model-discovery.yml

name: Model Discovery

on:
  schedule:
    - cron: "0 6 * * *" # Daily at 06:00 UTC
  workflow_dispatch: {}

concurrency:
  group: model-discovery
  cancel-in-progress: false

jobs:
  discover:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write
      id-token: write # For Workload Identity Federation

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3
        with:
          project_id: ${{ secrets.GCP_PROJECT }}
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}

      - name: Set up gcloud CLI
        uses: google-github-actions/setup-gcloud@v3

      - name: Run model discovery
        env:
          GCP_REGION: ${{ secrets.GCP_REGION }}
          GCP_PROJECT: ${{ secrets.GCP_PROJECT }}
        run: python .github/scripts/model-discovery.py

      - name: Check for changes
        id: diff
        run: git diff --quiet -- components/manifests/base/core/models.json && echo "changed=false" >> "$GITHUB_OUTPUT" || echo "changed=true" >> "$GITHUB_OUTPUT"

      - name: Validate manifest
        if: steps.diff.outputs.changed == 'true'
        run: python .github/scripts/validate-model-manifest.py

      - name: Generate PR body
        if: steps.diff.outputs.changed == 'true'
        id: body
        run: |
          DIFF=$(git diff -- components/manifests/base/core/models.json)
          BODY=$(cat <<'HEADER'
          Automated model discovery run.

          This PR updates `components/manifests/base/core/models.json` based on
          probing Vertex AI endpoints. Validation passed — safe to auto-merge.

          Unleash flags are synced automatically on deploy by the
          `sync-model-flags` Job.

          HEADER
          )
          BODY="${BODY}
          <details><summary>Diff</summary>

          \`\`\`diff
          ${DIFF}
          \`\`\`
          </details>"
          # Write to file to avoid shell escaping issues
          echo "$BODY" > /tmp/pr-body.md

      - name: Create or update PR
        if: steps.diff.outputs.changed == 'true'
        id: create-pr
        uses: peter-evans/create-pull-request@v8
        with:
          add-paths: components/manifests/base/core/models.json
          branch: automated/model-discovery
          commit-message: "chore: update model manifest from Vertex AI discovery"
          title: "chore: update model manifest"
          body-path: /tmp/pr-body.md
          labels: automated,models
          delete-branch: true

      - name: Generate app token
        if: steps.create-pr.outputs.pull-request-number
        id: app-token
        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
        with:
          app-id: ${{ secrets.AMBIENT_APP_ID }}
          private-key: ${{ secrets.AMBIENT_APP_PRIVATE_KEY }}

      - name: Approve PR
        if: steps.create-pr.outputs.pull-request-number
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_NUMBER: ${{ steps.create-pr.outputs.pull-request-number }}
        run: gh pr review "$PR_NUMBER" --approve --body "Manifest validation passed — auto-approved by model discovery workflow"

      - name: Enable auto-merge
        if: steps.create-pr.outputs.pull-request-number
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ steps.create-pr.outputs.pull-request-number }}
        run: gh pr merge "$PR_NUMBER" --auto --squash