name: Explore (hook capabilities)

# Investigative probe (mock/spy framework groundwork; see
# docs/mock-spy-design.md). Installs and authenticates every real harness, then
# runs scripts/explore-hooks.sh against each to answer, from live behavior:
# does its pre/post tool hook fire headlessly, what payload does it receive,
# and are input-rewrite / result-replacement verdicts honored? The point is to
# SOURCE each harness's mock verdict shape from real output before any `mock`
# capability lands in the registry — never guess (the same discipline as
# explore-events.yml for transcript shapes).
#
# Triggers: dispatch on demand from the Actions tab (re-probe when a harness
# updates), PLUS same-repo PRs that modify the probe itself — because a
# workflow_dispatch entry only exists once the file is on the default branch,
# a paths-filtered pull_request trigger is what lets a new or changed probe
# produce its logs BEFORE merge (and stays silent on every unrelated PR).
# Gated like the e2e workflows: canonical repo and non-fork PRs only, so its
# secrets are never reachable by untrusted code.

on:
  workflow_dispatch:
  pull_request:
    paths:
      - scripts/explore-hooks.sh
      - .github/workflows/explore-hooks.yml

permissions:
  contents: read

concurrency:
  group: explore-hooks-${{ github.ref }}
  cancel-in-progress: true

jobs:
  explore:
    name: explore harness hook capabilities
    if: >-
      github.repository == 'nickderobertis/oneharness' &&
      (github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    timeout-minutes: 60
    env:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
      CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: lts/*

      - name: Install harness CLIs
        run: |
          npm install -g @anthropic-ai/claude-code @openai/codex opencode-ai \
            @qwen-code/qwen-code @charmland/crush @github/copilot
          curl https://cursor.com/install -fsS | bash
          if [ -x "$HOME/.local/bin/cursor-agent" ]; then echo "$HOME/.local/bin" >> "$GITHUB_PATH"; fi
          curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh | CONFIGURE=false bash
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Authenticate Codex (headless)
        run: printenv OPENAI_API_KEY | codex login --with-api-key || true

      - name: Probe claude-code
        continue-on-error: true
        env:
          EXPLORE_MODEL: ${{ vars.CLAUDE_E2E_MODEL }}
        run: bash scripts/explore-hooks.sh claude-code

      - name: Probe codex
        continue-on-error: true
        env:
          EXPLORE_MODEL: ${{ vars.CODEX_E2E_MODEL }}
        run: bash scripts/explore-hooks.sh codex

      - name: Probe opencode
        continue-on-error: true
        env:
          EXPLORE_MODEL: ${{ vars.OPENCODE_E2E_MODEL || 'anthropic/claude-haiku-4-5' }}
        run: bash scripts/explore-hooks.sh opencode

      - name: Probe cursor
        continue-on-error: true
        env:
          EXPLORE_MODEL: ${{ vars.CURSOR_E2E_MODEL }}
        run: bash scripts/explore-hooks.sh cursor

      - name: Probe goose
        continue-on-error: true
        env:
          GOOSE_PROVIDER: openai
          GOOSE_MODEL: ${{ vars.GOOSE_E2E_MODEL || 'gpt-4o-mini' }}
        run: bash scripts/explore-hooks.sh goose

      - name: Probe qwen
        continue-on-error: true
        env:
          OPENAI_BASE_URL: ${{ vars.QWEN_OPENAI_BASE_URL || 'https://api.openai.com/v1' }}
          OPENAI_MODEL: ${{ vars.QWEN_E2E_MODEL || 'gpt-4o-mini' }}
          EXPLORE_MODEL: ${{ vars.QWEN_E2E_MODEL || 'gpt-4o-mini' }}
        run: bash scripts/explore-hooks.sh qwen

      - name: Probe crush
        continue-on-error: true
        env:
          EXPLORE_MODEL: ${{ vars.CRUSH_E2E_MODEL }}
        run: bash scripts/explore-hooks.sh crush

      - name: Probe copilot
        continue-on-error: true
        env:
          EXPLORE_MODEL: ${{ vars.COPILOT_E2E_MODEL }}
        run: bash scripts/explore-hooks.sh copilot
