notify-acfs.yml

# ACFS Installer Change Notification Workflow
# Generated by ACFS audit on 2026-01-26
# Tool: br (beads_rust)
name: Notify ACFS of Installer Changes

on:
  push:
    branches: [main, master]
    paths:
      - 'install.sh'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Test without sending notification'
        required: false
        default: 'false'
        type: boolean
      force:
        description: 'Force notification even if checksum unchanged'
        required: false
        default: 'false'
        type: boolean

env:
  TOOL_NAME: 'br'
  INSTALLER_PATH: 'install.sh'
  ACFS_REPO: 'Dicklesworthstone/agentic_coding_flywheel_setup'

jobs:
  compute-and-notify:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Compute SHA256
        id: checksum
        run: |
          SHA256=$(sha256sum "${{ env.INSTALLER_PATH }}" | cut -d' ' -f1)
          echo "sha256=$SHA256" >> $GITHUB_OUTPUT
          echo "Computed SHA256: $SHA256"

      - name: Get previous checksum
        id: previous
        run: |
          if git show HEAD~1:"${{ env.INSTALLER_PATH }}" > /tmp/prev 2>/dev/null; then
            PREV=$(sha256sum /tmp/prev | cut -d' ' -f1)
            echo "prev_sha256=$PREV" >> $GITHUB_OUTPUT
            echo "Previous SHA256: $PREV"
          else
            echo "prev_sha256=none" >> $GITHUB_OUTPUT
            echo "No previous version found"
          fi

      - name: Compare checksums
        id: compare
        run: |
          if [[ "${{ steps.checksum.outputs.sha256 }}" != "${{ steps.previous.outputs.prev_sha256 }}" ]]; then
            echo "changed=true" >> $GITHUB_OUTPUT
          else
            echo "changed=false" >> $GITHUB_OUTPUT
          fi

      - name: Notify ACFS (dry run)
        if: |
          (steps.compare.outputs.changed == 'true' || github.event.inputs.force == 'true') &&
          github.event.inputs.dry_run == 'true'
        run: |
          echo "::notice::DRY RUN - Would send notification to ACFS"
          echo "Tool: ${{ env.TOOL_NAME }}"
          echo "SHA256: ${{ steps.checksum.outputs.sha256 }}"

      - name: Notify ACFS
        if: |
          (steps.compare.outputs.changed == 'true' || github.event.inputs.force == 'true') &&
          github.event.inputs.dry_run != 'true'
        uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.ACFS_NOTIFY_TOKEN }}
          repository: ${{ env.ACFS_REPO }}
          event-type: installer-updated
          client-payload: |
            {
              "tool": "${{ env.TOOL_NAME }}",
              "new_sha256": "${{ steps.checksum.outputs.sha256 }}",
              "old_sha256": "${{ steps.previous.outputs.prev_sha256 }}",
              "repo": "${{ github.repository }}",
              "commit": "${{ github.sha }}"
            }

      - name: Summary
        if: always()
        run: |
          echo "## ACFS Notification Summary" >> $GITHUB_STEP_SUMMARY
          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Tool | ${{ env.TOOL_NAME }} |" >> $GITHUB_STEP_SUMMARY
          echo "| SHA256 | \`${{ steps.checksum.outputs.sha256 }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Changed | ${{ steps.compare.outputs.changed }} |" >> $GITHUB_STEP_SUMMARY