setup.sh

#!/usr/bin/env bash
set +o histexpand

# Setup Action
# Copies activation job files to the agent environment
#
# This script copies JavaScript (.cjs) and JSON files from the js/ directory
# and shell scripts from the sh/ directory to the destination directory.
#
# The js/ and sh/ directories contain the source of truth for all JavaScript
# and shell script files. These files are manually edited and committed to git.
# They are NOT generated by a build process.
#
# At runtime, this script copies the files from actions/setup/js/ and
# actions/setup/sh/ to $RUNNER_TEMP/gh-aw/actions where workflows can access them.
# Uses $RUNNER_TEMP instead of /opt/gh-aw for compatibility with self-hosted runners
# that may not have write access to /opt.

set -e

# Capture start time immediately so the OTLP setup span reflects actual setup duration.
# Falls back to 0 when node is unavailable.
SETUP_START_MS=$(node -e "process.stdout.write(String(Date.now()))" 2>/dev/null || echo "0")

# Log a message only when GitHub Actions debug mode is active.
# Handles both RUNNER_DEBUG=1 and RUNNER_DEBUG=true (GitHub Actions sets 'true').
debug_log() {
  if [[ "${RUNNER_DEBUG:-0}" == "1" || "${RUNNER_DEBUG:-0}" == "true" ]]; then
    echo "$@"
  fi
}

# Helper: create directories, using sudo on macOS where system directories are root-owned
create_dir() {
  if [[ "$(uname -s)" == "Darwin" ]] && [[ "$1" == /opt/* ]]; then
    sudo mkdir -p "$1"
    sudo chown -R "$(whoami)" "$1"
  else
    mkdir -p "$1"
  fi
}

# GH_AW_ROOT uses RUNNER_TEMP for write access on both GitHub-hosted and self-hosted runners.
# RUNNER_TEMP is guaranteed to be set by GitHub Actions and is always writable.
GH_AW_ROOT="${RUNNER_TEMP}/gh-aw"

# Verify RUNNER_TEMP is set and the directory has write access
if [ -z "${RUNNER_TEMP}" ]; then
  echo "::error::RUNNER_TEMP environment variable is not set. This script must run in a GitHub Actions environment."
  exit 1
fi

if [ ! -d "${RUNNER_TEMP}" ]; then
  echo "::error::RUNNER_TEMP directory does not exist: ${RUNNER_TEMP}"
  exit 1
fi

if [ ! -w "${RUNNER_TEMP}" ]; then
  echo "::error::RUNNER_TEMP directory is not writable: ${RUNNER_TEMP}"
  echo "::error::The runner user ($(whoami)) does not have write access to ${RUNNER_TEMP}"
  exit 1
fi

# Detect tree collision: RUNNER_TEMP must not resolve to /tmp.
# gh-aw mounts ${RUNNER_TEMP}/gh-aw read-only (setup tree) and /tmp/gh-aw read-write
# (runtime tree). When RUNNER_TEMP=/tmp both paths collapse into /tmp/gh-aw, giving
# the agent write access to compiled scripts, prompts, and MCP configs that must stay
# immutable. Fail fast here rather than silently running with a broken security boundary.
RESOLVED_RUNNER_TEMP="$(cd "${RUNNER_TEMP}" && pwd -P)"
if [ -z "${RESOLVED_RUNNER_TEMP}" ]; then
  echo "::error::Failed to resolve canonical path for RUNNER_TEMP: ${RUNNER_TEMP}"
  exit 1
fi
if [ "${RESOLVED_RUNNER_TEMP%/}" = "/tmp" ]; then
  echo "::error::RUNNER_TEMP resolves to /tmp, which conflicts with gh-aw's runtime tree (/tmp/gh-aw). Please configure your self-hosted runner with a different temp directory to maintain security isolation. See: https://docs.github.com/en/actions/hosting-your-own-runners"
  exit 1
fi

debug_log "Using RUNNER_TEMP: ${RUNNER_TEMP} (resolved: ${RESOLVED_RUNNER_TEMP}, writable: yes)"

# Get destination from input or use default
DESTINATION="${INPUT_DESTINATION:-${GH_AW_ROOT}/actions}"

# Get safe-output-custom-tokens flag from input (default: false)
SAFE_OUTPUT_CUSTOM_TOKENS_ENABLED="${INPUT_SAFE_OUTPUT_CUSTOM_TOKENS:-false}"

# Get safe-output-artifact-client flag from input (default: false)
SAFE_OUTPUT_ARTIFACT_CLIENT_ENABLED="${INPUT_SAFE_OUTPUT_ARTIFACT_CLIENT:-false}"

debug_log "Copying activation files to ${DESTINATION}"
debug_log "Safe-output custom tokens support: ${SAFE_OUTPUT_CUSTOM_TOKENS_ENABLED}"

# Create destination directory if it doesn't exist
create_dir "${DESTINATION}"
debug_log "Created directory: ${DESTINATION}"

# Remove and recreate /tmp/gh-aw directory to ensure a clean state
rm -rf /tmp/gh-aw
mkdir -p /tmp/gh-aw
debug_log "Created /tmp/gh-aw directory"

# Get the directory where this script is located
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
JS_SOURCE_DIR="${SCRIPT_DIR}/js"

debug_log "Script directory: ${SCRIPT_DIR}"
debug_log "Looking for JavaScript sources in: ${JS_SOURCE_DIR}"

# In debug mode, list the contents of the script directory to understand the file layout
if [[ "${RUNNER_DEBUG:-0}" == "1" ]]; then
  echo "Contents of ${SCRIPT_DIR}:"
  ls -la "${SCRIPT_DIR}" || echo "::warning::Failed to list ${SCRIPT_DIR}"
fi

# Check if js directory exists
if [ ! -d "${JS_SOURCE_DIR}" ]; then
  echo "::error::JavaScript source directory not found: ${JS_SOURCE_DIR}"
  echo "::error::The js/ directory should contain the source of truth JavaScript files"
  echo "::error::These files should be committed to git in actions/setup/js/"
  
  # Show parent directory contents to aid debugging
  echo "Contents of parent directory $(dirname "${SCRIPT_DIR}"):"
  ls -la "$(dirname "${SCRIPT_DIR}")" || echo "::warning::Failed to list parent directory"
  
  exit 1
fi

# In debug mode, list files in js directory
if [[ "${RUNNER_DEBUG:-0}" == "1" ]]; then
  echo "Files in ${JS_SOURCE_DIR}:"
  ls -1 "${JS_SOURCE_DIR}" | head -10 || echo "::warning::Failed to list files in ${JS_SOURCE_DIR}"
fi
FILE_COUNT_IN_DIR=$(ls -1 "${JS_SOURCE_DIR}" 2>/dev/null | wc -l)
debug_log "Found ${FILE_COUNT_IN_DIR} files in ${JS_SOURCE_DIR}"

# Copy all .cjs files from js/ to destination (excluding test files)
FILE_COUNT=0
for file in "${JS_SOURCE_DIR}"/*.cjs; do
  if [ -f "$file" ]; then
    filename=$(basename "$file")
    # Skip test files
    if [[ "$filename" == *.test.cjs ]]; then
      debug_log "Skipping test file: ${filename}"
      continue
    fi
    cp "$file" "${DESTINATION}/${filename}"
    debug_log "Copied: ${filename}"
    FILE_COUNT=$((FILE_COUNT + 1))
  fi
done

# Copy any .json files as well
for file in "${JS_SOURCE_DIR}"/*.json; do
  if [ -f "$file" ]; then
    filename=$(basename "$file")
    cp "$file" "${DESTINATION}/${filename}"
    debug_log "Copied: ${filename}"
    FILE_COUNT=$((FILE_COUNT + 1))
  fi
done

# Copy shell scripts from sh/ directory with executable permissions
SH_SOURCE_DIR="${SCRIPT_DIR}/sh"
if [ -d "${SH_SOURCE_DIR}" ]; then
  debug_log "Found shell scripts directory: ${SH_SOURCE_DIR}"
  for file in "${SH_SOURCE_DIR}"/*.sh; do
    if [ -f "$file" ]; then
      filename=$(basename "$file")
      cp "$file" "${DESTINATION}/${filename}"
      chmod +x "${DESTINATION}/${filename}"
      debug_log "Copied shell script: ${filename}"
      FILE_COUNT=$((FILE_COUNT + 1))
    fi
  done
else
  debug_log "No shell scripts directory found at ${SH_SOURCE_DIR}"
fi

echo "Successfully copied ${FILE_COUNT} files to ${DESTINATION}"

# Export model multipliers JSON as GH_AW_MODEL_MULTIPLIERS environment variable.
# This makes the per-model effective token multipliers available to JavaScript
# actions running in subsequent steps so they can compute Effective Tokens (ET).
MODEL_MULTIPLIERS_FILE="${DESTINATION}/model_multipliers.json"
if [ -f "${MODEL_MULTIPLIERS_FILE}" ] && [ -n "${GITHUB_ENV:-}" ]; then
  {
    echo "GH_AW_MODEL_MULTIPLIERS<<EOF_MODEL_MULTIPLIERS"
    cat "${MODEL_MULTIPLIERS_FILE}"
    echo "EOF_MODEL_MULTIPLIERS"
  } >> "${GITHUB_ENV}"
  debug_log "Exported GH_AW_MODEL_MULTIPLIERS from ${MODEL_MULTIPLIERS_FILE}"
fi

# Copy prompt markdown files to their expected directory
PROMPTS_DEST="${GH_AW_ROOT}/prompts"
debug_log "Copying prompt markdown files to ${PROMPTS_DEST}"
create_dir "${PROMPTS_DEST}"

MD_SOURCE_DIR="${SCRIPT_DIR}/md"
PROMPT_COUNT=0
if [ -d "${MD_SOURCE_DIR}" ]; then
  debug_log "Found markdown prompts directory: ${MD_SOURCE_DIR}"
  for file in "${MD_SOURCE_DIR}"/*.md; do
    if [ -f "$file" ]; then
      filename=$(basename "$file")
      cp "$file" "${PROMPTS_DEST}/${filename}"
      debug_log "Copied prompt: ${filename}"
      PROMPT_COUNT=$((PROMPT_COUNT + 1))
    fi
  done
  debug_log "Successfully copied ${PROMPT_COUNT} prompt files to ${PROMPTS_DEST}"
else
  echo "::warning::No markdown prompts directory found at ${MD_SOURCE_DIR}"
fi

# Copy mcp-scripts files to their expected directory
MCP_SCRIPTS_DEST="${GH_AW_ROOT}/mcp-scripts"
debug_log "Copying mcp-scripts files to ${MCP_SCRIPTS_DEST}"
create_dir "${MCP_SCRIPTS_DEST}"

MCP_SCRIPTS_FILES=(
  "mcp_scripts_bootstrap.cjs"
  "mcp_scripts_config_loader.cjs"
  "mcp_scripts_mcp_server.cjs"
  "mcp_scripts_mcp_server_http.cjs"
  "mcp_scripts_tool_factory.cjs"
  "mcp_scripts_validation.cjs"
  "mcp_server_core.cjs"
  "mcp_logger.cjs"
  "mcp_http_transport.cjs"
  "mcp_http_server_runner.cjs"
  "mcp_handler_shell.cjs"
  "mcp_handler_python.cjs"
  "mcp_handler_go.cjs"
  "mcp_handler_javascript.cjs"
  "mcp_handler_process.cjs"
  "read_buffer.cjs"
  "generate_mcp_scripts_config.cjs"
  "setup_globals.cjs"
  "github_rate_limit_logger.cjs"
  "error_helpers.cjs"
  "error_codes.cjs"
  "constants.cjs"
  "mcp_enhanced_errors.cjs"
  "shim.cjs"
  "mcp-scripts-runner.cjs"
)

MCP_SCRIPTS_COUNT=0
MCP_SCRIPTS_MISSING=()
for file in "${MCP_SCRIPTS_FILES[@]}"; do
  if [ -f "${JS_SOURCE_DIR}/${file}" ]; then
    cp "${JS_SOURCE_DIR}/${file}" "${MCP_SCRIPTS_DEST}/${file}"
    debug_log "Copied mcp-scripts: ${file}"
    MCP_SCRIPTS_COUNT=$((MCP_SCRIPTS_COUNT + 1))
  else
    echo "::error::MCP Scripts file not found: ${file}"
    MCP_SCRIPTS_MISSING+=("${file}")
  fi
done

if [ ${#MCP_SCRIPTS_MISSING[@]} -gt 0 ]; then
  echo "::error::Failed to copy ${#MCP_SCRIPTS_MISSING[@]} required mcp-scripts files:"
  for missing_file in "${MCP_SCRIPTS_MISSING[@]}"; do
    echo "::error::  - ${missing_file}"
  done
  echo "::error::Expected location: ${JS_SOURCE_DIR}"
  echo "::error::These files must exist in the repository for mcp-scripts to work"
  exit 1
fi

echo "Successfully copied ${MCP_SCRIPTS_COUNT} mcp-scripts files to ${MCP_SCRIPTS_DEST}"

# Copy safe-outputs files to their expected directory
SAFE_OUTPUTS_DEST="${GH_AW_ROOT}/safeoutputs"
debug_log "Copying safe-outputs files to ${SAFE_OUTPUTS_DEST}"
create_dir "${SAFE_OUTPUTS_DEST}"

SAFE_OUTPUTS_FILES=(
  "safe_outputs_mcp_server.cjs"
  "safe_outputs_mcp_server_http.cjs"
  "safe_outputs_bootstrap.cjs"
  "safe_outputs_tools_loader.cjs"
  "safe_outputs_config.cjs"
  "safe_outputs_handlers.cjs"
  "allowed_extensions_helpers.cjs"
  "safe_outputs_append.cjs"
  "mcp_server_core.cjs"
  "mcp_logger.cjs"
  "mcp_http_transport.cjs"
  "mcp_http_server_runner.cjs"
  "mcp_handler_python.cjs"
  "mcp_handler_shell.cjs"
  "mcp_handler_go.cjs"
  "mcp_handler_javascript.cjs"
  "mcp_handler_process.cjs"
  "read_buffer.cjs"
  "mcp_scripts_validation.cjs"
  "messages.cjs"
  "messages_core.cjs"
  "messages_footer.cjs"
  "messages_header.cjs"
  "messages_run_status.cjs"
  "messages_staged.cjs"
  "messages_close_discussion.cjs"
  "effective_tokens.cjs"
  "estimate_tokens.cjs"
  "generate_git_patch.cjs"
  "generate_git_bundle.cjs"
  "git_patch_utils.cjs"
  "get_base_branch.cjs"
  "get_current_branch.cjs"
  "normalize_branch_name.cjs"
  "write_large_content_to_file.cjs"
  "generate_compact_schema.cjs"
  "setup_globals.cjs"
  "github_rate_limit_logger.cjs"
  "error_helpers.cjs"
  "error_codes.cjs"
  "constants.cjs"
  "git_helpers.cjs"
  "github_api_helpers.cjs"
  "find_repo_checkout.cjs"
  "mcp_enhanced_errors.cjs"
  "comment_limit_helpers.cjs"
  "shim.cjs"
  "repo_helpers.cjs"
  "glob_pattern_helpers.cjs"
  "handler_auth.cjs"
  "missing_messages_helper.cjs"
  "firewall_blocked_domains.cjs"
  "render_template.cjs"
  "is_truthy.cjs"
  "template_branch.cjs"
  "gateway_difc_filtered.cjs"
  "missing_info_formatter.cjs"
  "sanitize_content_core.cjs"
  "markdown_code_region_balancer.cjs"
  "temporary_id.cjs"
)

SAFE_OUTPUTS_COUNT=0
SAFE_OUTPUTS_MISSING=()
for file in "${SAFE_OUTPUTS_FILES[@]}"; do
  if [ -f "${JS_SOURCE_DIR}/${file}" ]; then
    cp "${JS_SOURCE_DIR}/${file}" "${SAFE_OUTPUTS_DEST}/${file}"
    debug_log "Copied safe-outputs: ${file}"
    SAFE_OUTPUTS_COUNT=$((SAFE_OUTPUTS_COUNT + 1))
  elif [ -f "${DESTINATION}/${file}" ]; then
    # If file was already copied to main destination, copy from there
    cp "${DESTINATION}/${file}" "${SAFE_OUTPUTS_DEST}/${file}"
    debug_log "Copied safe-outputs (from destination): ${file}"
    SAFE_OUTPUTS_COUNT=$((SAFE_OUTPUTS_COUNT + 1))
  else
    echo "::error::Safe-outputs file not found: ${file}"
    SAFE_OUTPUTS_MISSING+=("${file}")
  fi
done

if [ ${#SAFE_OUTPUTS_MISSING[@]} -gt 0 ]; then
  echo "::error::Failed to copy ${#SAFE_OUTPUTS_MISSING[@]} required safe-outputs files:"
  for missing_file in "${SAFE_OUTPUTS_MISSING[@]}"; do
    echo "::error::  - ${missing_file}"
  done
  echo "::error::Expected locations: ${JS_SOURCE_DIR} or ${DESTINATION}"
  echo "::error::These files must exist in the repository for safe-outputs to work"
  exit 1
fi

# Copy the MCP server entry point to mcp-server.cjs (the name expected by MCP config)
if [ -f "${JS_SOURCE_DIR}/safe-outputs-mcp-server.cjs" ]; then
  cp "${JS_SOURCE_DIR}/safe-outputs-mcp-server.cjs" "${SAFE_OUTPUTS_DEST}/mcp-server.cjs"
  chmod +x "${SAFE_OUTPUTS_DEST}/mcp-server.cjs"
  debug_log "Copied safe-outputs MCP entry point: mcp-server.cjs"
  SAFE_OUTPUTS_COUNT=$((SAFE_OUTPUTS_COUNT + 1))
else
  echo "::warning::Safe-outputs MCP entry point not found: safe-outputs-mcp-server.cjs"
fi

# Copy safe_outputs_tools.json to tools.json (required by safe-outputs server)
if [ -f "${JS_SOURCE_DIR}/safe_outputs_tools.json" ]; then
  cp "${JS_SOURCE_DIR}/safe_outputs_tools.json" "${SAFE_OUTPUTS_DEST}/tools.json"
  debug_log "Copied safe-outputs tools definition: tools.json"
  SAFE_OUTPUTS_COUNT=$((SAFE_OUTPUTS_COUNT + 1))
else
  echo "::error::Safe-outputs tools definition not found: safe_outputs_tools.json"
  exit 1
fi

# Create empty config.json if it doesn't exist (required by safe-outputs server check)
# The actual config is optional and will be loaded from environment if provided
if [ ! -f "${SAFE_OUTPUTS_DEST}/config.json" ]; then
  echo "{}" > "${SAFE_OUTPUTS_DEST}/config.json"
  debug_log "Created empty config.json for safe-outputs server"
fi

echo "Successfully copied ${SAFE_OUTPUTS_COUNT} safe-outputs files to ${SAFE_OUTPUTS_DEST}"

# Install @actions/artifact package if upload-artifact safe output is configured.
# upload_artifact.cjs uses DefaultArtifactClient to upload via Actions REST API directly.
if [ "${SAFE_OUTPUT_ARTIFACT_CLIENT_ENABLED}" = "true" ]; then
  echo "Artifact client enabled - installing @actions/artifact package in ${DESTINATION}..."
  cd "${DESTINATION}"

  # Check if npm is available
  if ! command -v npm &> /dev/null; then
    echo "::error::npm is not available. Cannot install @actions/artifact package."
    exit 1
  fi

  # Create a minimal package.json if it doesn't exist
  if [ ! -f "package.json" ]; then
    echo '{"private": true}' > package.json
  fi

  # Install @actions/artifact package
  npm install --ignore-scripts --no-save --loglevel=error @actions/artifact@^6.0.0 2>&1 | grep -v "npm WARN" || true
  if [ -d "node_modules/@actions/artifact" ]; then
    echo "✓ Successfully installed @actions/artifact package"
  else
    echo "::error::Failed to install @actions/artifact package"
    exit 1
  fi

  # Return to original directory
  cd - > /dev/null
else
  debug_log "Artifact client not enabled - skipping @actions/artifact installation"
fi

# Send OTLP job setup span when configured (non-fatal).
# Delegates to action_setup_otlp.cjs (same file used by actions/setup/index.js)
# to keep dev/release and script mode behavior in sync.
# Skipped when GH_AW_SKIP_SETUP_OTLP=1 because index.js will send the span itself.
if [ -z "${GH_AW_SKIP_SETUP_OTLP}" ] && command -v node &>/dev/null && [ -f "${DESTINATION}/action_setup_otlp.cjs" ]; then
  debug_log "Sending OTLP setup span..."
  SETUP_START_MS="${SETUP_START_MS}" INPUT_TRACE_ID="${INPUT_TRACE_ID:-}" INPUT_JOB_NAME="${INPUT_JOB_NAME:-}" node "${DESTINATION}/action_setup_otlp.cjs" || true
  debug_log "OTLP setup span step complete"
fi

# Set output
if [ -n "${GITHUB_OUTPUT}" ]; then
  echo "files_copied=${FILE_COUNT}" >> "${GITHUB_OUTPUT}"
  echo "mcp_scripts_files_copied=${MCP_SCRIPTS_COUNT}" >> "${GITHUB_OUTPUT}"
  echo "safe_outputs_files_copied=${SAFE_OUTPUTS_COUNT}" >> "${GITHUB_OUTPUT}"
  echo "prompt_files_copied=${PROMPT_COUNT}" >> "${GITHUB_OUTPUT}"
else
  debug_log "GITHUB_OUTPUT not set, skipping output"
fi