pr-orchestrator.yml

name: Gemini Orchestrator

on:
  pull_request:
    types: [opened, synchronize]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR Number (optional, for manual trigger context)'
        required: false
        type: string
      base_ref:
        description: 'Base branch for path filtering'
        required: false
        type: string
      base_branch:
        description: 'Base branch for protection rules lookup'
        required: false
        type: string
      head_ref:
        description: 'Head branch for path filtering'
        required: false
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write
  issues: write
  checks: write
  actions: read

jobs:
  welcome:
    name: 👋 PR Welcome & Reminder
    if: github.event_name == 'pull_request' && github.event.action == 'opened'
    runs-on: ubuntu-latest
    steps:
      - name: Post Welcome Comment
        uses: actions/github-script@v7
        with:
          script: |
            const body = '## 👋 Welcome to HRM!\n\n' +
              'Thanks for your contribution. This repository uses Gemini AI for automated triage, code review, and generation.\n\n' +
              '#### 🤖 Gemini Manual Trigger Quick Reference\n' +
              '| Command | Action |\n' +
              '| :--- | :--- |\n' +
              '| `@gemini-bot` | Run AI Code Review (PR only) |\n' +
              '| `@gemini-enrich` | Run PR Enrichment (PR only) |\n' +
              '| `@gemini-triage` | Run Issue Triage |\n' +
              '| `@gemini-coder <task>` | Generate Code |\n' +
              '| `@create-review-issues` | Create issues from review (PR only) |\n' +
              '| `@gemini-help` | Show this help message |\n' +
              '| `@pr-squash` | Squash PR commits (PR only) |\n' +
              '| `@conflict-resolve` | Resolve merge conflicts (PR only) |\n\n' +
              'For more details and GitHub CLI examples, see the [Manual Trigger Guide](' + context.payload.repository.html_url + '/blob/leader/docs/workflows/MANUAL_TRIGGERS.md).';

            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
              body: body
            });

  filter:
    name: 🔍 Path Filter
    runs-on: ubuntu-latest
    outputs:
      should_review: ${{ steps.changes.outputs.src }}
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: dorny/paths-filter@v3
        if: github.event_name == 'pull_request'
        id: changes-pr
        with:
          filters: |
            src:
              - 'app/**'
              - 'components/**'
              - 'constants/**'
              - 'context/**'
              - 'hooks/**'
              - 'lib/**'
              - 'services/**'
              - 'utils/**'
              - 'types/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'tsconfig.json'
              - 'next.config.js'
              - 'tailwind.config.ts'
              - '.env*'
              - '.github/**'
              - 'scripts/**'
              - 'tests/**'
              - 'stories/**'
              - '.storybook/**'
              - 'verification/**'
              - '*.config.*'
              - '*.ts'
              - 'ecosystem.config.cjs'
              - 'verify_empty_dashboard.py'

      - uses: dorny/paths-filter@v3
        if: github.event_name == 'workflow_dispatch'
        id: changes-dispatch
        with:
          base: ${{ inputs.base_ref }}
          ref: ${{ inputs.head_ref }}
          filters: |
            src:
              - 'app/**'
              - 'components/**'
              - 'constants/**'
              - 'context/**'
              - 'hooks/**'
              - 'lib/**'
              - 'services/**'
              - 'utils/**'
              - 'types/**'
              - 'package.json'
              - 'pnpm-lock.yaml'
              - 'tsconfig.json'
              - 'next.config.js'
              - 'tailwind.config.ts'
              - '.env*'
              - '.github/**'
              - 'scripts/**'
              - 'tests/**'
              - 'stories/**'
              - '.storybook/**'
              - 'verification/**'
              - '*.config.*'
              - '*.ts'
              - 'ecosystem.config.cjs'
              - 'verify_empty_dashboard.py'

      - name: Consolidate Changes
        id: changes
        run: |
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo "src=${{ steps.changes-pr.outputs.src }}" >> $GITHUB_OUTPUT
          else
            echo "src=${{ steps.changes-dispatch.outputs.src }}" >> $GITHUB_OUTPUT
          fi

  check-diff:
    name: 🔍 Check Diff
    needs: [filter]
    if: needs.filter.outputs.should_review == 'true'
    runs-on: ubuntu-latest
    outputs:
      is_meaningful: ${{ steps.diff_check.outputs.is_meaningful }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Install dependencies
        run: pip install unidiff

      - name: Generate Diff and Run Script
        id: diff_check
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          HEAD_REF: ${{ github.head_ref || inputs.head_ref }}
        run: |
          # Bypass check for E2E tests to ensure they always run the full quality gate
          if [[ "$PR_TITLE" == *"E2E Test PR"* ]] || [[ "$HEAD_REF" == "e2e-test-"* ]]; then
            echo "::notice::Detected E2E Test PR (Title: '$PR_TITLE', Branch: '$HEAD_REF'). Forcing meaningful changes."
            echo "is_meaningful=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [ "${{ github.event_name }}" == "pull_request" ]; then
            BASE_SHA="${{ github.event.pull_request.base.sha }}"
            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
          else
            BASE_SHA="${{ inputs.base_ref || 'origin/leader' }}"
            HEAD_SHA="${{ inputs.head_ref || 'HEAD' }}"

            if [[ "$BASE_SHA" == "origin/"* ]]; then
                git fetch origin "${BASE_SHA#origin/}"
            elif ! git cat-file -e $BASE_SHA^{commit}; then
                git fetch origin leader
                BASE_SHA="origin/leader"
            fi
          fi

          echo "Generating diff between $BASE_SHA and $HEAD_SHA"
          git diff "$BASE_SHA...$HEAD_SHA" > pr.diff

          set +e
          python3 scripts/check_diff.py pr.diff --exclude 'pnpm-lock.yaml' 'package-lock.json' '*.lock' '*.md'
          RESULT=$?
          set -e

          if [ "$RESULT" -eq 2 ]; then
            echo "No meaningful changes detected (exit code 2)."
            echo "is_meaningful=false" >> "$GITHUB_OUTPUT"
          elif [ "$RESULT" -eq 0 ]; then
            echo "Meaningful changes detected (exit code 0)."
            echo "is_meaningful=true" >> "$GITHUB_OUTPUT"
          else
            echo "::warning::Diff check failed with error code $RESULT. Assuming meaningful changes to be safe."
            echo "is_meaningful=true" >> "$GITHUB_OUTPUT"
          fi

  pr-quality:
    name: 🛡️ Quality Gates
    needs: [filter, check-diff]
    # Requisite: Path Filter must have succeeded (even if no src changes).
    # check-diff must not have failed (success or skipped is fine).
    if: |
      needs.filter.result == 'success' &&
      !cancelled() &&
      (needs.check-diff.result == 'success' || needs.check-diff.result == 'skipped')
    uses: ./.github/workflows/pr-quality.yml
    with:
      pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
      branch: ${{ github.base_ref || inputs.base_branch || inputs.base_ref || 'leader' }}
    secrets:
      GH_TOKEN: ${{ secrets.ARI_PAT }}
      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}

  pr-review:
    name: 🤖 Gemini AI Review
    needs: [filter, pr-quality, check-diff]
    # We always want a label ("approved", "not approved", or "not reviewed")
    # So we run this job if the filter matched, regardless of quality gate result.
    # We skip only if the filter didn't match (non-source changes).
    if: |
      always() &&
      needs.filter.outputs.should_review == 'true' &&
      !cancelled()
    uses: ./.github/workflows/reusable-gemini-review.yml
    with:
      pr_quality_result: ${{ needs.pr-quality.result }}
      trigger_event: 'pull_request'
      # Path filter handles the diff logic; we pass current HEAD for analysis
      last_non_empty_commit: ${{ github.event.pull_request.head.sha || github.sha }}
      pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
      base_sha: ${{ github.event.pull_request.base.sha || inputs.base_ref }}
      head_sha: ${{ github.event.pull_request.head.sha || inputs.head_ref }}
    secrets: inherit

  create-review-issues:
    name: 🚀 Create Review Issues
    needs: [pr-review]
    if: |
      always() &&
      needs.pr-review.result == 'success' &&
      needs.pr-review.outputs.review_performed == 'true'
    uses: ./.github/workflows/reusable-create-review-issues.yml
    with:
      pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
      base_sha: ${{ github.event.pull_request.base.sha || inputs.base_ref }}
      run_id: ${{ github.run_id }}
    secrets:
      gh_token: ${{ secrets.GITHUB_TOKEN }}