dependency-update.yml

name: Dependency Updates

on:
  schedule:
    # Run weekly on Mondays at 9 AM UTC
    - cron: '0 9 * * 1'
  workflow_dispatch:
    inputs:
      update_type:
        description: 'Type of updates to perform'
        required: true
        default: 'patch'
        type: choice
        options:
          - patch
          - minor
          - major
          - all

jobs:
  check-dependencies:
    name: Check for Dependency Updates
    runs-on: ubuntu-latest
    outputs:
      has_updates: ${{ steps.check.outputs.has_updates }}
      update_summary: ${{ steps.check.outputs.summary }}
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Check for outdated dependencies
        id: check
        run: |
          echo "🔍 Checking for outdated dependencies..."
          
          # Get outdated packages
          npm outdated --json > outdated.json || true
          
          if [ -s outdated.json ] && [ "$(cat outdated.json)" != "{}" ]; then
            echo "has_updates=true" >> $GITHUB_OUTPUT
            echo "📦 Found outdated dependencies:"
            cat outdated.json | jq -r 'to_entries[] | "\(.key): \(.value.current) → \(.value.wanted)"'
            
            # Create summary
            SUMMARY=$(cat outdated.json | jq -r 'to_entries[] | "\(.key): \(.value.current) → \(.value.wanted)"' | head -10)
            echo "summary<<EOF" >> $GITHUB_OUTPUT
            echo "$SUMMARY" >> $GITHUB_OUTPUT
            echo "EOF" >> $GITHUB_OUTPUT
          else
            echo "has_updates=false" >> $GITHUB_OUTPUT
            echo "✅ All dependencies are up to date"
            echo "summary=All dependencies are up to date" >> $GITHUB_OUTPUT
          fi

      - name: Upload outdated dependencies report
        uses: actions/upload-artifact@v4
        if: steps.check.outputs.has_updates == 'true'
        with:
          name: outdated-dependencies
          path: outdated.json
          retention-days: 7

  security-updates:
    name: Apply Security Updates
    runs-on: ubuntu-latest
    needs: check-dependencies
    if: needs.check-dependencies.outputs.has_updates == 'true'
    permissions:
      contents: write
      pull-requests: write
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.ACCESS_TOKEN }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit fix
        run: |
          echo "🔧 Applying security fixes..."
          npm audit fix --audit-level=moderate || true
          
          # Check if package.json or package-lock.json changed
          if git diff --quiet package.json package-lock.json; then
            echo "No security updates applied"
            echo "SECURITY_UPDATES=false" >> $GITHUB_ENV
          else
            echo "Security updates applied"
            echo "SECURITY_UPDATES=true" >> $GITHUB_ENV
          fi

      - name: Test after security updates
        if: env.SECURITY_UPDATES == 'true'
        run: |
          npm run build
          npm run test:config || true
          npm run test:shell-multiline || true

      - name: Create security update PR
        if: env.SECURITY_UPDATES == 'true'
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.ACCESS_TOKEN}}
          commit-message: "fix(deps): apply security updates"
          title: "🔒 Security Updates"
          body: |
            ## 🔒 Automated Security Updates
            
            This PR contains security updates applied by `npm audit fix`.
            
            ### Changes
            - Applied security patches for vulnerable dependencies
            - Updated package-lock.json with secure versions
            
            ### Testing
            - ✅ Build successful
            - ✅ Basic tests passing
            
            Please review the changes and merge if appropriate.
          branch: security-updates
          delete-branch: true

  dependency-updates:
    name: Update Dependencies
    runs-on: ubuntu-latest
    needs: [check-dependencies, security-updates]
    if: needs.check-dependencies.outputs.has_updates == 'true' && (github.event_name == 'workflow_dispatch' || github.event.schedule)
    permissions:
      contents: write
      pull-requests: write
    
    strategy:
      matrix:
        update-type: 
          - patch
          - minor
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.ACCESS_TOKEN}}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Install npm-check-updates
        run: npm install -g npm-check-updates

      - name: Update ${{ matrix.update-type }} dependencies
        run: |
          echo "📦 Updating ${{ matrix.update-type }} dependencies..."
          
          case "${{ matrix.update-type }}" in
            patch)
              ncu -u --target patch
              ;;
            minor)
              ncu -u --target minor
              ;;
            major)
              ncu -u --target latest
              ;;
          esac
          
          # Install updated dependencies
          npm install
          
          # Check if anything changed
          if git diff --quiet package.json; then
            echo "No ${{ matrix.update-type }} updates available"
            echo "HAS_CHANGES=false" >> $GITHUB_ENV
          else
            echo "HAS_CHANGES=true" >> $GITHUB_ENV
          fi

      - name: Test after updates
        if: env.HAS_CHANGES == 'true'
        run: |
          echo "🧪 Testing after ${{ matrix.update-type }} updates..."
          
          # Build project
          npm run build
          
          # Run tests
          npm run test:config || echo "Config test completed with possible errors"
          npm run test:shell-multiline || echo "Shell test completed with possible errors"
          npm run test:openai-parse || echo "OpenAI test completed with possible errors"
          
          # Test CLI
          node dist/aiflow-app.js --help > /dev/null
          node dist/aiflow-conan-app.js --help > /dev/null

      - name: Generate update summary
        if: env.HAS_CHANGES == 'true'
        id: summary
        run: |
          echo "📋 Generating update summary..."
          
          # Get the diff of package.json
          CHANGES=$(git diff package.json | grep '^[+-]' | grep -E '^\+.*".*":' | sed 's/^+/Updated:/' || echo "No specific changes detected")
          
          echo "changes<<EOF" >> $GITHUB_OUTPUT
          echo "$CHANGES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Create dependency update PR
        if: env.HAS_CHANGES == 'true'
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.ACCESS_TOKEN}}
          commit-message: "chore(deps): update ${{ matrix.update-type }} dependencies"
          title: "⬆️ Update ${{ matrix.update-type }} dependencies"
          body: |
            ## ⬆️ Automated ${{ matrix.update-type }} Dependency Updates
            
            This PR updates ${{ matrix.update-type }} dependencies to their latest compatible versions.
            
            ### Changes
            ${{ steps.summary.outputs.changes }}
            
            ### Testing
            - ✅ Build successful
            - ✅ Basic tests passing
            - ✅ CLI commands functional
            
            ### Review Notes
            - These are ${{ matrix.update-type }} updates, which should be backward compatible
            - Please review the changelog of updated packages for any breaking changes
            - Consider running additional tests before merging
            
            Auto-generated by dependency update workflow.
          branch: deps-${{ matrix.update-type }}-updates
          delete-branch: true

  vulnerability-assessment:
    name: Vulnerability Assessment
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run comprehensive vulnerability check
        run: |
          echo "🛡️ Comprehensive Vulnerability Assessment"
          echo "========================================"
          
          # Get current vulnerabilities
          npm audit --json > vulnerability-report.json || true
          
          if [ -s vulnerability-report.json ]; then
            echo "📊 Vulnerability Summary:"
            cat vulnerability-report.json | jq '.metadata.vulnerabilities' || echo "Could not parse vulnerability metadata"
            
            echo -e "\n🔍 High/Critical Vulnerabilities:"
            cat vulnerability-report.json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical") | .key' || echo "No high/critical vulnerabilities"
            
            echo -e "\n📋 Affected Packages:"
            cat vulnerability-report.json | jq -r '.vulnerabilities | to_entries[] | "\(.key): \(.value.severity)"' | head -20 || echo "Could not list affected packages"
          else
            echo "✅ No vulnerabilities detected"
          fi

      - name: Check dependency tree for issues
        run: |
          echo "🌳 Dependency Tree Analysis"
          echo "==========================="
          
          # Check for duplicate dependencies
          npm ls --all 2>&1 | grep -E "WARN|ERR" | head -20 || echo "No major dependency tree issues found"
          
          # Check for peer dependency issues
          npm ls --depth=0 2>&1 | grep -i "peer" || echo "No peer dependency issues"

      - name: Upload vulnerability report
        uses: actions/upload-artifact@v4
        with:
          name: vulnerability-assessment
          path: |
            vulnerability-report.json
          retention-days: 30

  notify-updates:
    name: Notify Update Results
    runs-on: ubuntu-latest
    needs: [check-dependencies, security-updates, dependency-updates, vulnerability-assessment]
    if: always()
    
    steps:
      - name: Determine notification message
        id: message
        run: |
          if [ "${{ needs.check-dependencies.outputs.has_updates }}" == "true" ]; then
            if [ "${{ needs.security-updates.result }}" == "success" ] || [ "${{ needs.dependency-updates.result }}" == "success" ]; then
              echo "message=✅ Dependency updates processed successfully" >> $GITHUB_OUTPUT
              echo "color=good" >> $GITHUB_OUTPUT
            else
              echo "message=⚠️ Dependency updates encountered issues" >> $GITHUB_OUTPUT
              echo "color=warning" >> $GITHUB_OUTPUT
            fi
          else
            echo "message=ℹ️ No dependency updates needed" >> $GITHUB_OUTPUT
            echo "color=good" >> $GITHUB_OUTPUT
          fi

      - name: Create workflow summary
        run: |
          echo "# 📦 Dependency Update Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Status:** ${{ steps.message.outputs.message }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## 📋 Update Results" >> $GITHUB_STEP_SUMMARY
          echo "- Dependency Check: ${{ needs.check-dependencies.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Security Updates: ${{ needs.security-updates.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Dependency Updates: ${{ needs.dependency-updates.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Vulnerability Assessment: ${{ needs.vulnerability-assessment.result }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          if [ "${{ needs.check-dependencies.outputs.has_updates }}" == "true" ]; then
            echo "## 📝 Available Updates" >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
            echo "${{ needs.check-dependencies.outputs.update_summary }}" >> $GITHUB_STEP_SUMMARY
            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
          fi