failed checks","Add agent/fix-obi label","Add agent/fix-obi-pending label","Handle CI completion","Request Copilot review"]'

          # Retry wrapper for transient GitHub API errors (e.g. 401 token refresh race)
          gh_retry() {
            local attempt
            for attempt in 1 2 3; do
              if output=$("$@" 2>&1); then
                echo "$output"
                return 0
              fi
              echo "::warning::API call failed (attempt ${attempt}/3): $output" >&2
              sleep 10
            done
            echo "::error::API call failed after 3 attempts" >&2
            return 1
          }

          echo "Waiting for all CI checks on PR #${PR_NUMBER} to complete..."

          while true; do
            HEAD_SHA=$(gh_retry gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')

            # Build set of check-suite IDs from pull_request-triggered workflow runs.
            # This excludes schedule/workflow_dispatch/push runs that share the same SHA,
            # matching the approach in scripts/release-train.sh:check_ci_green().
            PR_SUITE_IDS=$(
              gh_retry gh api --paginate -H "Accept: application/vnd.github+json" \
                "repos/${REPO}/actions/runs?head_sha=${HEAD_SHA}&event=pull_request&per_page=100" \
                | jq -s '[ map(.workflow_runs // []) | add // [] | .[].check_suite_id ]'
            )

            # Fetch all check-runs, filter to PR suites + non-Actions apps, deduplicate by name.
            ALL_CHECKS=$(
              gh_retry gh api --paginate -H "Accept: application/vnd.github+json" \
                "repos/${REPO}/commits/${HEAD_SHA}/check-runs?per_page=100" \
                | jq -s '{check_runs: ((map(.check_runs // []) | add) // [])}'
            )

            CHECKS_JSON=$(
              echo "$ALL_CHECKS" \
                | jq --argjson pr_suites "$PR_SUITE_IDS" --argjson excluded "$EXCLUDED_NAMES" \
                  '{check_runs: [
                    .check_runs[]
                    | select(
                        .app.slug != "github-actions"
                        or (.check_suite.id as $id | $pr_suites | index($id))
                      )
                    | select(
                        (.name as $n | $excluded | index($n)) | not
                      )
                  ]}' \
                | jq '{check_runs: [.check_runs | group_by(.name) | .[] | sort_by(.id) | last]}'
            )

            TOTAL=$(echo "$CHECKS_JSON" | jq '.check_runs | length')
            PENDING=$(echo "$CHECKS_JSON" | jq '[.check_runs[] | select(.status != "completed")] | length')

            if [ "$TOTAL" -eq 0 ]; then
              echo "No CI checks found yet. Waiting 60s..."
              sleep 60
              continue
            fi

            if [ "$PENDING" -eq 0 ]; then
              echo "All ${TOTAL} CI checks have completed."

              # Log any non-green checks for visibility
              NON_GREEN=$(echo "$CHECKS_JSON" | jq -r '[.check_runs[] | select(.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped")] | length')
              if [ "$NON_GREEN" -gt 0 ]; then
                echo "Warning: ${NON_GREEN} check(s) are not green:"
                echo "$CHECKS_JSON" | jq -r '.check_runs[] | select(.conclusion != "success" and .conclusion != "neutral" and .conclusion != "skipped") | "  - \(.name): \(.conclusion // "none")"'
              fi
              break
            fi

            echo "${PENDING} of ${TOTAL} checks still pending. Waiting 60s..."
            sleep 60
          done

  triage:
    name: Triage CI failures
    needs: wait-for-ci
    if: >
      github.event.action == 'labeled' &&
      github.event.label.name == 'agent/fix-obi' &&
      github.event.pull_request.head.repo.id == github.repository_id
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    timeout-minutes: 45
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          submodules: recursive
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Generate files
        run: make prereqs vendor-obi

      - name: Get vault secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1
        with:
          repo_secrets: |
            ANTHROPIC_API_KEY=anthropic-token:token

      - name: Get GitHub App token
        id: get-github-app-token
        uses: grafana/shared-workflows/actions/create-github-app-token@ae92934a14a48b94494dbc06d74a81d47fe08a40 # create-github-app-token/v0.2.2
        with:
          github_app: grafana-beyla-bot

      - name: Load triage prompt
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          PROMPT=$(cat .github/prompts/fix-obi/triage.md)
          PROMPT="${PROMPT//\{\{PR_NUMBER\}\}/${PR_NUMBER}}"
          PROMPT="${PROMPT//\{\{PR_TITLE\}\}/${PR_TITLE}}"
          {
            echo 'AGENT_PROMPT<<PROMPT_EOF'
            echo "$PROMPT"
            echo 'PROMPT_EOF'
          } >> "$GITHUB_ENV"

      - name: Run Claude Code – Triage
        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1.0.165
        with:
          anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }}
          github_token: ${{ steps.get-github-app-token.outputs.token }}
          label_trigger: agent/fix-obi
          allowed_bots: "grafana-beyla-bot"
          use_sticky_comment: "true"
          use_commit_signing: "false"
          claude_args: >-
            --max-turns 75
            --allowedTools
            "Bash(cat:*),Bash(gh:*),Bash(grep:*),Bash(head:*),Bash(jq:*),
            Bash(ls:*),Bash(python3:*),Bash(tail:*),Bash(wc:*),
            Glob,Grep,LS,Read,Write,Task,TodoWrite"
          prompt: ${{ env.AGENT_PROMPT }}
        env:
          DISABLE_TELEMETRY: "1"
          DISABLE_ERROR_REPORTING: "1"

      - name: Upload triage artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: triage
          path: triage.md
          if-no-files-found: error

  plan:
    name: Plan fixes
    needs: triage
    if: >
      github.event.action == 'labeled' &&
      github.event.label.name == 'agent/fix-obi' &&
      github.event.pull_request.head.repo.id == github.repository_id
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    timeout-minutes: 45
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          submodules: recursive
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Generate files
        run: make prereqs vendor-obi

      - name: Download triage artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: triage

      - name: Get vault secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1
        with:
          repo_secrets: |
            ANTHROPIC_API_KEY=anthropic-token:token

      - name: Get GitHub App token
        id: get-github-app-token
        uses: grafana/shared-workflows/actions/create-github-app-token@ae92934a14a48b94494dbc06d74a81d47fe08a40 # create-github-app-token/v0.2.2
        with:
          github_app: grafana-beyla-bot

      - name: Load plan prompt
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          PROMPT=$(cat .github/prompts/fix-obi/plan.md)
          PROMPT="${PROMPT//\{\{PR_NUMBER\}\}/${PR_NUMBER}}"
          PROMPT="${PROMPT//\{\{PR_TITLE\}\}/${PR_TITLE}}"
          {
            echo 'AGENT_PROMPT<<PROMPT_EOF'
            echo "$PROMPT"
            echo 'PROMPT_EOF'
          } >> "$GITHUB_ENV"

      - name: Run Claude Code – Plan
        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1.0.165
        with:
          anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }}
          github_token: ${{ steps.get-github-app-token.outputs.token }}
          label_trigger: agent/fix-obi
          allowed_bots: "grafana-beyla-bot"
          use_sticky_comment: "true"
          use_commit_signing: "false"
          claude_args: >-
            --max-turns 100
            --allowedTools
            "Bash(cat:*),Bash(git:*),Bash(grep:*),Bash(head:*),Bash(ls:*),Bash(pwd:*),Bash(tail:*),Bash(wc:*),
            Glob,Grep,LS,Read,Write,Task,TodoWrite"
          prompt: ${{ env.AGENT_PROMPT }}
        env:
          DISABLE_TELEMETRY: "1"
          DISABLE_ERROR_REPORTING: "1"

      - name: Upload plan artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: plan
          path: plan.md
          if-no-files-found: error

  implement:
    name: Implement and push
    needs: plan
    if: >
      github.event.action == 'labeled' &&
      github.event.label.name == 'agent/fix-obi' &&
      github.event.pull_request.head.repo.id == github.repository_id
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    timeout-minutes: 45
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          submodules: recursive
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: go.mod
          cache: false

      - name: Generate files
        run: make prereqs vendor-obi

      - name: Download triage artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: triage

      - name: Download plan artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: plan

      - name: Get vault secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1
        with:
          repo_secrets: |
            ANTHROPIC_API_KEY=anthropic-token:token

      - name: Get GitHub App token
        id: get-github-app-token
        uses: grafana/shared-workflows/actions/create-github-app-token@ae92934a14a48b94494dbc06d74a81d47fe08a40 # create-github-app-token/v0.2.2
        with:
          github_app: grafana-beyla-bot

      - name: Load implement prompt
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          PROMPT=$(cat .github/prompts/fix-obi/implement.md)
          PROMPT="${PROMPT//\{\{PR_NUMBER\}\}/${PR_NUMBER}}"
          PROMPT="${PROMPT//\{\{PR_TITLE\}\}/${PR_TITLE}}"
          {
            echo 'AGENT_PROMPT<<PROMPT_EOF'
            echo "$PROMPT"
            echo 'PROMPT_EOF'
          } >> "$GITHUB_ENV"

      - name: Run Claude Code – Implement
        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1.0.165
        with:
          anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }}
          github_token: ${{ steps.get-github-app-token.outputs.token }}
          label_trigger: agent/fix-obi
          allowed_bots: "grafana-beyla-bot"
          use_sticky_comment: "true"
          use_commit_signing: "true"
          claude_args: >-
            --max-turns 100
            --allowedTools
            "Bash(bash:*),Bash(cat:*),Bash(date:*),Bash(echo:*),Bash(gh:*),
            Bash(git:*),Bash(go:*),Bash(grep:*),Bash(head:*),Bash(jq:*),
            Bash(ls:*),Bash(make:*),Bash(python3:*),Bash(pwd:*),
            Bash(sh:*),Bash(sort:*),Bash(tail:*),Bash(uniq:*),Bash(wc:*),
            Edit,MultiEdit,Glob,Grep,LS,Read,Write,Task,TodoWrite,
            mcp__github_file_ops__commit_files,
            mcp__github_file_ops__delete_files,
            mcp__github_file_ops__update_claude_comment,
            mcp__github_file_ops__create_or_update_file"
          prompt: ${{ env.AGENT_PROMPT }}
        env:
          DISABLE_TELEMETRY: "1"
          DISABLE_ERROR_REPORTING: "1"

  cleanup:
    name: Remove agent label
    needs: implement
    if: always() && github.event.label.name == 'agent/fix-obi'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      id-token: write
    timeout-minutes: 5
    steps:
      - name: Get GitHub App token
        id: get-github-app-token
        uses: grafana/shared-workflows/actions/create-github-app-token@ae92934a14a48b94494dbc06d74a81d47fe08a40 # create-github-app-token/v0.2.2
        with:
          github_app: grafana-beyla-bot

      - name: Remove agent/fix-obi label
        env:
          GH_TOKEN: ${{ steps.get-github-app-token.outputs.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPO: ${{ github.repository }}
        run: |
          echo "Removing agent labels from PR #${PR_NUMBER} to allow re-triggering"
          gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "agent/fix-obi" || true
          gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "agent/fix-obi-pending" || true