name: Verify AI models catalog

# Runs the AI-model verifier and commits any changes to
# AppImage/config/verified_ai_models.json on the same branch the run
# was launched from.
#
# GitHub only fires `on: schedule` from the default branch, so the
# daily cron always runs against main and keeps stable users fresh.
# When a beta cycle needs its own refresh on develop, use the
# "Run workflow" button on the Actions tab and pick develop from the
# branch selector — the same YAML then checks out develop, runs the
# verifier and commits back to develop. Cross-branch pushes never
# happen: each run only touches the branch it started on.
#
# The verifier code lives at .github/scripts/ai-models-verifier/ and
# reads API keys from repository Secrets. Any provider without a key
# is skipped silently — the workflow keeps going with the rest.

on:
  schedule:
    - cron: '0 4 * * *'   # 04:00 UTC every day — cron always fires from main
  workflow_dispatch:       # manual trigger — branch is picked in the UI

permissions:
  contents: write

concurrency:
  # Keyed by branch so a manual develop run does not collide with the
  # scheduled main run — each branch gets its own serialisation lane.
  group: verify-ai-models-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Check out the branch this run belongs to
        uses: actions/checkout@v4
        with:
          # `github.ref_name` resolves to main for the cron and to the
          # branch selected in the dispatch UI otherwise. The same
          # value is used again below when we push, so every run is
          # symmetric: checkout X → refresh → push X.
          ref: ${{ github.ref_name }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Run verifier
        working-directory: .github/scripts/ai-models-verifier
        env:
          # API keys — each is optional. verify.py silently skips any
          # provider whose *_API_KEY env var is empty, so the workflow
          # runs even when only a subset of keys is configured.
          OPENAI_API_KEY:     ${{ secrets.OPENAI_API_KEY }}
          ANTHROPIC_API_KEY:  ${{ secrets.ANTHROPIC_API_KEY }}
          GROQ_API_KEY:       ${{ secrets.GROQ_API_KEY }}
          GEMINI_API_KEY:     ${{ secrets.GEMINI_API_KEY }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          # Optional base URLs for custom-endpoint providers.
          OPENAI_BASE_URL:    ${{ secrets.OPENAI_BASE_URL }}
        run: |
          python3 verify.py --json-out /tmp/report.json || true
          if [ ! -s /tmp/report.json ]; then
            echo "Verifier produced no report — bailing"
            exit 1
          fi

      - name: Apply report to catalog
        id: apply
        working-directory: .
        run: |
          set +e
          python3 .github/scripts/ai-models-verifier/apply.py \
            --report /tmp/report.json \
            --catalog AppImage/config/verified_ai_models.json
          code=$?
          set -e
          case "$code" in
            0)  echo "changed=false" >> "$GITHUB_OUTPUT" ;;
            10) echo "changed=true"  >> "$GITHUB_OUTPUT" ;;
            *)  echo "apply.py exited with $code"; exit "$code" ;;
          esac

      - name: Commit and push back to the same branch
        if: steps.apply.outputs.changed == 'true'
        run: |
          git config user.name  "proxmenux-bot"
          git config user.email "proxmenux-bot@users.noreply.github.com"
          git add AppImage/config/verified_ai_models.json
          git commit -m "chore(ai-models): daily catalog refresh"
          # Push to the branch this run started on — same ref used at
          # checkout above, so the operation is symmetric regardless of
          # whether cron (main) or dispatch (any branch) triggered it.
          git push origin HEAD:${{ github.ref_name }}

      - name: Report unchanged
        if: steps.apply.outputs.changed != 'true'
        run: echo "Catalog already up to date — nothing to commit."