release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version_bump:
        description: "Version bump type"
        required: true
        default: "patch"
        type: choice
        options:
          - patch
          - minor
          - major
      pre_release:
        description: "Pre-release (skips updating consumer repos)"
        required: false
        default: false
        type: boolean

concurrency:
  group: release
  cancel-in-progress: true

permissions:
  contents: write

jobs:
  release:
    name: Create release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      sha: ${{ steps.release-commit.outputs.sha }}

    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}

      - name: Configure git
        run: |
          git config user.name "docker-agent[bot]"
          git config user.email "docker-agent[bot]@users.noreply.github.com"

      - name: Calculate new version
        id: version
        env:
          BUMP_TYPE: ${{ inputs.version_bump }}
        run: |
          # Get the latest semver tag
          LATEST_TAG=$(git tag -l 'v*.*.*' --sort=-v:refname | head -n1)

          if [ -z "$LATEST_TAG" ]; then
            echo "No existing version tags found, starting at v0.0.0"
            MAJOR=0; MINOR=0; PATCH=0
          else
            VERSION="${LATEST_TAG#v}"
            MAJOR=$(echo "$VERSION" | cut -d. -f1)
            MINOR=$(echo "$VERSION" | cut -d. -f2)
            PATCH=$(echo "$VERSION" | cut -d. -f3)
            echo "Current version: v${MAJOR}.${MINOR}.${PATCH}"
          fi

          # Bump the chosen segment
          case "$BUMP_TYPE" in
            major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
            minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
            patch) PATCH=$((PATCH + 1)) ;;
          esac

          NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}"

          # Collision avoidance: if tag already exists, bump patch until unique
          while git rev-parse "$NEW_VERSION" >/dev/null 2>&1; do
            echo "Tag $NEW_VERSION already exists, bumping patch..."
            PATCH=$((PATCH + 1))
            NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}"
          done

          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "previous=${LATEST_TAG}" >> $GITHUB_OUTPUT
          echo "New version: $NEW_VERSION (previous: ${LATEST_TAG:-none})"

      # CI cannot push commits to main (branch protection). Instead, we create
      # a detached release commit with pinned refs, reachable only via tags.
      # main keeps SHA-pinned self-refs; the release commit updates them to the
      # HEAD SHA so the tagged commit is fully self-contained.
      - name: Create release commit with pinned refs
        id: release-commit
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -e

          # Capture HEAD SHA before creating the detached commit.
          # The release commit's self-refs will point to this SHA (the parent on main),
          # which has an identical root action.yml.
          HEAD_SHA=$(git rev-parse HEAD)
          echo "Pinning SHA refs to ${HEAD_SHA} # ${VERSION}..."

          # Replace all docker/cagent-action*@<40-hex-SHA> # v<anything> refs
          # with the current HEAD SHA and new version.
          # Uses a capture group so any sub-path (e.g., /review-pr, /review-pr/reply) is preserved.
          # Automatically covers new sub-actions without needing to update this workflow.
          # Only targets `uses:` lines to avoid pinning refs in comments or documentation.
          OLD_PIN_PATTERN='uses: *docker/cagent-action[^@]*@[a-f0-9]\{40\} # v'
          PIN_PATTERN='s|^\([^#]*uses: *docker/cagent-action\)\([^@]*\)@[a-f0-9]\{40\} # v[^ ]*|\1\2@'"${HEAD_SHA}"' # '"${VERSION}"'|g'
          PINNED_FILES=()
          while IFS= read -r file; do
            sed -i "$PIN_PATTERN" "$file"
            PINNED_FILES+=("$file")
            echo "  Pinned: $file"
          done < <(grep -rl "$OLD_PIN_PATTERN" --include='*.yml' --include='*.yaml' \
            --exclude-dir=.git \
            review-pr/ .github/workflows/review-pr.yml .github/workflows/release.yml)

          if [ ${#PINNED_FILES[@]} -eq 0 ]; then
            echo "::error::No SHA-pinned self-refs found to update — expected at least one. Check that review-pr/ actions still reference docker/cagent-action with a SHA pin."
            exit 1
          fi

          # Check for any SHA-pinned refs that lack version comments (won't be auto-updated)
          UNVERSIONED=$(grep -n 'uses: *docker/cagent-action[^@]*@[a-f0-9]\{40\}' "${PINNED_FILES[@]}" 2>/dev/null | \
            grep -v '# v' || true)
          if [ -n "$UNVERSIONED" ]; then
            echo "::error::Found SHA-pinned refs without version comments (won't be auto-updated):"
            echo "$UNVERSIONED"
            exit 1
          fi

          # Verify no refs with the old SHA remain in pinned files
          REMAINING=$(grep -n "$OLD_PIN_PATTERN" "${PINNED_FILES[@]}" 2>/dev/null | grep -v "${HEAD_SHA}" || true)
          if [ -n "$REMAINING" ]; then
            echo "::error::Old SHA refs remain after pinning:"
            echo "$REMAINING"
            exit 1
          fi

          echo "Pinned refs:"
          grep -rn "cagent-action@" "${PINNED_FILES[@]}"

          # Create a detached commit (not on main) with the pinned refs
          # Note: write-tree captures the full index (all files from HEAD),
          # but we explicitly add DOCKER_AGENT_VERSION for clarity.
          git add "${PINNED_FILES[@]}" DOCKER_AGENT_VERSION
          TREE=$(git write-tree)
          RELEASE_SHA=$(git commit-tree "$TREE" -p HEAD -m "release: ${VERSION}")

          echo "sha=$RELEASE_SHA" >> $GITHUB_OUTPUT
          echo "Release commit: $RELEASE_SHA"

      - name: Push version tag
        env:
          VERSION: ${{ steps.version.outputs.version }}
          RELEASE_SHA: ${{ steps.release-commit.outputs.sha }}
        run: |
          git tag "$VERSION" "$RELEASE_SHA"
          git push origin "$VERSION"

      - name: Create GitHub Release
        env:
          VERSION: ${{ steps.version.outputs.version }}
          PREVIOUS: ${{ steps.version.outputs.previous }}
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          ARGS=(--generate-notes --latest)
          if [ -n "$PREVIOUS" ]; then
            ARGS+=(--notes-start-tag "$PREVIOUS")
          fi
          gh release create "$VERSION" "${ARGS[@]}"

  update-consumers:
    name: Update consumer repo references
    needs: release
    if: success() && !inputs.pre_release
    runs-on: ubuntu-latest
    concurrency:
      group: update-consumers
      cancel-in-progress: false
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Discover and update consumer repos
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          SHA: ${{ needs.release.outputs.sha }}
          VERSION: ${{ needs.release.outputs.version }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -e

          if [ -z "$SHA" ] || [ -z "$VERSION" ]; then
            echo "::error::SHA or VERSION is empty (SHA='$SHA', VERSION='$VERSION')"
            exit 1
          fi

          # Discover repos that use the cagent-action reusable workflow.
          # Uses GitHub code search API — results may have eventual consistency lag
          # for very recently created repos, but this is fine for release automation.
          echo "Searching for consumer repos..."
          REPOS=$(gh api --paginate '/search/code?per_page=100' \
            -f q='org:docker "docker/cagent-action/.github/workflows/review-pr.yml@" language:YAML path:/^\.github\/workflows\//' \
            --jq '[.items[] | {repo: .repository.full_name, path: .path}] | unique_by(.repo) | .[] | "\(.repo) \(.path)"')

          if [ -z "$REPOS" ]; then
            echo "No consumer repos found, skipping."
            exit 0
          fi

          echo "Found consumer repos:"
          echo "$REPOS"
          echo ""

          # Pattern to match cagent-action workflow refs with SHA pins
          OLD_PATTERN='cagent-action/\.github/workflows/review-pr\.yml@[[:xdigit:]]\{40\} # v[0-9.]*'
          NEW_REF="cagent-action/.github/workflows/review-pr.yml@${SHA} # ${VERSION}"

          BRANCH="auto/update-cagent-action"
          RELEASE_URL="https://github.com/docker/cagent-action/releases/tag/$VERSION"

          while IFS=' ' read -r REPO FILE_PATH; do
            echo "=========================================="
            echo "Processing ${REPO} (${FILE_PATH})..."
            echo "=========================================="

            # Clone the repo into a temp directory
            # Set up cleanup trap for this iteration
            trap 'cd /; rm -rf "$WORK_DIR"' EXIT

            WORK_DIR=$(mktemp -d)
            if ! gh repo clone "$REPO" "$WORK_DIR" -- --depth=1 2>/dev/null; then
              echo "::warning::Failed to clone $REPO — skipping (token may lack access)"
              rm -rf "$WORK_DIR"
              continue
            fi

            cd "$WORK_DIR"

            # Check if the app has push access to this repo
            CAN_PUSH=$(gh api "repos/$REPO" --jq '.permissions.push' 2>/dev/null || echo "false")
            if [ "$CAN_PUSH" != "true" ]; then
              echo "::warning::No push access to $REPO — skipping (app may not be installed or lacks write access)"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            # Check that the file exists and contains the pattern
            if [ ! -f "$FILE_PATH" ]; then
              echo "::warning::$FILE_PATH not found in $REPO — skipping"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            if ! grep -q "$OLD_PATTERN" "$FILE_PATH"; then
              echo "Pattern not found in $FILE_PATH — may already be up to date, skipping"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            # Apply the sed replacement
            sed -i "s|${OLD_PATTERN}|${NEW_REF}|g" "$FILE_PATH"

            if git diff --quiet "$FILE_PATH"; then
              echo "No changes after sed — already up to date"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            echo "Updated reference to ${SHA} # ${VERSION}"

            # Commit and push
            git config user.name "docker-agent[bot]"
            git config user.email "docker-agent[bot]@users.noreply.github.com"

            git checkout -B "$BRANCH"
            git add "$FILE_PATH"
            git commit -m "chore: update cagent-action to $VERSION"
            git push --force origin "$BRANCH"

            # Create or update PR
            EXISTING_PR=$(gh pr list --repo "$REPO" --head "$BRANCH" --state open --json number --jq '.[0].number')

            # Build PR body safely using printf to avoid shell expansion of FILE_PATH
            # FILE_PATH comes from GitHub API and could theoretically contain shell metacharacters
            printf -v PR_BODY '%s\n%s\n%s\n%s\n%s' \
              "## Summary" \
              "Updates \`cagent-action\` reference in \`${FILE_PATH}\` to [${VERSION}](${RELEASE_URL})." \
              "- **Commit**: \`${SHA}\`" \
              "- **Version**: \`${VERSION}\`" \
              "> Auto-generated by the [release](${RUN_URL}) workflow."

            if [ -n "$EXISTING_PR" ]; then
              echo "Updating existing PR #$EXISTING_PR in $REPO"
              gh pr edit "$EXISTING_PR" --repo "$REPO" \
                --title "chore: update cagent-action to $VERSION" \
                --body "$PR_BODY" \
                --add-reviewer "derekmisler"
            else
              echo "Creating new PR in $REPO"
              gh pr create --repo "$REPO" \
                --title "chore: update cagent-action to $VERSION" \
                --body "$PR_BODY" \
                --reviewer "derekmisler" || echo "::warning::Failed to create PR in $REPO"
            fi

            # Clear trap and cleanup
            trap - EXIT

            cd /
            rm -rf "$WORK_DIR"
            echo ""
          done <<< "$REPOS"

          echo "Done updating consumer repos."

  update-self-refs:
    name: Update self-refs in cagent-action main
    needs: release
    if: success()
    runs-on: ubuntu-latest
    concurrency:
      group: update-self-refs
      cancel-in-progress: false
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Checkout cagent-action
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: docker/cagent-action
          token: ${{ steps.app-token.outputs.token }}

      - name: Update self-ref pins
        id: update
        env:
          SHA: ${{ needs.release.outputs.sha }}
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          if [ -z "$SHA" ] || [ -z "$VERSION" ]; then
            echo "::error::SHA or VERSION is empty (SHA='$SHA', VERSION='$VERSION')"
            exit 1
          fi

          OLD_PATTERN='docker/cagent-action[^@]*@[a-f0-9]\{40\} # v[^ ]*'
          # YAML sed: anchored on `uses:` to avoid false matches in comments
          YAML_PIN_PATTERN='s|\(uses: *docker/cagent-action\)\([^@]*\)@[a-f0-9]\{40\} # v[^ ]*|\1\2@'"${SHA}"' # '"${VERSION}"'|g'

          UPDATED_FILES=()

          # Update YAML/YAML files (uses: anchored)
          while IFS= read -r file; do
            sed -i "$YAML_PIN_PATTERN" "$file"
            UPDATED_FILES+=("$file")
            echo "  Updated (yaml): $file"
          done < <(grep -rl "$OLD_PATTERN" --include='*.yml' --include='*.yaml' \
            --exclude-dir=.git \
            review-pr/ .github/workflows/review-pr.yml .github/workflows/release.yml)

          if [ ${#UPDATED_FILES[@]} -eq 0 ]; then
            echo "No self-refs needed updating, skipping."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          elif git diff --quiet; then
            echo "Files already up to date, skipping."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "Updated self-refs to ${SHA} # ${VERSION}"
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Create or update PR
        if: steps.update.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION: ${{ needs.release.outputs.version }}
          SHA: ${{ needs.release.outputs.sha }}
        run: |
          BRANCH="auto/update-cagent-action"
          RELEASE_URL="https://github.com/docker/cagent-action/releases/tag/$VERSION"

          git config user.name "docker-agent[bot]"
          git config user.email "docker-agent[bot]@users.noreply.github.com"

          git checkout -B "$BRANCH"
          git add -A
          git commit -m "chore: update cagent-action to $VERSION"

          # Force-push to handle both new and existing branches.
          # This branch is exclusively managed by this workflow, so --force is safe.
          git push --force origin "$BRANCH"

          EXISTING_PR=$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number')

          PR_BODY="$(cat <<EOF
          ## Summary
          Updates \`cagent-action\` reference in \`pr-review.yml\` to [$VERSION]($RELEASE_URL).
          - **Commit**: \`${SHA}\`
          - **Version**: \`${VERSION}\`
          > Auto-generated by the [release](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) workflow.
          EOF
          )"

          if [ -n "$EXISTING_PR" ]; then
            echo "Updating existing PR #$EXISTING_PR"
            gh pr edit "$EXISTING_PR" \
              --title "chore: update cagent-action to $VERSION" \
              --body "$PR_BODY" \
              --add-reviewer "derekmisler"
          else
            echo "Creating new PR"
            gh pr create \
              --title "chore: update cagent-action to $VERSION" \
              --body "$PR_BODY" \
              --label "team/gordon" \
              --label "merge/auto" \
              --reviewer "derekmisler"
          fi

  publish-agent:
    name: Push review-pr agent to Docker Hub
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ needs.release.outputs.version }}

      - name: Install Docker Agent
        run: |
          set -e
          DOCKER_AGENT_VERSION=$(tr -d '[:space:]' < DOCKER_AGENT_VERSION)
          if [ -z "$DOCKER_AGENT_VERSION" ]; then
            echo "::error::Could not extract Docker Agent version from DOCKER_AGENT_VERSION"
            exit 1
          fi
          echo "Using Docker Agent version from DOCKER_AGENT_VERSION: ${DOCKER_AGENT_VERSION}"
          curl -fL -o docker-agent \
            "https://github.com/docker/docker-agent/releases/download/${DOCKER_AGENT_VERSION}/docker-agent-linux-amd64"
          chmod +x docker-agent
          sudo mv docker-agent /usr/local/bin/

      - name: Docker Hub login
        env:
          HUB_USER: ${{ secrets.HUB_USER }}
          HUB_PAT: ${{ secrets.HUB_PAT }}
        run: |
          set -e
          if [ -z "${HUB_USER}" ]; then echo "::error::HUB_USER secret is not set"; exit 1; fi
          if [ -z "${HUB_PAT}" ]; then echo "::error::HUB_PAT secret is not set"; exit 1; fi
          echo "${HUB_PAT}" | docker login --username "${HUB_USER}" --password-stdin

      - name: Push agent
        env:
          HUB_ORG: ${{ secrets.HUB_ORG }}
        run: |
          set -e
          if [ -z "${HUB_ORG}" ]; then echo "::error::HUB_ORG secret is not set"; exit 1; fi
          cd review-pr/agents
          TELEMETRY_ENABLED=false docker-agent share push pr-review.yaml "${HUB_ORG}/review-pr"

      - name: Upload README to Docker Hub
        env:
          HUB_USER: ${{ secrets.HUB_USER }}
          HUB_PAT: ${{ secrets.HUB_PAT }}
          HUB_ORG: ${{ secrets.HUB_ORG }}
        run: |
          set -e
          TOKEN=$(curl -sSf -X POST https://hub.docker.com/v2/users/login/ \
            -H "Content-Type: application/json" \
            -d "{\"username\":\"${HUB_USER}\",\"password\":\"${HUB_PAT}\"}" | jq -r .token)
          if [ -z "${TOKEN}" ] || [ "${TOKEN}" = "null" ]; then
            echo "::error::Failed to get Docker Hub API token"
            exit 1
          fi
          curl -sSf -X PATCH "https://hub.docker.com/v2/namespaces/${HUB_ORG}/repositories/review-pr" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "$(jq -n --arg desc "Docker Agent-powered PR review team. Analyzes code changes, posts reviews, and learns from feedback." \
                       --rawfile readme review-pr/README.md \
                       '{description: $desc, full_description: $readme}')"

  notify:
    name: Notify Slack
    needs: [release, publish-agent]
    if: success()
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2
        with:
          app_id: ${{ secrets.CAGENT_REVIEWER_APP_ID }}
          private_key: ${{ secrets.CAGENT_REVIEWER_APP_PRIVATE_KEY }}

      - name: Fetch release notes from GitHub
        id: release-notes
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          if ! NOTES=$(gh release view "$VERSION" --repo docker/cagent-action --json body --jq '.body'); then
            echo "::warning::Failed to fetch release notes, using fallback"
            NOTES="Release ${VERSION} — see GitHub for details."
          fi
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Generate Slack summary
        id: slack-summary
        # Pinned to a SHA — automatically updated by the update-self-refs job after each release.
        # GitHub Actions requires static `uses:` values, so we can't pin dynamically.
        uses: docker/cagent-action@dba0ca51938c78afb363625363c50582243218d6 # v1.3.1
        with:
          agent: agentcatalog/github-action-release-notes
          prompt: |
            Convert these release notes to a SHORT plain text Slack message.

            VERSION: ${{ needs.release.outputs.version }}
            RELEASE URL: https://github.com/docker/cagent-action/releases/tag/${{ needs.release.outputs.version }}

            ORIGINAL RELEASE NOTES:
            ${{ steps.release-notes.outputs.notes }}

            CRITICAL - PLAIN TEXT ONLY:
            This goes through Slack Workflow Builder which does NOT support formatting.
            - DO NOT use *asterisks* - they show literally
            - DO NOT use <url|text> links - use plain URLs
            - DO use :emoji: codes - those work
            - DO use bullet points with •
            - Use CAPS for section headers instead of bold

            OUTPUT REQUIREMENTS:
            - Keep it SHORT - max 5-7 bullet points total
            - Include the release URL at the end (plain URL, not link syntax)
            - Output ONLY the Slack message, nothing else
            - Skip the "Platforms" line — this is a GitHub Action, not a binary

            EXAMPLE FORMAT:
            :tada: cagent-action v1.3.0 Released

            :package: WHAT'S NEW
            • New feature one
            • New feature two

            :wrench: IMPROVEMENTS
            • Enhancement description

            :bug: BUG FIXES
            • Fix description

            :inbox_tray: Release: https://github.com/docker/cagent-action/releases/tag/v1.3.0
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

      - name: Send Slack notification
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
          VERSION: ${{ needs.release.outputs.version }}
          SLACK_SUMMARY_FILE: ${{ steps.slack-summary.outputs.output-file }}
        run: |
          if [ -z "$SLACK_WEBHOOK_URL" ]; then
            echo "⚠️ SLACK_RELEASE_WEBHOOK not configured, skipping notification"
            exit 0
          fi

          RELEASE_URL="https://github.com/docker/cagent-action/releases/tag/${VERSION}"

          # Use the AI-generated Slack summary
          if [ -f "$SLACK_SUMMARY_FILE" ] && [ -s "$SLACK_SUMMARY_FILE" ]; then
            MESSAGE_TEXT=$(cat "$SLACK_SUMMARY_FILE")
          else
            # Fallback message if summary generation failed
            MESSAGE_TEXT=$(printf ':tada: cagent-action %s Released\n\n:package: See the full release notes for details.\n\n:inbox_tray: Release: %s' "$VERSION" "$RELEASE_URL")
          fi

          # Create payload with text and release_url fields (matching Slack Workflow Builder webhook)
          PAYLOAD=$(jq -n \
            --arg text "$MESSAGE_TEXT" \
            --arg release_url "$RELEASE_URL" \
            '{
              text: $text,
              release_url: $release_url
            }')

          if ! HTTP_CODE=$(curl -s -w "%{http_code}" -o /tmp/slack_response.txt -X POST "$SLACK_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"); then
            echo "⚠️ Slack notification failed (curl error)"
          elif [ "$HTTP_CODE" -eq 200 ]; then
            echo "✅ Slack notification sent"
          else
            echo "⚠️ Slack notification failed (HTTP $HTTP_CODE)"
            cat /tmp/slack_response.txt
          fi
          # Don't fail the workflow if Slack fails