moltbot/.github/workflows/mantis-discord-status-reactions.yml

name: Mantis Discord Status Reactions

on:
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      baseline_ref:
        description: Ref, tag, or SHA expected to reproduce queued-only behavior
        required: true
        default: 0bf06e953fdda290799fc9fb9244a8f67fdae593
        type: string
      candidate_ref:
        description: Ref, tag, or SHA expected to show queued -> thinking -> done
        required: true
        default: main
        type: string
      pr_number:
        description: Optional bug or fix PR number to receive the QA evidence comment
        required: false
        type: string

permissions:
  contents: write
  issues: write
  pull-requests: write

concurrency:
  group: mantis-discord-status-reactions-${{ github.event.issue.number || inputs.pr_number || inputs.candidate_ref || github.run_id }}-${{ github.run_attempt }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  NODE_VERSION: "24.x"
  PNPM_VERSION: "11.0.8"
  OPENCLAW_BUILD_PRIVATE_QA: "1"
  OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1"

jobs:
  authorize_actor:
    name: Authorize workflow actor
    if: >-
      ${{
        github.event_name == 'workflow_dispatch' ||
        (
          github.event_name == 'issue_comment' &&
          github.event.issue.pull_request &&
          (
            contains(github.event.comment.body, '@Mantis') ||
            contains(github.event.comment.body, '@mantis') ||
            contains(github.event.comment.body, '/mantis')
          )
        )
      }}
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Require maintainer-level repository access
        uses: actions/github-script@v8
        with:
          script: |
            const allowed = new Set(["admin", "maintain", "write"]);
            const { owner, repo } = context.repo;
            const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
              owner,
              repo,
              username: context.actor,
            });
            const permission = data.permission;
            core.info(`Actor ${context.actor} permission: ${permission}`);
            if (!allowed.has(permission)) {
              core.setFailed(
                `Workflow requires write/maintain/admin access. Actor "${context.actor}" has "${permission}".`,
              );
            }

  resolve_request:
    name: Resolve Mantis request
    needs: authorize_actor
    runs-on: blacksmith-8vcpu-ubuntu-2404
    outputs:
      baseline_ref: ${{ steps.resolve.outputs.baseline_ref }}
      candidate_ref: ${{ steps.resolve.outputs.candidate_ref }}
      pr_number: ${{ steps.resolve.outputs.pr_number }}
      request_source: ${{ steps.resolve.outputs.request_source }}
      should_run: ${{ steps.resolve.outputs.should_run }}
    steps:
      - name: Resolve refs and target PR
        id: resolve
        uses: actions/github-script@v8
        with:
          script: |
            const defaultBaseline = "0bf06e953fdda290799fc9fb9244a8f67fdae593";
            const eventName = context.eventName;

            function setOutput(name, value) {
              core.setOutput(name, value ?? "");
              core.info(`${name}=${value ?? ""}`);
            }

            if (eventName === "workflow_dispatch") {
              const inputs = context.payload.inputs ?? {};
              setOutput("should_run", "true");
              setOutput("baseline_ref", inputs.baseline_ref || defaultBaseline);
              setOutput("candidate_ref", inputs.candidate_ref || "main");
              setOutput("pr_number", inputs.pr_number || "");
              setOutput("request_source", "workflow_dispatch");
              return;
            }

            if (eventName !== "issue_comment") {
              core.setFailed(`Unsupported event: ${eventName}`);
              return;
            }

            const issue = context.payload.issue;
            const body = context.payload.comment?.body ?? "";
            if (!issue?.pull_request) {
              core.setFailed("Mantis issue_comment trigger requires a pull request comment.");
              return;
            }

            const normalized = body.toLowerCase();
            const requested =
              (normalized.includes("@mantis") || normalized.includes("/mantis")) &&
              normalized.includes("discord") &&
              normalized.includes("status") &&
              normalized.includes("reaction");
            if (!requested) {
              core.notice("Comment mentioned Mantis but did not request the Discord status-reactions scenario.");
              setOutput("should_run", "false");
              setOutput("baseline_ref", "");
              setOutput("candidate_ref", "");
              setOutput("pr_number", "");
              setOutput("request_source", "unsupported_issue_comment");
              return;
            }

            const { owner, repo } = context.repo;
            const { data: pr } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: issue.number,
            });

            const baselineMatch = body.match(/(?:baseline|base)[\s:=]+([^\s`]+)/i);
            const candidateMatch = body.match(/(?:candidate|head)[\s:=]+([^\s`]+)/i);
            const baseline = baselineMatch?.[1] ?? defaultBaseline;
            const rawCandidate = candidateMatch?.[1];
            const candidate =
              rawCandidate && !["head", "pr", "pr-head"].includes(rawCandidate.toLowerCase())
                ? rawCandidate
                : pr.head.sha;

            setOutput("should_run", "true");
            setOutput("baseline_ref", baseline);
            setOutput("candidate_ref", candidate);
            setOutput("pr_number", String(issue.number));
            setOutput("request_source", "issue_comment");

            await github.rest.reactions.createForIssueComment({
              owner,
              repo,
              comment_id: context.payload.comment.id,
              content: "eyes",
            }).catch((error) => core.warning(`Could not add eyes reaction: ${error.message}`));

  validate_refs:
    name: Validate selected refs
    needs: resolve_request
    if: ${{ needs.resolve_request.outputs.should_run == 'true' }}
    runs-on: blacksmith-8vcpu-ubuntu-2404
    outputs:
      baseline_revision: ${{ steps.validate.outputs.baseline_revision }}
      candidate_revision: ${{ steps.validate.outputs.candidate_revision }}
    steps:
      - name: Checkout harness ref
        uses: actions/checkout@v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Validate refs are trusted
        id: validate
        env:
          GH_TOKEN: ${{ github.token }}
          BASELINE_REF: ${{ needs.resolve_request.outputs.baseline_ref }}
          CANDIDATE_REF: ${{ needs.resolve_request.outputs.candidate_ref }}
        shell: bash
        run: |
          set -euo pipefail

          git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main

          validate_ref() {
            local label="$1"
            local input_ref="$2"
            local revision=""
            local reason=""

            revision="$(git rev-parse "${input_ref}^{commit}")"
            if git merge-base --is-ancestor "$revision" refs/remotes/origin/main; then
              reason="main-ancestor"
            elif git tag --points-at "$revision" | grep -Eq '^v'; then
              reason="release-tag"
            else
              local pr_head_count
              pr_head_count="$(
                gh api \
                  -H "Accept: application/vnd.github+json" \
                  "repos/${GITHUB_REPOSITORY}/commits/${revision}/pulls" \
                  --jq '[.[] | select(.state == "open" and .head.repo.full_name == "'"${GITHUB_REPOSITORY}"'" and .head.sha == "'"${revision}"'")] | length'
              )"
              if [[ "$pr_head_count" != "0" ]]; then
                reason="open-pr-head"
              fi
            fi

            if [[ -z "$reason" ]]; then
              echo "${label} ref '${input_ref}' resolved to ${revision}, which is not trusted for this secret-bearing Mantis run." >&2
              exit 1
            fi

            echo "${label}_revision=${revision}" >> "$GITHUB_OUTPUT"
            {
              echo "${label}: \`${input_ref}\`"
              echo "${label} SHA: \`${revision}\`"
              echo "${label} trust reason: \`${reason}\`"
            } >> "$GITHUB_STEP_SUMMARY"
          }

          validate_ref baseline "$BASELINE_REF"
          validate_ref candidate "$CANDIDATE_REF"

  run_status_reactions:
    name: Run Discord status reaction before/after
    needs: [resolve_request, validate_refs]
    if: ${{ needs.resolve_request.outputs.should_run == 'true' }}
    runs-on: blacksmith-8vcpu-ubuntu-2404
    timeout-minutes: 180
    environment: qa-live-shared
    steps:
      - name: Checkout harness ref
        uses: actions/checkout@v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Setup Node environment
        uses: ./.github/actions/setup-node-env
        with:
          node-version: ${{ env.NODE_VERSION }}
          pnpm-version: ${{ env.PNPM_VERSION }}
          install-bun: "true"

      - name: Build Mantis harness
        run: pnpm build

      - name: Setup Go for Crabbox CLI
        uses: actions/setup-go@v6
        with:
          go-version: "1.26.x"
          cache: false

      - name: Install Crabbox CLI
        shell: bash
        run: |
          set -euo pipefail
          install_dir="${RUNNER_TEMP}/crabbox"
          mkdir -p "$install_dir" "$HOME/.local/bin"
          git clone --depth 1 https://github.com/openclaw/crabbox.git "$install_dir/src"
          go build -C "$install_dir/src" -o "$HOME/.local/bin/crabbox" ./cmd/crabbox
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          "$HOME/.local/bin/crabbox" --version
          "$HOME/.local/bin/crabbox" warmup --help 2>&1 | grep -q -- "-desktop"

      - name: Prepare baseline and candidate worktrees
        shell: bash
        env:
          BASELINE_SHA: ${{ needs.validate_refs.outputs.baseline_revision }}
          CANDIDATE_SHA: ${{ needs.validate_refs.outputs.candidate_revision }}
        run: |
          set -euo pipefail

          worktree_root=".artifacts/qa-e2e/mantis/discord-status-reactions-worktrees"
          mkdir -p "$worktree_root"
          git worktree add --detach "$worktree_root/baseline" "$BASELINE_SHA"
          git worktree add --detach "$worktree_root/candidate" "$CANDIDATE_SHA"

          for lane in baseline candidate; do
            lane_dir="$worktree_root/${lane}"
            echo "Installing ${lane} worktree dependencies"
            pnpm --dir "$lane_dir" install --frozen-lockfile
            echo "Building ${lane} worktree"
            pnpm --dir "$lane_dir" build
          done

      - name: Run baseline and candidate
        id: run_mantis
        shell: bash
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          OPENCLAW_QA_CONVEX_SITE_URL: ${{ secrets.OPENCLAW_QA_CONVEX_SITE_URL }}
          OPENCLAW_QA_CONVEX_SECRET_CI: ${{ secrets.OPENCLAW_QA_CONVEX_SECRET_CI }}
          OPENCLAW_QA_REDACT_PUBLIC_METADATA: "1"
          OPENCLAW_QA_DISCORD_CAPTURE_CONTENT: "1"
          CRABBOX_COORDINATOR: ${{ secrets.CRABBOX_COORDINATOR }}
          CRABBOX_COORDINATOR_TOKEN: ${{ secrets.CRABBOX_COORDINATOR_TOKEN }}
          OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR: ${{ secrets.OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR }}
          OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN: ${{ secrets.OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN }}
          CRABBOX_ACCESS_CLIENT_ID: ${{ secrets.CRABBOX_ACCESS_CLIENT_ID }}
          CRABBOX_ACCESS_CLIENT_SECRET: ${{ secrets.CRABBOX_ACCESS_CLIENT_SECRET }}
        run: |
          set -euo pipefail

          require_var() {
            local key="$1"
            if [[ -z "${!key:-}" ]]; then
              echo "Missing required ${key}." >&2
              exit 1
            fi
          }

          CRABBOX_COORDINATOR="${CRABBOX_COORDINATOR:-${OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR:-}}"
          CRABBOX_COORDINATOR_TOKEN="${CRABBOX_COORDINATOR_TOKEN:-${OPENCLAW_QA_MANTIS_CRABBOX_COORDINATOR_TOKEN:-}}"
          export CRABBOX_COORDINATOR CRABBOX_COORDINATOR_TOKEN

          require_var OPENAI_API_KEY
          require_var OPENCLAW_QA_CONVEX_SITE_URL
          require_var OPENCLAW_QA_CONVEX_SECRET_CI
          require_var CRABBOX_COORDINATOR_TOKEN

          root=".artifacts/qa-e2e/mantis/discord-status-reactions"
          worktree_root=".artifacts/qa-e2e/mantis/discord-status-reactions-worktrees"
          mkdir -p "$root"
          echo "output_dir=${root}" >> "$GITHUB_OUTPUT"

          run_lane() {
            local lane="$1"
            local repo_root="$worktree_root/$lane"
            local output_dir=".artifacts/qa-e2e/mantis/discord-status-reactions/$lane"
            pnpm openclaw qa discord \
              --repo-root "$repo_root" \
              --output-dir "$output_dir" \
              --provider-mode live-frontier \
              --model openai/gpt-5.4 \
              --alt-model openai/gpt-5.4 \
              --fast \
              --credential-source convex \
              --credential-role ci \
              --scenario discord-status-reactions-tool-only \
              --allow-failures
            rm -rf "$root/$lane"
            mkdir -p "$root/$lane"
            cp -a "$repo_root/$output_dir/." "$root/$lane/"
          }

          run_lane baseline
          run_lane candidate

          desktop_lease_id=""
          warmup_output="$(
            crabbox warmup \
              --provider hetzner \
              --desktop \
              --browser \
              --class standard \
              --idle-timeout 30m \
              --ttl 90m
          )"
          printf '%s\n' "$warmup_output" | tee "$root/crabbox-desktop-warmup.log"
          desktop_lease_id="$(printf '%s\n' "$warmup_output" | grep -Eo 'cbx_[a-f0-9]+' | head -n 1 || true)"
          if [[ ! "$desktop_lease_id" =~ ^cbx_[a-f0-9]+$ ]]; then
            echo "Crabbox desktop warmup did not return a lease id." >&2
            exit 1
          fi

          cleanup_desktop_lease() {
            if [[ -n "$desktop_lease_id" ]]; then
              crabbox stop --provider hetzner "$desktop_lease_id" || true
            fi
          }
          trap cleanup_desktop_lease EXIT

          capture_desktop_lane() {
            local lane="$1"
            local html_file="$root/$lane/discord-status-reactions-tool-only-timeline.html"
            local desktop_dir="$root/$lane/desktop-browser"
            if [[ ! -f "$html_file" ]]; then
              echo "Missing desktop source HTML for ${lane}: ${html_file}" >&2
              exit 1
            fi
            local args=(
              openclaw qa mantis desktop-browser-smoke
              --html-file "$html_file"
              --output-dir "$desktop_dir"
              --provider hetzner
              --class standard
              --idle-timeout 30m
              --ttl 90m
              --lease-id "$desktop_lease_id"
            )
            pnpm "${args[@]}"
            cp "$desktop_dir/desktop-browser-smoke.png" "$root/$lane/discord-status-reactions-tool-only-desktop.png"
            cp "$desktop_dir/desktop-browser-smoke.mp4" "$root/$lane/discord-status-reactions-tool-only-desktop.mp4"
          }

          capture_desktop_lane baseline
          capture_desktop_lane candidate

          make_desktop_preview() {
            local lane="$1"
            local input="$root/$lane/discord-status-reactions-tool-only-desktop.mp4"
            local output="$root/$lane/discord-status-reactions-tool-only-desktop-preview.gif"
            local clip="$root/$lane/discord-status-reactions-tool-only-desktop-change.mp4"
            local metadata="$root/$lane/discord-status-reactions-tool-only-desktop-preview.json"
            crabbox media preview \
              --input "$input" \
              --output "$output" \
              --trimmed-video-output "$clip" \
              --json > "$metadata"
          }

          if ! command -v ffmpeg >/dev/null 2>&1 || ! command -v ffprobe >/dev/null 2>&1; then
            sudo apt-get update && sudo apt-get install -y ffmpeg || true
          fi
          if ! make_desktop_preview baseline || ! make_desktop_preview candidate; then
            rm -f "$root/baseline/discord-status-reactions-tool-only-desktop-preview.gif"
            rm -f "$root/candidate/discord-status-reactions-tool-only-desktop-preview.gif"
            rm -f "$root/baseline/discord-status-reactions-tool-only-desktop-change.mp4"
            rm -f "$root/candidate/discord-status-reactions-tool-only-desktop-change.mp4"
            rm -f "$root/baseline/discord-status-reactions-tool-only-desktop-preview.json"
            rm -f "$root/candidate/discord-status-reactions-tool-only-desktop-preview.json"
            echo "::warning::Could not generate motion-trimmed desktop previews; continuing with screenshots and full MP4 links."
          fi

          baseline_status="$(jq -r '.scenarios[0].status' "$root/baseline/discord-qa-summary.json")"
          candidate_status="$(jq -r '.scenarios[0].status' "$root/candidate/discord-qa-summary.json")"

          jq -n \
            --arg baseline_status "$baseline_status" \
            --arg candidate_status "$candidate_status" \
            --arg baseline_sha "${{ needs.validate_refs.outputs.baseline_revision }}" \
            --arg candidate_sha "${{ needs.validate_refs.outputs.candidate_revision }}" \
            '{
              scenario: "discord-status-reactions-tool-only",
              baseline: { sha: $baseline_sha, expected: "queued-only", status: $baseline_status, reproduced: ($baseline_status == "fail") },
              candidate: { sha: $candidate_sha, expected: "queued -> thinking -> done", status: $candidate_status, fixed: ($candidate_status == "pass") },
              pass: (($baseline_status == "fail") and ($candidate_status == "pass"))
            }' > "$root/comparison.json"

          {
            echo "# Mantis Discord Status Reactions"
            echo
            echo "- Scenario: \`discord-status-reactions-tool-only\`"
            echo "- Baseline status: \`${baseline_status}\`"
            echo "- Candidate status: \`${candidate_status}\`"
            echo "- Baseline screenshot: \`baseline/discord-status-reactions-tool-only-timeline.png\`"
            echo "- Candidate screenshot: \`candidate/discord-status-reactions-tool-only-timeline.png\`"
            echo "- Baseline desktop screenshot: \`baseline/discord-status-reactions-tool-only-desktop.png\`"
            echo "- Candidate desktop screenshot: \`candidate/discord-status-reactions-tool-only-desktop.png\`"
            if [[ -f "$root/baseline/discord-status-reactions-tool-only-desktop-preview.gif" ]]; then
              echo "- Baseline desktop preview: \`baseline/discord-status-reactions-tool-only-desktop-preview.gif\`"
            fi
            if [[ -f "$root/candidate/discord-status-reactions-tool-only-desktop-preview.gif" ]]; then
              echo "- Candidate desktop preview: \`candidate/discord-status-reactions-tool-only-desktop-preview.gif\`"
            fi
            if [[ -f "$root/baseline/discord-status-reactions-tool-only-desktop-change.mp4" ]]; then
              echo "- Baseline desktop change clip: \`baseline/discord-status-reactions-tool-only-desktop-change.mp4\`"
            fi
            if [[ -f "$root/candidate/discord-status-reactions-tool-only-desktop-change.mp4" ]]; then
              echo "- Candidate desktop change clip: \`candidate/discord-status-reactions-tool-only-desktop-change.mp4\`"
            fi
            echo "- Baseline desktop video: \`baseline/discord-status-reactions-tool-only-desktop.mp4\`"
            echo "- Candidate desktop video: \`candidate/discord-status-reactions-tool-only-desktop.mp4\`"
          } > "$root/mantis-report.md"

          jq -n \
            --arg baseline_status "$baseline_status" \
            --arg candidate_status "$candidate_status" \
            --arg baseline_sha "${{ needs.validate_refs.outputs.baseline_revision }}" \
            --arg candidate_sha "${{ needs.validate_refs.outputs.candidate_revision }}" \
            '{
              schemaVersion: 1,
              id: "discord-status-reactions",
              title: "Mantis Discord Status Reactions QA",
              summary: "Mantis reran Discord status reactions against the known queued-only baseline and the candidate ref. The baseline reproduced the bug, while the candidate showed the expected queued -> thinking -> done reaction sequence.",
              scenario: "discord-status-reactions-tool-only",
              comparison: {
                baseline: { sha: $baseline_sha, expected: "queued-only", status: $baseline_status, reproduced: ($baseline_status == "fail") },
                candidate: { sha: $candidate_sha, expected: "queued -> thinking -> done", status: $candidate_status, fixed: ($candidate_status == "pass") },
                pass: (($baseline_status == "fail") and ($candidate_status == "pass"))
              },
              artifacts: [
                { kind: "timeline", lane: "baseline", label: "Baseline queued-only", path: "baseline/discord-status-reactions-tool-only-timeline.png", targetPath: "baseline.png", alt: "Baseline Discord status reaction timeline", width: 420 },
                { kind: "timeline", lane: "candidate", label: "Candidate queued -> thinking -> done", path: "candidate/discord-status-reactions-tool-only-timeline.png", targetPath: "candidate.png", alt: "Candidate Discord status reaction timeline", width: 420 },
                { kind: "desktopScreenshot", lane: "baseline", label: "Baseline desktop/VNC browser", path: "baseline/discord-status-reactions-tool-only-desktop.png", targetPath: "baseline-desktop.png", alt: "Baseline Mantis desktop browser screenshot", width: 420 },
                { kind: "desktopScreenshot", lane: "candidate", label: "Candidate desktop/VNC browser", path: "candidate/discord-status-reactions-tool-only-desktop.png", targetPath: "candidate-desktop.png", alt: "Candidate Mantis desktop browser screenshot", width: 420 },
                { kind: "motionPreview", lane: "baseline", label: "Baseline motion preview", path: "baseline/discord-status-reactions-tool-only-desktop-preview.gif", targetPath: "baseline-desktop-preview.gif", alt: "Animated baseline desktop preview", width: 420, required: false },
                { kind: "motionPreview", lane: "candidate", label: "Candidate motion preview", path: "candidate/discord-status-reactions-tool-only-desktop-preview.gif", targetPath: "candidate-desktop-preview.gif", alt: "Animated candidate desktop preview", width: 420, required: false },
                { kind: "motionClip", lane: "baseline", label: "Baseline change MP4", path: "baseline/discord-status-reactions-tool-only-desktop-change.mp4", targetPath: "baseline-desktop-change.mp4", required: false },
                { kind: "motionClip", lane: "candidate", label: "Candidate change MP4", path: "candidate/discord-status-reactions-tool-only-desktop-change.mp4", targetPath: "candidate-desktop-change.mp4", required: false },
                { kind: "fullVideo", lane: "baseline", label: "Baseline desktop MP4", path: "baseline/discord-status-reactions-tool-only-desktop.mp4", targetPath: "baseline-desktop.mp4" },
                { kind: "fullVideo", lane: "candidate", label: "Candidate desktop MP4", path: "candidate/discord-status-reactions-tool-only-desktop.mp4", targetPath: "candidate-desktop.mp4" },
                { kind: "metadata", lane: "baseline", label: "Baseline preview metadata", path: "baseline/discord-status-reactions-tool-only-desktop-preview.json", targetPath: "baseline-desktop-preview.json", required: false },
                { kind: "metadata", lane: "candidate", label: "Candidate preview metadata", path: "candidate/discord-status-reactions-tool-only-desktop-preview.json", targetPath: "candidate-desktop-preview.json", required: false },
                { kind: "metadata", lane: "run", label: "Comparison JSON", path: "comparison.json", targetPath: "comparison.json" },
                { kind: "report", lane: "run", label: "Mantis report", path: "mantis-report.md", targetPath: "mantis-report.md" }
              ]
            }' > "$root/mantis-evidence.json"

          cat "$root/mantis-report.md" >> "$GITHUB_STEP_SUMMARY"

          if [[ "$baseline_status" != "fail" ]]; then
            echo "Baseline did not reproduce queued-only behavior." >&2
            exit 1
          fi
          if [[ "$candidate_status" != "pass" ]]; then
            echo "Candidate did not show queued -> thinking -> done." >&2
            exit 1
          fi

      - name: Upload Mantis status reaction artifacts
        id: upload_artifact
        if: ${{ always() && steps.run_mantis.outputs.output_dir != '' }}
        uses: actions/upload-artifact@v4
        with:
          name: mantis-discord-status-reactions-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ steps.run_mantis.outputs.output_dir }}
          retention-days: 14
          if-no-files-found: warn

      - name: Create Mantis GitHub App token
        id: mantis_app_token
        if: ${{ always() && needs.resolve_request.outputs.pr_number != '' }}
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.MANTIS_GITHUB_APP_ID }}
          private-key: ${{ secrets.MANTIS_GITHUB_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: ${{ github.event.repository.name }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - name: Comment PR with inline QA evidence
        if: ${{ always() && needs.resolve_request.outputs.pr_number != '' && steps.run_mantis.outputs.output_dir != '' }}
        env:
          GH_TOKEN: ${{ steps.mantis_app_token.outputs.token }}
          TARGET_PR: ${{ needs.resolve_request.outputs.pr_number }}
          ARTIFACT_URL: ${{ steps.upload_artifact.outputs.artifact-url }}
          REQUEST_SOURCE: ${{ needs.resolve_request.outputs.request_source }}
        shell: bash
        run: |
          set -euo pipefail

          root=".artifacts/qa-e2e/mantis/discord-status-reactions"
          node scripts/mantis/publish-pr-evidence.mjs \
            --manifest "$root/mantis-evidence.json" \
            --target-pr "$TARGET_PR" \
            --artifact-root "mantis/discord-status-reactions/pr-${TARGET_PR}/run-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" \
            --marker "<!-- mantis-discord-status-reactions -->" \
            --artifact-url "$ARTIFACT_URL" \
            --run-url "https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" \
            --request-source "$REQUEST_SOURCE"