rollback.yml

name: Rollback

on:
  workflow_dispatch:
    inputs:
      reason:
        description: 'Reason for rollback'
        required: true
        type: string
      target_commit:
        description: 'Target commit SHA to rollback to (optional - uses parent commit if empty)'
        required: false
        type: string

permissions:
  contents: write
  pull-requests: write

jobs:
  rollback:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Configure git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Capture current state
        id: current
        run: |
          # Save current operation count
          CURRENT_OPS=$(ls src/core/operations/*.mjs 2>/dev/null | wc -l)
          echo "current_ops=$CURRENT_OPS" >> $GITHUB_OUTPUT

          # Check ref-proj state
          if [ -d "ref-proj/CyberChef/.git" ]; then
            cd ref-proj/CyberChef
            REF_SHA=$(git rev-parse HEAD)
            REF_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "unknown")
            echo "ref_sha=$REF_SHA" >> $GITHUB_OUTPUT
            echo "ref_tag=$REF_TAG" >> $GITHUB_OUTPUT
            cd ../..
          else
            echo "ref_sha=none" >> $GITHUB_OUTPUT
            echo "ref_tag=none" >> $GITHUB_OUTPUT
          fi

      - name: Determine rollback target
        id: target
        env:
          TARGET_COMMIT: ${{ inputs.target_commit }}
        run: |
          if [ -n "$TARGET_COMMIT" ]; then
            COMMIT="$TARGET_COMMIT"
            echo "Using specified commit: $COMMIT"
          else
            # Use parent of current HEAD
            COMMIT=$(git rev-parse HEAD^)
            echo "Using parent commit: $COMMIT"
          fi

          echo "commit=$COMMIT" >> $GITHUB_OUTPUT

          # Get commit info for reference (sanitized)
          SHORT_SHA=$(echo "$COMMIT" | cut -c1-7)
          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT

          # Get commit message for context
          COMMIT_MSG=$(git log --format=%s -n 1 "$COMMIT" | head -c 100)
          echo "commit_msg=$COMMIT_MSG" >> $GITHUB_OUTPUT

      - name: Create rollback branch
        env:
          SHORT_SHA: ${{ steps.target.outputs.short_sha }}
        run: |
          BRANCH_NAME="rollback-to-${SHORT_SHA}"
          git checkout -b "$BRANCH_NAME"
          echo "branch=$BRANCH_NAME" >> $GITHUB_ENV

      - name: Perform rollback
        id: rollback
        env:
          COMMIT: ${{ steps.target.outputs.commit }}
        run: |
          # Save current SHA for reference
          CURRENT_SHA=$(git rev-parse HEAD)
          echo "current_sha=$CURRENT_SHA" >> $GITHUB_OUTPUT

          # Reset to target commit
          git reset --hard "$COMMIT"

          # Verify we're at the right commit
          ACTUAL_SHA=$(git rev-parse HEAD)
          if [ "$ACTUAL_SHA" != "$COMMIT" ]; then
            echo "Rollback failed - commit mismatch"
            exit 1
          fi

          echo "Rollback successful"
          echo "target_sha=$ACTUAL_SHA" >> $GITHUB_OUTPUT

      - name: Install dependencies
        run: |
          npm install

      - name: Apply Node 22 compatibility patches
        run: |
          if [ -f "node_modules/avsc/lib/types.js" ]; then
            sed -i 's/new SlowBuffer/Buffer.alloc/g' node_modules/avsc/lib/types.js
          fi

          if [ -f "node_modules/buffer-equal-constant-time/index.js" ]; then
            sed -i 's/SlowBuffer/Buffer/g' node_modules/buffer-equal-constant-time/index.js
          fi

      - name: Regenerate OperationConfig
        run: |
          npx grunt configTests
          echo "OperationConfig.json regenerated"

      - name: Run tests
        id: tests
        run: |
          # Run existing tests
          if npm test; then
            echo "passed=true" >> $GITHUB_OUTPUT
          else
            echo "passed=false" >> $GITHUB_OUTPUT
            echo "WARNING: Tests failed after rollback"
          fi

          # Run MCP validation tests
          if npm run test:mcp; then
            echo "mcp_passed=true" >> $GITHUB_OUTPUT
          else
            echo "mcp_passed=false" >> $GITHUB_OUTPUT
            echo "WARNING: MCP tests failed after rollback"
          fi

      - name: Update baseline
        if: steps.tests.outputs.passed == 'true'
        run: |
          node --input-type=module << 'EOF'
          import OperationConfig from './src/core/config/OperationConfig.json' with { type: 'json' };
          import { writeFileSync } from 'fs';

          function sanitizeToolName(name) {
              if (!name) return null;
              const sanitized = 'cyberchef_' + name.toLowerCase()
                  .replace(/[^a-z0-9_]/g, '_')
                  .replace(/_+/g, '_')
                  .replace(/^_|_$/g, '');
              if (sanitized === 'cyberchef_') return null;
              return sanitized;
          }

          const baseline = {
              version: require('./package.json').mcpVersion,
              timestamp: new Date().toISOString(),
              tool_count: Object.keys(OperationConfig).length + 2,
              tools: {
                  cyberchef_bake: { type: 'meta', description: 'Execute a CyberChef recipe' },
                  cyberchef_search: { type: 'meta', description: 'Search for available CyberChef operations' }
              }
          };

          Object.keys(OperationConfig).forEach(opName => {
              const op = OperationConfig[opName];
              const toolName = sanitizeToolName(opName);
              if (toolName) {
                  baseline.tools[toolName] = {
                      operation: opName,
                      description: op.description || '',
                      args_count: op.args ? op.args.length : 0,
                      arg_types: op.args ? op.args.map(a => a.type) : []
                  };
              }
          });

          writeFileSync('./tests/mcp/baseline.json', JSON.stringify(baseline, null, 2), 'utf-8');
          console.log('Baseline updated');
          EOF

      - name: Commit rollback
        env:
          SHORT_SHA: ${{ steps.target.outputs.short_sha }}
        run: |
          git add .
          COMMIT_MSG="revert: rollback to ${SHORT_SHA}

          Rolled back to commit ${SHORT_SHA}
          * Regenerated OperationConfig.json
          * Updated baseline.json
          * Applied Node 22 compatibility patches

          Generated with rollback workflow"
          git commit -m "$COMMIT_MSG" || echo "No changes to commit"

      - name: Push rollback branch
        env:
          BRANCH: ${{ env.branch }}
        run: |
          git push origin "$BRANCH" --force

      - name: Capture rollback state
        id: rollback_state
        run: |
          # Count operations after rollback
          ROLLBACK_OPS=$(ls src/core/operations/*.mjs 2>/dev/null | wc -l)
          echo "rollback_ops=$ROLLBACK_OPS" >> $GITHUB_OUTPUT

          # Check if ref-proj exists
          if [ -d "ref-proj/CyberChef/.git" ]; then
            cd ref-proj/CyberChef
            ROLLBACK_REF_SHA=$(git rev-parse HEAD)
            ROLLBACK_REF_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "unknown")
            echo "rollback_ref_sha=$ROLLBACK_REF_SHA" >> $GITHUB_OUTPUT
            echo "rollback_ref_tag=$ROLLBACK_REF_TAG" >> $GITHUB_OUTPUT
            cd ../..
          else
            echo "rollback_ref_sha=none" >> $GITHUB_OUTPUT
            echo "rollback_ref_tag=none" >> $GITHUB_OUTPUT
          fi

      - name: Create Pull Request
        env:
          GH_TOKEN: ${{ github.token }}
          REASON: ${{ inputs.reason }}
          SHORT_SHA: ${{ steps.target.outputs.short_sha }}
          COMMIT_MSG: ${{ steps.target.outputs.commit_msg }}
          TEST_PASSED: ${{ steps.tests.outputs.passed }}
          MCP_PASSED: ${{ steps.tests.outputs.mcp_passed }}
          CURRENT_OPS: ${{ steps.current.outputs.current_ops }}
          ROLLBACK_OPS: ${{ steps.rollback_state.outputs.rollback_ops }}
          CURRENT_REF_SHA: ${{ steps.current.outputs.ref_sha }}
          CURRENT_REF_TAG: ${{ steps.current.outputs.ref_tag }}
          ROLLBACK_REF_SHA: ${{ steps.rollback_state.outputs.rollback_ref_sha }}
          ROLLBACK_REF_TAG: ${{ steps.rollback_state.outputs.rollback_ref_tag }}
        run: |
          OPERATION_COUNT=$(node -p "Object.keys(require('./src/core/config/OperationConfig.json')).length")

          # Sanitize reason for safe usage (remove special chars)
          SAFE_REASON=$(echo "$REASON" | tr -cd '[:alnum:][:space:]._-')

          # Test status
          if [ "$TEST_PASSED" == "true" ] && [ "$MCP_PASSED" == "true" ]; then
            TEST_STATUS="✅ All tests passed"
          elif [ "$TEST_PASSED" == "true" ]; then
            TEST_STATUS="⚠️ Core tests passed, MCP tests failed"
          elif [ "$MCP_PASSED" == "true" ]; then
            TEST_STATUS="⚠️ MCP tests passed, core tests failed"
          else
            TEST_STATUS="🚨 **CRITICAL:** Both test suites failed"
          fi

          # Operation change
          OP_CHANGE=$((ROLLBACK_OPS - CURRENT_OPS))
          if [ $OP_CHANGE -gt 0 ]; then
            OP_STATUS="Gained $OP_CHANGE operations"
          elif [ $OP_CHANGE -lt 0 ]; then
            OP_STATUS="Lost ${OP_CHANGE#-} operations"
          else
            OP_STATUS="No operation count change"
          fi

          PR_BODY="## Emergency Rollback

          **Reason:** $SAFE_REASON

          ### Rollback Details

          * **Target Commit:** \`$SHORT_SHA\`
          * **Target Message:** $COMMIT_MSG
          * **Operations:** $OPERATION_COUNT ($OP_STATUS)
          * **Test Status:** $TEST_STATUS

          ### State Comparison

          | Metric | Before | After |
          |--------|--------|-------|
          | Operations | $CURRENT_OPS | $ROLLBACK_OPS |
          | ref-proj tag | $CURRENT_REF_TAG | $ROLLBACK_REF_TAG |
          | ref-proj SHA | ${CURRENT_REF_SHA:0:7} | ${ROLLBACK_REF_SHA:0:7} |

          ### Changes

          * Rolled back codebase to commit \`$SHORT_SHA\`
          * Regenerated \`OperationConfig.json\`
          * Updated \`baseline.json\`
          * Applied Node 22 compatibility patches
          * ref-proj/CyberChef/ state: $ROLLBACK_REF_TAG

          ### Verification Required

          - [ ] Verify rollback addresses the issue
          - [ ] Review test results
          - [ ] Test critical functionality manually
          - [ ] Verify ref-proj/ state is correct
          - [ ] Update CHANGELOG.md
          - [ ] Communicate rollback to users if needed

          ### Next Steps

          1. Review and merge this PR if rollback is successful
          2. Investigate root cause of the issue
          3. Determine if ref-proj/CyberChef/ needs rollback too
          4. Plan proper fix before re-attempting upgrade

          ### ref-proj/CyberChef State

          The ref-proj/CyberChef directory was **not automatically rolled back**.
          Current state: $ROLLBACK_REF_TAG (${ROLLBACK_REF_SHA:0:7})

          If the issue was caused by upstream changes, you may need to:
          \`\`\`bash
          cd ref-proj/CyberChef
          git checkout <previous-tag>
          cd ../..
          git add ref-proj/CyberChef
          git commit -m \"chore: rollback ref-proj to match main codebase\"
          \`\`\`

          ---
          Generated automatically by rollback workflow"

          gh pr create \
            --title "revert: rollback to $SHORT_SHA - $COMMIT_MSG" \
            --label "rollback,urgent" \
            --body "$PR_BODY" || echo "PR already exists"

      - name: Summary
        if: always()
        env:
          SHORT_SHA: ${{ steps.target.outputs.short_sha }}
          COMMIT_MSG: ${{ steps.target.outputs.commit_msg }}
          BRANCH: ${{ env.branch }}
          TEST_PASSED: ${{ steps.tests.outputs.passed }}
          MCP_PASSED: ${{ steps.tests.outputs.mcp_passed }}
          CURRENT_OPS: ${{ steps.current.outputs.current_ops }}
          ROLLBACK_OPS: ${{ steps.rollback_state.outputs.rollback_ops }}
          REF_TAG: ${{ steps.rollback_state.outputs.rollback_ref_tag }}
        run: |
          echo "### Rollback Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- **Target Commit:** \`$SHORT_SHA\`" >> $GITHUB_STEP_SUMMARY
          echo "- **Commit Message:** $COMMIT_MSG" >> $GITHUB_STEP_SUMMARY
          echo "- **Branch:** $BRANCH" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "#### State Changes" >> $GITHUB_STEP_SUMMARY
          echo "- **Operations:** $CURRENT_OPS → $ROLLBACK_OPS" >> $GITHUB_STEP_SUMMARY
          echo "- **ref-proj Tag:** $REF_TAG" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "#### Test Results" >> $GITHUB_STEP_SUMMARY
          echo "- **Core Tests:** $TEST_PASSED" >> $GITHUB_STEP_SUMMARY
          echo "- **MCP Tests:** $MCP_PASSED" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ "$TEST_PASSED" == "true" ] && [ "$MCP_PASSED" == "true" ]; then
            echo "✅ Rollback successful - all tests passed" >> $GITHUB_STEP_SUMMARY
          else
            echo "⚠️ Rollback completed but some tests failed" >> $GITHUB_STEP_SUMMARY
          fi