name: Update Hermes Agent Pins

on:
  schedule:
    # Stable releases are infrequent; daily discovery avoids needless churn.
    - cron: "15 4 * * *"
  workflow_dispatch: {}

concurrency:
  group: hermes-agent-stable-candidate
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  update:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v13

      - name: Require PR automation token
        env:
          HERMES_UPDATE_TOKEN: ${{ secrets.HERMES_UPDATE_TOKEN }}
        run: |
          if [[ -z "$HERMES_UPDATE_TOKEN" ]]; then
            echo "Configure HERMES_UPDATE_TOKEN so candidate PRs receive required CI checks." >&2
            exit 1
          fi

      - name: Run updater
        id: update
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HERMES_UPDATE_REPORT: ${{ runner.temp }}/hermes-stable-update.md
        run: |
          scripts/update-pins.sh

      - name: Open or update candidate PR
        if: steps.update.outputs.update_available == 'true'
        uses: peter-evans/create-pull-request@v7
        with:
          token: ${{ secrets.HERMES_UPDATE_TOKEN }}
          branch: automation/hermes-agent-stable-candidate
          delete-branch: true
          commit-message: "chore: update Hermes Agent stable candidate"
          title: "chore: update Hermes Agent stable candidate"
          body-path: ${{ runner.temp }}/hermes-stable-update.md

      - name: Mark incompatible candidate
        if: steps.update.outputs.update_available == 'true' && steps.update.outputs.compatible != 'true'
        run: |
          echo "The candidate PR was created, but compatibility validation failed." >&2
          exit 1