release.yml

name: Release

on:
  workflow_dispatch:
    inputs:
      version_bump:
        description: "Version bump type"
        required: true
        default: "patch"
        type: choice
        options:
          - patch
          - minor
          - major
      pre_release:
        description: "Pre-release (skips updating consumer repos and notifying Slack)"
        required: false
        default: false
        type: boolean

concurrency:
  group: release
  cancel-in-progress: true

permissions:
  contents: write
  id-token: write

jobs:
  release:
    name: Create release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      sha: ${{ steps.release-commit.outputs.sha }}

    steps:
      - name: Checkout for composite actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: docker/cagent-action
          ref: ${{ github.workflow_sha }}
          fetch-depth: 0
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24
          cache: pnpm

      - name: Build action
        run: pnpm install --frozen-lockfile && pnpm build

      - name: Setup credentials
        uses: ./.github/actions/setup-credentials

      - name: Calculate new version
        id: version
        env:
          BUMP_TYPE: ${{ inputs.version_bump }}
        run: |
          # Get the latest semver tag
          LATEST_TAG=$(git tag -l 'v*.*.*' --sort=-v:refname | head -n1)

          if [ -z "$LATEST_TAG" ]; then
            echo "No existing version tags found, starting at v0.0.0"
            MAJOR=0; MINOR=0; PATCH=0
          else
            VERSION="${LATEST_TAG#v}"
            MAJOR=$(echo "$VERSION" | cut -d. -f1)
            MINOR=$(echo "$VERSION" | cut -d. -f2)
            PATCH=$(echo "$VERSION" | cut -d. -f3)
            echo "Current version: v${MAJOR}.${MINOR}.${PATCH}"
          fi

          # Bump the chosen segment
          case "$BUMP_TYPE" in
            major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
            minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
            patch) PATCH=$((PATCH + 1)) ;;
          esac

          NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}"

          # Collision avoidance: if tag already exists, bump patch until unique
          while git rev-parse "$NEW_VERSION" >/dev/null 2>&1; do
            echo "Tag $NEW_VERSION already exists, bumping patch..."
            PATCH=$((PATCH + 1))
            NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}"
          done

          echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "previous=${LATEST_TAG}" >> $GITHUB_OUTPUT
          echo "New version: $NEW_VERSION (previous: ${LATEST_TAG:-none})"

      # CI cannot push commits to main (branch protection). Instead, we create
      # a detached release commit with pinned refs, reachable only via tags.
      # main keeps SHA-pinned self-refs; the release commit updates them to the
      # HEAD SHA so the tagged commit is fully self-contained.
      - name: Create release commit with pinned refs
        id: release-commit
        env:
          VERSION: ${{ steps.version.outputs.version }}
          GH_TOKEN: ${{ env.GITHUB_APP_TOKEN }}
        run: |
          set -e

          # ── Pass 1: Stage dist/ ──────────────────────────────────────────────
          # Enumerate all dist/ files (both setup-credentials and signed-commit)
          echo "Pass 1: staging dist/ and creating temp commit..."
          if [ ! -d .github/actions/setup-credentials/dist ] || [ -z "$(ls -A .github/actions/setup-credentials/dist)" ]; then
            echo "::error::setup-credentials/dist/ is missing or empty — build may have failed"
            exit 1
          fi
          if [ ! -d .github/actions/signed-commit/dist ] || [ -z "$(ls -A .github/actions/signed-commit/dist)" ]; then
            echo "::error::signed-commit/dist/ is missing — CLI build may have failed"
            exit 1
          fi

          # Create temp branch and first commit (staging dist/)
          STAGING_BRANCH="release-staging/${VERSION}"
          trap 'gh api -X DELETE "repos/docker/cagent-action/git/refs/heads/${STAGING_BRANCH}" >/dev/null 2>&1 || true' EXIT
          TEMP_SHA=$(find .github/actions/setup-credentials/dist/ .github/actions/signed-commit/dist/ -type f 2>/dev/null | \
            GITHUB_TOKEN="${GH_TOKEN}" node .github/actions/signed-commit/dist/signed-commit-cli.js \
              --repo docker/cagent-action \
              --branch "$STAGING_BRANCH" \
              --base-ref main \
              --force \
              --message "release(temp): stage dist/ for ${VERSION}" \
              --add-stdin)

          echo "TEMP_SHA=${TEMP_SHA}"

          # ── Pass 2: Pin refs ─────────────────────────────────────────────────
          # (sed pinning logic stays exactly as-is — pins to TEMP_SHA)
          echo "Pass 2: pinning refs to ${TEMP_SHA} # ${VERSION}..."

          # Replace all docker/cagent-action*@<any-ref> refs (SHA, tag, branch, SHA+comment)
          # with TEMP_SHA and the new version.
          # Uses a capture group so any sub-path (e.g., /review-pr, /review-pr/reply) is preserved.
          # Automatically covers new sub-actions without needing to update this workflow.
          # Only targets `uses:` lines to avoid pinning refs in comments or documentation.
          OLD_PIN_PATTERN='uses: *docker/cagent-action[^@]*@'
          PIN_PATTERN='s|^\([^#]*uses: *docker/cagent-action\)\([^@]*\)@.*|\1\2@'"${TEMP_SHA}"' # '"${VERSION}"'|g'
          PINNED_FILES=()
          while IFS= read -r file; do
            sed -i "$PIN_PATTERN" "$file"
            PINNED_FILES+=("$file")
            echo "  Pinned: $file"
          done < <(grep -rl "$OLD_PIN_PATTERN" --include='*.yml' --include='*.yaml' \
            --exclude-dir=.git \
            review-pr/ .github/workflows/ .github/actions/)

          if [ ${#PINNED_FILES[@]} -eq 0 ]; then
            echo "::error::No SHA-pinned self-refs found to update — expected at least one. Check that review-pr/ actions still reference docker/cagent-action with a SHA pin."
            exit 1
          fi

          # Verify no refs with the old pattern remain (other than those already on TEMP_SHA)
          REMAINING=$(grep -n '^[^#]*uses: *docker/cagent-action[^@]*@' "${PINNED_FILES[@]}" 2>/dev/null | grep -v "@${TEMP_SHA} # ${VERSION}" || true)
          if [ -n "$REMAINING" ]; then
            echo "::error::Old SHA refs remain after pinning:"
            echo "$REMAINING"
            exit 1
          fi

          echo "Pinned refs:"
          grep -rn "cagent-action@" "${PINNED_FILES[@]}"

          # Create second commit on the staging branch (pinned refs)
          RELEASE_SHA=$(printf '%s\n' "${PINNED_FILES[@]}" DOCKER_AGENT_VERSION | \
            GITHUB_TOKEN="${GH_TOKEN}" node .github/actions/signed-commit/dist/signed-commit-cli.js \
              --repo docker/cagent-action \
              --branch "$STAGING_BRANCH" \
              --message "release: ${VERSION}" \
              --add-stdin)

          echo "sha=$RELEASE_SHA" >> $GITHUB_OUTPUT
          echo "Release commit: $RELEASE_SHA"

          # ── Create tag via API (no git push needed) ──────────────────────────
          gh api "repos/docker/cagent-action/git/refs" \
            -f "ref=refs/tags/${VERSION}" \
            -f "sha=${RELEASE_SHA}" > /dev/null

          # ── Clean up staging branch ──────────────────────────────────────────
          gh api -X DELETE "repos/docker/cagent-action/git/refs/heads/${STAGING_BRANCH}" > /dev/null 2>&1 || true

          echo "✅ Tag ${VERSION} created pointing to ${RELEASE_SHA}"

      - name: Create GitHub Release
        env:
          VERSION: ${{ steps.version.outputs.version }}
          PREVIOUS: ${{ steps.version.outputs.previous }}
          GH_TOKEN: ${{ env.GITHUB_APP_TOKEN }}
        run: |
          ARGS=(--generate-notes --latest)
          if [ -n "$PREVIOUS" ]; then
            ARGS+=(--notes-start-tag "$PREVIOUS")
          fi
          gh release create "$VERSION" "${ARGS[@]}"

  publish-agent:
    name: Push review-pr agent to Docker Hub
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ needs.release.outputs.version }}

      - name: Install Docker Agent
        run: |
          set -e
          DOCKER_AGENT_VERSION=$(tr -d '[:space:]' < DOCKER_AGENT_VERSION)
          if [ -z "$DOCKER_AGENT_VERSION" ]; then
            echo "::error::Could not extract Docker Agent version from DOCKER_AGENT_VERSION"
            exit 1
          fi
          echo "Using Docker Agent version from DOCKER_AGENT_VERSION: ${DOCKER_AGENT_VERSION}"
          curl -fL -o docker-agent \
            "https://github.com/docker/docker-agent/releases/download/${DOCKER_AGENT_VERSION}/docker-agent-linux-amd64"
          chmod +x docker-agent
          sudo mv docker-agent /usr/local/bin/

      - name: Docker Hub login
        env:
          HUB_USER: ${{ secrets.HUB_USER }}
          HUB_PAT: ${{ secrets.HUB_PAT }}
        run: |
          set -e
          if [ -z "${HUB_USER}" ]; then echo "::error::HUB_USER secret is not set"; exit 1; fi
          if [ -z "${HUB_PAT}" ]; then echo "::error::HUB_PAT secret is not set"; exit 1; fi
          echo "${HUB_PAT}" | docker login --username "${HUB_USER}" --password-stdin

      - name: Push agent
        env:
          HUB_ORG: ${{ secrets.HUB_ORG }}
        run: |
          set -e
          if [ -z "${HUB_ORG}" ]; then echo "::error::HUB_ORG secret is not set"; exit 1; fi
          cd review-pr/agents
          TELEMETRY_ENABLED=false docker-agent share push pr-review.yaml "${HUB_ORG}/review-pr"

      - name: Upload README to Docker Hub
        env:
          HUB_USER: ${{ secrets.HUB_USER }}
          HUB_PAT: ${{ secrets.HUB_PAT }}
          HUB_ORG: ${{ secrets.HUB_ORG }}
        run: |
          set -e
          TOKEN=$(curl -sSf -X POST https://hub.docker.com/v2/users/login/ \
            -H "Content-Type: application/json" \
            -d "{\"username\":\"${HUB_USER}\",\"password\":\"${HUB_PAT}\"}" | jq -r .token)
          if [ -z "${TOKEN}" ] || [ "${TOKEN}" = "null" ]; then
            echo "::error::Failed to get Docker Hub API token"
            exit 1
          fi
          curl -sSf -X PATCH "https://hub.docker.com/v2/namespaces/${HUB_ORG}/repositories/review-pr" \
            -H "Authorization: Bearer ${TOKEN}" \
            -H "Content-Type: application/json" \
            -d "$(jq -n --arg desc "Docker Agent-powered PR review team. Analyzes code changes, posts reviews, and learns from feedback." \
                       --rawfile readme review-pr/README.md \
                       '{description: $desc, full_description: $readme}')"

  update-self-refs:
    name: Update self-refs in cagent-action main
    needs: release
    if: success()
    runs-on: ubuntu-latest
    concurrency:
      group: update-self-refs
      cancel-in-progress: false
    steps:

      - name: Checkout for composite actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: docker/cagent-action
          ref: ${{ needs.release.outputs.sha }}
          persist-credentials: false

      - name: Setup credentials
        uses: ./.github/actions/setup-credentials

      - name: Checkout cagent-action
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: docker/cagent-action
          token: ${{ env.GITHUB_APP_TOKEN }}

      - name: Setup pnpm
        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 24
          cache: pnpm

      - name: Build signed-commit CLI
        run: pnpm install --frozen-lockfile && pnpm build

      - name: Update self-ref pins
        id: update
        env:
          SHA: ${{ needs.release.outputs.sha }}
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          if [ -z "$SHA" ] || [ -z "$VERSION" ]; then
            echo "::error::SHA or VERSION is empty (SHA='$SHA', VERSION='$VERSION')"
            exit 1
          fi

          OLD_PATTERN='docker/cagent-action[^@]*@'
          # YAML sed: anchored on `uses:` to avoid false matches in comments
          YAML_PIN_PATTERN='s|\(uses: *docker/cagent-action\)\([^@]*\)@.*|\1\2@'"${SHA}"' # '"${VERSION}"'|g'

          UPDATED_FILES=()

          # Update YAML/YAML files (uses: anchored)
          while IFS= read -r file; do
            sed -i "$YAML_PIN_PATTERN" "$file"
            UPDATED_FILES+=("$file")
            echo "  Updated (yaml): $file"
          done < <(grep -rl "$OLD_PATTERN" --include='*.yml' --include='*.yaml' \
            --exclude-dir=.git \
            review-pr/ .github/workflows/ .github/actions/)

          if [ ${#UPDATED_FILES[@]} -eq 0 ]; then
            echo "No self-refs needed updating, skipping."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          elif git diff --quiet; then
            echo "Files already up to date, skipping."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "Updated self-refs to ${SHA} # ${VERSION}"
            echo "skip=false" >> "$GITHUB_OUTPUT"
            printf '%s\n' "${UPDATED_FILES[@]}" > /tmp/updated-files.txt
          fi

      - name: Create or update PR
        if: steps.update.outputs.skip != 'true'
        env:
          GH_TOKEN: ${{ env.GITHUB_APP_TOKEN }}
          VERSION: ${{ needs.release.outputs.version }}
          SHA: ${{ needs.release.outputs.sha }}
        run: |
          BRANCH="auto/update-cagent-action"
          RELEASE_URL="https://github.com/docker/cagent-action/releases/tag/$VERSION"

          # Create signed commit
          COMMIT_OID=$(GITHUB_TOKEN="${GH_TOKEN}" node .github/actions/signed-commit/dist/signed-commit-cli.js \
              --repo docker/cagent-action \
              --branch "$BRANCH" \
              --base-ref main \
              --force \
              --message "chore: update cagent-action to $VERSION" \
              --add-stdin < /tmp/updated-files.txt)

          echo "✅ Signed commit: $COMMIT_OID"

          EXISTING_PR=$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number')

          PR_BODY="$(cat <<EOF
          ## Summary
          Updates \`cagent-action\` reference in \`pr-review.yml\` to [$VERSION]($RELEASE_URL).
          - **Commit**: \`${SHA}\`
          - **Version**: \`${VERSION}\`
          > Auto-generated by the [release](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) workflow.
          EOF
          )"

          if [ -n "$EXISTING_PR" ]; then
            echo "Updating existing PR #$EXISTING_PR"
            gh pr edit "$EXISTING_PR" \
              --title "chore: update cagent-action to $VERSION" \
              --body "$PR_BODY" \
              --add-reviewer "derekmisler"
          else
            echo "Creating new PR"
            gh pr create \
              --head "$BRANCH" \
              --title "chore: update cagent-action to $VERSION" \
              --body "$PR_BODY" \
              --reviewer "derekmisler"
          fi

  update-consumers:
    name: Update consumer repo references
    needs: [release, update-self-refs]
    if: success() && !inputs.pre_release
    runs-on: ubuntu-latest
    concurrency:
      group: update-consumers
      cancel-in-progress: false
    steps:

      - name: Checkout for composite actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: docker/cagent-action
          ref: ${{ needs.release.outputs.sha }}
          persist-credentials: false

      - name: Setup credentials
        uses: ./.github/actions/setup-credentials

      - name: Discover and update consumer repos
        env:
          GH_TOKEN: ${{ env.GITHUB_APP_TOKEN }}
          SHA: ${{ needs.release.outputs.sha }}
          VERSION: ${{ needs.release.outputs.version }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -e

          CAGENT_DIR="$(pwd)"

          if [ -z "$SHA" ] || [ -z "$VERSION" ]; then
            echo "::error::SHA or VERSION is empty (SHA='$SHA', VERSION='$VERSION')"
            exit 1
          fi

          # Discover repos that use the cagent-action reusable workflow.
          # Uses GitHub code search API — results may have eventual consistency lag
          # for very recently created repos, but this is fine for release automation.
          echo "Searching for consumer repos..."
          REPOS=$(gh api --method GET --paginate '/search/code?per_page=100' \
            -f q='org:docker "docker/cagent-action/.github/workflows/review-pr.yml@" language:YAML path:.github/workflows' \
            --jq '[.items[] | {repo: .repository.full_name, path: .path}] | unique_by(.repo) | .[] | "\(.repo) \(.path)"')

          if [ -z "$REPOS" ]; then
            echo "No consumer repos found, skipping."
            exit 0
          fi

          echo "Found consumer repos:"
          echo "$REPOS"
          echo ""

          # Pattern to match any cagent-action workflow ref (SHA, tag, branch, SHA+comment)
          OLD_PATTERN='cagent-action/\.github/workflows/review-pr\.yml@'

          BRANCH="auto/update-cagent-action"
          RELEASE_URL="https://github.com/docker/cagent-action/releases/tag/$VERSION"

          while IFS=' ' read -r REPO FILE_PATH; do
            echo "=========================================="
            echo "Processing ${REPO} (${FILE_PATH})..."
            echo "=========================================="

            # Clone the repo into a temp directory
            # Set up cleanup trap for this iteration
            trap 'cd /; rm -rf "$WORK_DIR"' EXIT

            WORK_DIR=$(mktemp -d)
            if ! gh repo clone "$REPO" "$WORK_DIR" -- --depth=1 2>/dev/null; then
              echo "::warning::Failed to clone $REPO — skipping (token may lack access)"
              rm -rf "$WORK_DIR"
              continue
            fi

            cd "$WORK_DIR"

            # Check if the app has push access to this repo
            CAN_PUSH=$(gh api "repos/$REPO" --jq '.permissions.push' 2>/dev/null || echo "false")
            if [ "$CAN_PUSH" != "true" ]; then
              echo "::warning::No push access to $REPO — skipping (app may not be installed or lacks write access)"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            # Check that the file exists and contains the pattern
            if [ ! -f "$FILE_PATH" ]; then
              echo "::warning::$FILE_PATH not found in $REPO — skipping"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            if ! grep -q "$OLD_PATTERN" "$FILE_PATH"; then
              echo "Pattern not found in $FILE_PATH — may already be up to date, skipping"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            # Apply the sed replacement
            sed -i 's|\(docker/cagent-action/\.github/workflows/review-pr\.yml@\).*|\1'"${SHA}"' # '"${VERSION}"'|g' "$FILE_PATH"

            if git diff --quiet "$FILE_PATH"; then
              echo "No changes after sed — already up to date"
              cd /
              rm -rf "$WORK_DIR"
              continue
            fi

            echo "Updated reference to ${SHA} # ${VERSION}"

            # Create signed commit via API
            COMMIT_OID=$(GITHUB_TOKEN="${GH_TOKEN}" node "${CAGENT_DIR}/.github/actions/signed-commit/dist/signed-commit-cli.js" \
              --repo "$REPO" \
              --branch "$BRANCH" \
              --base-ref main \
              --force \
              --message "chore: update cagent-action to $VERSION" \
              --add "$FILE_PATH") || {
              echo "::warning::Failed to create signed commit in $REPO (may lack write access)"
              cd /
              rm -rf "$WORK_DIR"
              continue
            }

            echo "✅ Signed commit: $COMMIT_OID"

            # Create or update PR
            EXISTING_PR=$(gh pr list --repo "$REPO" --head "$BRANCH" --state open --json number --jq '.[0].number')

            # Build PR body safely using printf to avoid shell expansion of FILE_PATH
            # FILE_PATH comes from GitHub API and could theoretically contain shell metacharacters
            printf -v PR_BODY '%s\n%s\n%s\n%s\n%s' \
              "## Summary" \
              "Updates \`cagent-action\` reference in \`${FILE_PATH}\` to [${VERSION}](${RELEASE_URL})." \
              "- **Commit**: \`${SHA}\`" \
              "- **Version**: \`${VERSION}\`" \
              "> Auto-generated by the [release](${RUN_URL}) workflow."

            if [ -n "$EXISTING_PR" ]; then
              echo "Updating existing PR #$EXISTING_PR in $REPO"
              gh pr edit "$EXISTING_PR" --repo "$REPO" \
                --title "chore: update cagent-action to $VERSION" \
                --body "$PR_BODY" \
                --add-reviewer "derekmisler" 2>&1 || echo "::warning::Failed to update PR #$EXISTING_PR in $REPO (may be non-fatal)"
            else
              echo "Creating new PR in $REPO"
              gh pr create --repo "$REPO" \
                --head "$BRANCH" \
                --title "chore: update cagent-action to $VERSION" \
                --body "$PR_BODY" \
                --reviewer "derekmisler" || echo "::warning::Failed to create PR in $REPO"
            fi

            # Clear trap and cleanup
            trap - EXIT

            cd /
            rm -rf "$WORK_DIR"
            echo ""
          done <<< "$REPOS"

          echo "Done updating consumer repos."

  notify:
    name: Notify Slack
    needs: [release, publish-agent, update-self-refs, update-consumers]
    if: success() && !inputs.pre_release
    runs-on: ubuntu-latest
    steps:

      - name: Checkout for composite actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: docker/cagent-action
          ref: ${{ needs.release.outputs.sha }}
          persist-credentials: false

      - name: Setup credentials
        uses: ./.github/actions/setup-credentials

      - name: Fetch release notes from GitHub
        id: release-notes
        env:
          GH_TOKEN: ${{ env.GITHUB_APP_TOKEN }}
          VERSION: ${{ needs.release.outputs.version }}
        run: |
          if ! NOTES=$(gh release view "$VERSION" --repo docker/cagent-action --json body --jq '.body'); then
            echo "::warning::Failed to fetch release notes, using fallback"
            NOTES="Release ${VERSION} — see GitHub for details."
          fi
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Generate Slack summary
        id: slack-summary
        # Pinned to a SHA — automatically updated by the update-self-refs job after each release.
        # GitHub Actions requires static `uses:` values, so we can't pin dynamically.
        uses: docker/cagent-action@d98096f432f2aea5091c811852c4da804e60623a # v1.4.1
        with:
          agent: agentcatalog/github-action-release-notes
          prompt: |
            Convert these release notes to a SHORT plain text Slack message.

            VERSION: ${{ needs.release.outputs.version }}
            RELEASE URL: https://github.com/docker/cagent-action/releases/tag/${{ needs.release.outputs.version }}

            ORIGINAL RELEASE NOTES:
            ${{ steps.release-notes.outputs.notes }}

            CRITICAL - PLAIN TEXT ONLY:
            This goes through Slack Workflow Builder which does NOT support formatting.
            - DO NOT use *asterisks* - they show literally
            - DO NOT use <url|text> links - use plain URLs
            - DO use :emoji: codes - those work
            - DO use bullet points with •
            - Use CAPS for section headers instead of bold

            OUTPUT REQUIREMENTS:
            - Keep it SHORT - max 5-7 bullet points total
            - Include the release URL at the end (plain URL, not link syntax)
            - Output ONLY the Slack message, nothing else
            - Skip the "Platforms" line — this is a GitHub Action, not a binary

            EXAMPLE FORMAT:
            :tada: cagent-action v1.3.0 Released

            :package: WHAT'S NEW
            • New feature one
            • New feature two

            :wrench: IMPROVEMENTS
            • Enhancement description

            :bug: BUG FIXES
            • Fix description

            :inbox_tray: Release: https://github.com/docker/cagent-action/releases/tag/v1.3.0
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

      - name: Send Slack notification
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
          VERSION: ${{ needs.release.outputs.version }}
          SLACK_SUMMARY_FILE: ${{ steps.slack-summary.outputs.output-file }}
        run: |
          if [ -z "$SLACK_WEBHOOK_URL" ]; then
            echo "⚠️ SLACK_RELEASE_WEBHOOK not configured, skipping notification"
            exit 0
          fi

          RELEASE_URL="https://github.com/docker/cagent-action/releases/tag/${VERSION}"

          # Use the AI-generated Slack summary
          if [ -f "$SLACK_SUMMARY_FILE" ] && [ -s "$SLACK_SUMMARY_FILE" ]; then
            MESSAGE_TEXT=$(cat "$SLACK_SUMMARY_FILE")
          else
            # Fallback message if summary generation failed
            MESSAGE_TEXT=$(printf ':tada: cagent-action %s Released\n\n:package: See the full release notes for details.\n\n:inbox_tray: Release: %s' "$VERSION" "$RELEASE_URL")
          fi

          # Create payload with text and release_url fields (matching Slack Workflow Builder webhook)
          PAYLOAD=$(jq -n \
            --arg text "$MESSAGE_TEXT" \
            --arg release_url "$RELEASE_URL" \
            '{
              text: $text,
              release_url: $release_url
            }')

          if ! HTTP_CODE=$(curl -s -w "%{http_code}" -o /tmp/slack_response.txt -X POST "$SLACK_WEBHOOK_URL" \
            -H "Content-Type: application/json" \
            -d "$PAYLOAD"); then
            echo "⚠️ Slack notification failed (curl error)"
          elif [ "$HTTP_CODE" -eq 200 ]; then
            echo "✅ Slack notification sent"
          else
            echo "⚠️ Slack notification failed (HTTP $HTTP_CODE)"
            cat /tmp/slack_response.txt
          fi
          # Don't fail the workflow if Slack fails