code-generate.yml

# Module 4 — Code Generate (M4 of pipeline-redesign-v3)
#
# Purpose: single-responsibility code generation. Today this logic is the
# `develop` job in `develop.yml` (lines 112-220). M4 extracts it so the
# retry wrapper (M2) and engine-dispatch (M1) can compose here cleanly.
#
# STATUS: M4 = ADDITIVE ONLY. This workflow has NO automated trigger in M4.
# It can only run via workflow_dispatch (manual smoke test). M6 will wire
# the real trigger (workflow_run: completed on develop-gate.yml).
# The existing `develop.yml` remains authoritative until M6.
#
# RESPONSIBILITIES (single):
#   - Create head branch off base (never main — S3 guard)
#   - Invoke develop composite action (Claude writes code + commits)
#   - Detect no-op (issue #57): pre-sha == post-sha means Claude made no
#     new commit → escalate to stage:failed + audit comment, skip M6 artifact
#   - Emit branch-name + commit-sha for the next workflow (pr-lifecycle)
#
# OUTPUTS:
#   - branch-name, commit-sha, summary
#   - (no-op path: stage:failed label + audit comment on the issue)
#
# SECURITY (S1-S7 preserved):
#   - permissions: contents:write (branch + commit only — S3: never on main)
#   - S3 enforced: refuse if base-branch is main/master; claude --disallowedTools
#     blocks `git push --force*` and `git checkout main*` wholesale
#   - S5 preserved: no --dangerously-skip-permissions
#
# Manual smoke test (requires develop-gate outputs as inputs):
#   gh workflow run code-generate.yml \
#     -f issue-number=NN \
#     -f head-branch=claude/issue-NN-slug \
#     -f base-branch=dev \
#     -f issue-language=en

name: code-generate

on:
  workflow_dispatch:
    inputs:
      issue-number:
        description: "Issue number"
        required: true
        type: string
      head-branch:
        description: "Head branch to commit onto (from develop-gate)"
        required: true
        type: string
      base-branch:
        description: "Base branch to develop from (must NOT be main/master)"
        required: true
        type: string
      issue-language:
        description: "Detected dominant language of the issue body (zh|en|...)"
        required: false
        type: string
        default: "en"
      prior-test-report:
        description: "Prior Module 6 test report (retry path). Empty = first attempt."
        required: false
        type: string
        default: ""
  workflow_run:
    workflows: [develop-gate]
    types: [completed]
  issues:
    types: [labeled]

permissions:
  contents: write
  issues: write
  actions: read

concurrency:
  group: code-generate-run-${{ github.event.workflow_run.id || github.event.issue.number || github.run_id }}
  cancel-in-progress: false

jobs:
  develop:
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') ||
      (github.event_name == 'issues' && github.event.action == 'labeled' && (startsWith(github.event.label.name, 'test:retry-') || startsWith(github.event.label.name, 'review:retry-') || startsWith(github.event.label.name, 'verify:retry-')))
    permissions:
      contents: write
      issues: write
      actions: read
    env:
      # PR #138 root cause: claude-code-action@v1 reads env.ANTHROPIC_BASE_URL
      # at the JOB level. Step-level env on composite actions does NOT
      # propagate to the SDK call. Without this, SDK defaults to
      # api.anthropic.com and GLM passthrough key gets 401.
      ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL }}
    timeout-minutes: ${{ fromJSON(vars.DEVELOP_TIME_BUDGET_MIN || '60') }}
    outputs:
      branch-name: ${{ steps.branch.outputs.branch-name }}
      commit-sha: ${{ steps.develop.outputs.commit-sha }}
      summary: ${{ steps.develop.outputs.summary }}
      issue-number: ${{ steps.resolve.outputs.issue-number }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
          token: ${{ secrets.CLAUDE_DEV_PAT }}

      - name: Resolve inputs (dispatch, workflow_run artifact, or issues.labeled retry)
        id: resolve
        env:
          EVENT_NAME: ${{ github.event_name }}
          DISPATCH_ISSUE: ${{ inputs.issue-number }}
          DISPATCH_HEAD: ${{ inputs.head-branch }}
          DISPATCH_BASE: ${{ inputs.base-branch }}
          DISPATCH_LANG: ${{ inputs.issue-language }}
          DISPATCH_PRIOR: ${{ inputs.prior-test-report }}
          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
          ISSUE_NUMBER_FROM_EVENT: ${{ github.event.issue.number }}
          LABEL_NAME: ${{ github.event.label.name }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          retry_attempt="0"
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            issue_number="$DISPATCH_ISSUE"
            head_branch="$DISPATCH_HEAD"
            base_branch="$DISPATCH_BASE"
            issue_language="${DISPATCH_LANG:-en}"
            prior_test_report="${DISPATCH_PRIOR:-}"
          elif [ "$EVENT_NAME" = "issues" ]; then
            # M1+M2 restore (issue #118): test:retry-N label → re-run Module 4
            # with prior test report.
            # PR #122 extension: review:retry-N label → re-run Module 4 with
            # prior review feedback (Claude flagged changes-requested).
            # PR #124 extension: verify:retry-N label → re-run Module 4 with
            # prior verify report (Module 5 failed).
            if [ -z "$LABEL_NAME" ] || ! printf '%s' "$LABEL_NAME" | grep -qE '^(test|review|verify):retry-[0-9]+$'; then
              echo "::warning::issues.labeled event with non-retry label '$LABEL_NAME' — skipping."
              exit 0
            fi
            if [ -z "$ISSUE_NUMBER_FROM_EVENT" ]; then
              echo "::error::issues.labeled event missing issue.number"
              exit 1
            fi
            issue_number="$ISSUE_NUMBER_FROM_EVENT"
            retry_kind="test"
            if printf '%s' "$LABEL_NAME" | grep -q '^review:retry-'; then
              retry_kind="review"
            elif printf '%s' "$LABEL_NAME" | grep -q '^verify:retry-'; then
              retry_kind="verify"
            fi
            retry_attempt="${LABEL_NAME#*:retry-}"
            # Locate the existing PR for this issue (head: claude/issue-N-*).
            pr_json=$(gh pr list --repo "$GITHUB_REPOSITORY" --state open \
              --json headRefName,baseRefName,number --limit 100 \
              --jq ".[] | select(.headRefName | startswith(\"claude/issue-${issue_number}-\"))" 2>/dev/null || echo "")
            if [ -z "$pr_json" ]; then
              echo "::error::No open PR found for issue #$issue_number with head claude/issue-${issue_number}-*. Retry cannot proceed."
              exit 1
            fi
            head_branch=$(printf '%s' "$pr_json" | jq -r '.headRefName')
            base_branch=$(printf '%s' "$pr_json" | jq -r '.baseRefName // "dev"')
            pr_number=$(printf '%s' "$pr_json" | jq -r '.number')
            if [ "$base_branch" = "null" ] || [ -z "$base_branch" ]; then base_branch="dev"; fi
            if [ "$base_branch" = "main" ] || [ "$base_branch" = "master" ]; then
              echo "::error::Resolved PR base branch is $base_branch — refusing retry (S3)."
              exit 1
            fi
            # Issue language: default to en (we do not re-analyse body on retry path).
            issue_language="en"
            if [ "$retry_kind" = "review" ]; then
              # PR #122: pull Claude's full review comment on the PR as
              # prior-review-feedback. Search PR comments for the AI review
              # block (posted by .github/actions/review/action.yml).
              prior_test_report=$(gh pr view "$pr_number" --repo "$GITHUB_REPOSITORY" \
                --json comments --jq '
                  [.comments[]
                    | select(.body | test("AI Initial Review|REVIEW_VERDICT|Review retry"))
                  ] | last | .body // ""
                ' 2>/dev/null || echo "")
            elif [ "$retry_kind" = "verify" ]; then
              # PR #124: pull prior Module 5 verify report from the most recent
              # "Verify retry" comment on the issue (posted by verify.yml).
              prior_test_report=$(gh issue view "$issue_number" --repo "$GITHUB_REPOSITORY" \
                --json comments --jq '
                  [.comments[]
                    | select(.body | test("Verify retry|Verify retries exhausted"))
                  ] | last | .body // ""
                ' 2>/dev/null || echo "")
            else
              # M1+M2 original: pull prior Module 6 test report from the most
              # recent "Auto-retry" or "Test failed" comment on the issue.
              prior_test_report=$(gh issue view "$issue_number" --repo "$GITHUB_REPOSITORY" \
                --json comments --jq '
                  [.comments[]
                    | select(.body | test("Auto-retry|❌ \\*\\*Test failed"))
                  ] | last | .body // ""
                ' 2>/dev/null || echo "")
            fi
          else
            if [ -z "$WORKFLOW_RUN_ID" ]; then
              echo "::error::workflow_run event missing workflow_run.id"
              exit 1
            fi
            mkdir -p ./.github/artifacts
            gh run download "$WORKFLOW_RUN_ID" \
              --repo "$GITHUB_REPOSITORY" \
              --name develop-gate-outputs \
              --dir ./.github/artifacts || {
                echo "::warning::develop-gate-outputs artifact not found in upstream run $WORKFLOW_RUN_ID — gate did not pass. Skipping."
                exit 0
              }
            issue_number=$(jq -r '.issue_number // ""' ./.github/artifacts/develop-gate-outputs.json)
            head_branch=$(jq -r '.head_branch // ""' ./.github/artifacts/develop-gate-outputs.json)
            base_branch=$(jq -r '.base_branch // ""' ./.github/artifacts/develop-gate-outputs.json)
            issue_language=$(jq -r '.issue_language // "en"' ./.github/artifacts/develop-gate-outputs.json)
            prior_test_report=""
            if [ -z "$issue_number" ] || [ -z "$head_branch" ] || [ -z "$base_branch" ]; then
              echo "::warning::Incomplete develop-gate-outputs artifact; skipping."
              exit 0
            fi
          fi
          # Issue #151: the prior verify/test/review report is a full markdown
          # comment containing "| Field | Value |" table rows and newlines.
          # Emitting it as a bare `prior-test-report=$value` spills each table
          # row as a separate line and GitHub's file-command parser rejects it
          # ("Invalid format '| Field | Value |'", run 29264389854), killing the
          # whole verify/test/review retry chain at this step. The multi-line
          # value MUST use the heredoc syntax; the delimiter is made unique
          # (PRIOR_TEST_REPORT_EOF, not a bare EOF) so a report that ever
          # contains a literal "EOF" line cannot terminate the heredoc early.
          {
            echo "issue-number=$issue_number"
            echo "head-branch=$head_branch"
            echo "base-branch=$base_branch"
            echo "issue-language=$issue_language"
            echo "retry-attempt=$retry_attempt"
            echo "prior-test-report<<PRIOR_TEST_REPORT_EOF"
            printf '%s\n' "$prior_test_report"
            echo "PRIOR_TEST_REPORT_EOF"
          } >> "$GITHUB_OUTPUT"
          # Defense-in-depth (issue #151): re-parse $GITHUB_OUTPUT and fail
          # loudly HERE if any emitted line is malformed, instead of letting the
          # retry die three jobs later on a cryptic parser error. The validator
          # is exercised by .github/actions/code-generate/test/write-outputs.test.sh.
          source ./.github/actions/code-generate/lib/write-outputs.sh
          code_generate_validate_github_output

      - name: Create head branch (off base, never main)
        id: branch
        if: steps.resolve.outputs.issue-number != ''
        env:
          BASE: ${{ steps.resolve.outputs.base-branch }}
          HEAD: ${{ steps.resolve.outputs.head-branch }}
        run: |
          set -euo pipefail
          if [ "$BASE" = "main" ] || [ "$BASE" = "master" ]; then
            echo "::error::Refusing to develop against $BASE (PRD §7 S3)"
            exit 1
          fi
          # Retry-awareness (issue #51): if remote head exists, check out tip.
          if git ls-remote --exit-code --heads origin "$HEAD" >/dev/null 2>&1; then
            echo "Remote branch $HEAD exists — checking out tip (likely retry scenario)"
            git fetch origin "$HEAD" --depth=1
            git checkout -B "$HEAD" "origin/$HEAD"
          elif git ls-remote --exit-code --heads origin "$BASE" >/dev/null 2>&1; then
            git checkout -B "$HEAD" "origin/$BASE"
          else
            default=$(git remote show origin | awk '/HEAD branch/ {print $NF}')
            if [ "$default" = "main" ] || [ "$default" = "master" ]; then
              echo "::error::Repo default branch is $default and DEV_BASE_BRANCH ($BASE) does not exist."
              exit 1
            fi
            git checkout -B "$HEAD" "origin/$default"
          fi
          echo "branch-name=$HEAD" >> "$GITHUB_OUTPUT"

      - name: Write .verify-state.json (M2 — retry path only)
        id: state
        if: steps.resolve.outputs.issue-number != '' && steps.resolve.outputs.retry-attempt != '0'
        env:
          ATTEMPT: ${{ steps.resolve.outputs.retry-attempt }}
          MAX: ${{ vars.TEST_RETRY_MAX || '3' }}
          HEAD_BRANCH: ${{ steps.resolve.outputs.head-branch }}
          CLAUDE_DEV_PAT: ${{ secrets.CLAUDE_DEV_PAT }}
          LABEL_NAME: ${{ github.event.label.name }}
        shell: bash
        run: |
          set -euo pipefail
          # M2 fix: previously .verify-state.json was read but never written,
          # so attempt counter was stuck at 1. Now code-generate writes it on
          # every retry path so the next verify.yml run reports the right count.
          # PR #122 extension: label prefix is dynamic (test:retry-N or review:retry-N).
          next_attempt=$((ATTEMPT + 1))
          ts=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          mkdir -p .github
          jq -n \
            --argjson attempt "$next_attempt" \
            --argjson max "$MAX" \
            --arg ts "$ts" \
            --arg label "${LABEL_NAME:-test:retry-$ATTEMPT}" \
            '{attempt: $attempt, max: $max, last_failed_at: $ts, label: $label}' \
            > .github/.verify-state.json
          cat .github/.verify-state.json
          # Configure git + embed PAT in extraheader (actions/checkout runs with
          # persist-credentials: false; same auth pattern as pr-lifecycle.yml).
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --local --unset http.https://github.com/.extraheader 2>/dev/null || true
          # PR #147: `base64 | tr -d '\n'` — default base64 wraps at 76 cols,
          # fine-grained PAT produces 2-line output that breaks the header.
          git config --local http.https://github.com/.extraheader "Authorization: basic $(printf 'x-access-token:%s' "$CLAUDE_DEV_PAT" | base64 | tr -d '\n')"
          git add .github/.verify-state.json
          git commit -m "chore(state): record verify attempt=$next_attempt (M2 retry)"
          git push origin "HEAD:$HEAD_BRANCH"
          echo "wrote-attempt=$next_attempt" >> "$GITHUB_OUTPUT"

      - name: Capture pre-develop HEAD SHA (issue #57 no-op detection)
        id: pre-sha
        if: steps.resolve.outputs.issue-number != ''
        shell: bash
        run: |
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: "Verify LLM_API_KEY secret exists (S4: never print value)"
        shell: bash
        run: |
          if [ -z "${{ secrets.LLM_API_KEY }}" ]; then
            echo "::error::LLM_API_KEY secret is not set or is empty."
            exit 1
          fi
          echo "::notice::LLM_API_KEY secret is configured (value not printed per S4)."

      - name: Run develop composite
        id: develop
        if: steps.resolve.outputs.issue-number != ''
        uses: ./.github/actions/develop
        with:
          issue-number: ${{ steps.resolve.outputs.issue-number }}
          base-branch: ${{ steps.resolve.outputs.base-branch }}
          head-branch: ${{ steps.resolve.outputs.head-branch }}
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          api-key: ${{ secrets.LLM_API_KEY }}
          api-key-backup: ${{ secrets.LLM_API_KEY_BACKUP }}
          anthropic-base-url: ${{ vars.ANTHROPIC_BASE_URL }}
          model: ${{ vars.DEVELOP_MODEL }}
          max-turns: ${{ vars.DEVELOP_MAX_TURNS || '20' }}
          context-budget-paths: ${{ vars.DEVELOP_CONTEXT_PATHS || '' }}
          issue-language: ${{ steps.resolve.outputs.issue-language }}
          prior-test-report: ${{ steps.resolve.outputs.prior-test-report }}

      - name: Detect no-op (issue #57 — retry produced no new commits)
        id: noop
        if: steps.resolve.outputs.issue-number != ''
        env:
          PRE_SHA: ${{ steps.pre-sha.outputs.sha }}
          POST_SHA: ${{ steps.develop.outputs.commit-sha }}
        shell: bash
        run: |
          set -u
          # Defensive: if the develop composite did not emit commit-sha (e.g.,
          # internal failure that did not trip set -e), treat as non-noop and
          # let the M6 artifact condition (commit-sha != '') + pr-lifecycle's
          # missing-artifact guard handle the skip. The on-failure job owns
          # the stage:failed apply for actual composite failures.
          if [ -n "$PRE_SHA" ] && [ -n "$POST_SHA" ] && [ "$PRE_SHA" = "$POST_SHA" ]; then
            echo "noop=true" >> "$GITHUB_OUTPUT"
            echo "::notice::No-op detected (pre-sha == post-sha == ${PRE_SHA:0:12}). Escalating to stage:failed."
          else
            echo "noop=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Escalate no-op to stage:failed (issue #57)
        if: steps.noop.outputs.noop == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NUMBER: ${{ steps.resolve.outputs.issue-number }}
          PRIOR: ${{ steps.resolve.outputs.prior-test-report }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        shell: bash
        run: |
          set -eu
          gh issue edit "$NUMBER" --repo "$GITHUB_REPOSITORY" --add-label "stage:failed" || true
          if [ -n "$PRIOR" ]; then
            gh issue comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body "$(cat <<EOF
          ⚠️ **Module 4 retry produced no new commits** (issue #57).

          Claude analysed the prior test report and concluded the existing branch tip already addresses it — \`pre-sha == post-sha\`, so no commit was made. Downstream modules (pr-lifecycle → verify) will NOT fire because there is no new push event for \`pull_request.synchronize\` to deliver.

          **Maintainer action required:**
          - Inspect the existing PR — the fix code may already be correct and the prior test failure spurious
          - OR re-dispatch \`code-generate.yml\` with stronger guidance in the issue
          - OR close as not-reproducible

          [Workflow run]($RUN_URL)
          EOF
          )"
          else
            gh issue comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body "$(cat <<EOF
          ⚠️ **Module 4 produced no new commits** (issue #57).

          Claude analysed the issue and concluded no code change is required — \`pre-sha == post-sha\`, so no commit was made. Downstream modules (pr-lifecycle → verify) will NOT fire.

          **Maintainer action required:**
          - Re-triage the issue — the acceptance criteria may already be satisfied by existing code
          - OR refine the issue body and re-dispatch \`code-generate.yml\`
          - OR close as not-actionable

          [Workflow run]($RUN_URL)
          EOF
          )"
          fi

      - name: Push head branch with Claude's commits (CLAUDE_DEV_PAT)
        # v2 develop architecture fix: develop composite denies `git push` via
        # settings.permissions.deny, so Claude's local commits die with the
        # runner unless we push them here. Without this, pr-lifecycle's
        # fresh checkout cannot resolve HEAD → "src refspec ... does not match".
        # Retry path already pushed .verify-state.json (line 296) but NOT the
        # develop composite's code commits — so this step is required on BOTH
        # first attempt and retry.
        if: steps.resolve.outputs.issue-number != '' && steps.develop.outputs.commit-sha != '' && steps.noop.outputs.noop != 'true'
        env:
          CLAUDE_DEV_PAT: ${{ secrets.CLAUDE_DEV_PAT }}
          HEAD_BRANCH: ${{ steps.resolve.outputs.head-branch }}
        run: |
          set -euo pipefail
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git config --local --unset http.https://github.com/.extraheader 2>/dev/null || true
          # PR #147 root cause: default `base64` wraps at 76 cols. Fine-grained
          # PAT (~90+ chars) → 2-line base64 → malformed Authorization header →
          # libcurl rejects with "Failed sending HTTP request" in ~80ms (not a
          # real network timeout). `tr -d '\n'` flattens it.
          git config --local http.https://github.com/.extraheader "Authorization: basic $(printf 'x-access-token:%s' "$CLAUDE_DEV_PAT" | base64 | tr -d '\n')"
          # No --force: S3/S5 forbid force-push. Fast-forward only; if the
          # remote tip diverged (concurrent develop run), fail loudly so the
          # concurrency group serializes the next attempt.
          git push origin "HEAD:$HEAD_BRANCH"

      - name: M6 — emit code-generate-outputs artifact
        if: steps.resolve.outputs.issue-number != '' && steps.develop.outputs.commit-sha != '' && steps.noop.outputs.noop != 'true'
        env:
          ISSUE_NUMBER: ${{ steps.resolve.outputs.issue-number }}
          BRANCH_NAME: ${{ steps.branch.outputs.branch-name }}
          COMMIT_SHA: ${{ steps.develop.outputs.commit-sha }}
          SUMMARY: ${{ steps.develop.outputs.summary }}
          BASE_BRANCH: ${{ steps.resolve.outputs.base-branch }}
        run: |
          set -eu
          mkdir -p ./.github/artifacts
          jq -n \
            --arg issue_number "$ISSUE_NUMBER" \
            --arg branch_name "$BRANCH_NAME" \
            --arg commit_sha "$COMMIT_SHA" \
            --arg summary "$SUMMARY" \
            --arg base_branch "$BASE_BRANCH" \
            '{issue_number: $issue_number, branch_name: $branch_name, commit_sha: $commit_sha, summary: $summary, base_branch: $base_branch}' \
            > ./.github/artifacts/code-generate-outputs.json
          cat ./.github/artifacts/code-generate-outputs.json

      - uses: actions/upload-artifact@v7
        if: steps.resolve.outputs.issue-number != '' && steps.develop.outputs.commit-sha != '' && steps.noop.outputs.noop != 'true'
        with:
          name: code-generate-outputs
          path: ./.github/artifacts/code-generate-outputs.json
          retention-days: 1

  on-failure:
    needs: develop
    if: ${{ always() && needs.develop.result == 'failure' }}
    runs-on: ubuntu-latest
    permissions:
      issues: write
      actions: read
    steps:
      - name: Resolve issue number for failure comment
        id: resolve
        env:
          EVENT_NAME: ${{ github.event_name }}
          DISPATCH_ISSUE: ${{ inputs.issue-number }}
          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
          ISSUE_NUMBER_FROM_EVENT: ${{ github.event.issue.number }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -u
          number=""
          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
            number="$DISPATCH_ISSUE"
          elif [ "$EVENT_NAME" = "issues" ]; then
            # Retry path (M1+M2 restore, issue #118): failure during test:retry-N
            # re-run. Without this branch the failure is silent — issue stays in
            # test:retry-N with no stage:failed and no audit comment.
            number="$ISSUE_NUMBER_FROM_EVENT"
          elif [ -n "$WORKFLOW_RUN_ID" ]; then
            mkdir -p ./.github/artifacts
            gh run download "$WORKFLOW_RUN_ID" --repo "$GITHUB_REPOSITORY" \
              --name develop-gate-outputs --dir ./.github/artifacts 2>/dev/null || true
            if [ -f ./.github/artifacts/develop-gate-outputs.json ]; then
              number=$(jq -r '.issue_number // ""' ./.github/artifacts/develop-gate-outputs.json)
            fi
          fi
          echo "number=$number" >> "$GITHUB_OUTPUT"

      - name: Mark stage:failed
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NUMBER: ${{ steps.resolve.outputs.number }}
        run: |
          if [ -z "$NUMBER" ]; then
            echo "::warning::No issue number on this event."
            exit 0
          fi
          gh issue edit "$NUMBER" --repo "$GITHUB_REPOSITORY" --add-label "stage:failed" || true
          gh issue comment "$NUMBER" --repo "$GITHUB_REPOSITORY" \
            --body "⚠️ code-generate failed. See [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details. A maintainer will triage manually." || true