copilot-setup-steps.yml

name: "Copilot Setup Steps"

# Automatically run the setup steps when they are changed to allow for easy validation, and
# allow manual testing through the repository's "Actions" tab
on:
  workflow_dispatch:
  push:
    paths:
      - .github/workflows/copilot-setup-steps.yml
  pull_request:
    paths:
      - .github/workflows/copilot-setup-steps.yml

env:
  GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
  GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
  COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN }}
  # IMF SDMX subscription keys — forwarded into the Copilot coding-agent shell so
  # interactive sessions can authenticate api.imf.org / sdmxcentral.imf.org / dataservices.imf.org
  # (WEO via www.imf.org Datamapper is unauthenticated). Primary is consumed by
  # scripts/imf-client.ts via Ocp-Apim-Subscription-Key; secondary is a hot-spare rotation key
  # (stored only, not auto-consumed). See analysis/imf/agentic-integration.md §"Pre-warm gate".
  IMF_SDMX_SUBSCRIPTION_KEY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY }}
  IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY }}

permissions:
  contents: read

jobs:
  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
  copilot-setup-steps:
    runs-on: ubuntu-26.04

    # Set the permissions to the lowest permissions possible needed for your steps.
    # Copilot will be given its own token for its operations.
    permissions:
      contents: read
      actions: read
      attestations: read
      checks: read
      deployments: read
      issues: write
      models: read
      discussions: read
      pages: read
      pull-requests: write
      security-events: read
      statuses: read

    # Steps run before the agent starts working
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # Forward IMF SDMX subscription keys to the Copilot coding-agent runtime.
      # The top-level workflow `env:` block ONLY scopes to setup-job steps — it does
      # NOT propagate to the agent's interactive bash sessions. The Copilot runtime
      # inherits env vars written to $GITHUB_ENV during setup-steps. This mirrors the
      # pattern used by .github/actions/news-prewarm/action.yml for news workflows.
      # The keys gate access to the SDMX 3.0 surface at api.imf.org/external/sdmx/3.0
      # (the only IMF SDMX surface this repo targets). The Datamapper transport at
      # www.imf.org/external/datamapper/api/v1 is unauthenticated and unaffected.
      # Reference: https://docs.github.com/en/copilot/customizing-copilot/customizing-the-development-environment-for-copilot-coding-agent
      - name: Export IMF SDMX subscription keys to agent env
        env:
          IMF_SDMX_SUBSCRIPTION_KEY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY }}
          IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY: ${{ secrets.IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY }}
        run: |
          if [ -n "${IMF_SDMX_SUBSCRIPTION_KEY:-}" ]; then
            echo "IMF_SDMX_SUBSCRIPTION_KEY=${IMF_SDMX_SUBSCRIPTION_KEY}" >> "$GITHUB_ENV"
            echo "::add-mask::${IMF_SDMX_SUBSCRIPTION_KEY}"
            echo "✅ IMF_SDMX_SUBSCRIPTION_KEY exported to agent env"
          else
            echo "::warning::IMF_SDMX_SUBSCRIPTION_KEY secret not set — SDMX calls to api.imf.org will fail with 404 auth-mask diagnostic"
          fi
          if [ -n "${IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY:-}" ]; then
            echo "IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY=${IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY}" >> "$GITHUB_ENV"
            echo "::add-mask::${IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY}"
            echo "✅ IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY exported to agent env"
          else
            echo "ℹ️ IMF_SDMX_SUBSCRIPTION_KEY_SECONDARY not set (optional rotation hot-spare)"
          fi

      # Setup environment
      - name: Setup Environment (resilient apt install)
        timeout-minutes: 10
        run: |
          echo "🔧 Setting up environment..."

          # System dependencies for Web rendering.
          # Retry apt metadata + install to tolerate transient mirror/network failures.
          for attempt in 1 2 3; do
            if sudo apt-get update -o Acquire::Retries=5 -o Acquire::http::Timeout=30; then
              break
            fi
            echo "⚠️ apt-get update failed (attempt $attempt) — retrying in $((attempt * 10))s"
            sleep $((attempt * 10))
            if [ "$attempt" -eq 3 ]; then
              echo "❌ apt-get update failed after 3 attempts"
              exit 1
            fi
          done

          for attempt in 1 2 3; do
            if sudo apt-get install -y --no-install-recommends graphviz; then
              break
            fi
            echo "⚠️ apt-get install graphviz failed (attempt $attempt) — retrying in $((attempt * 10))s"
            sleep $((attempt * 10))
            if [ "$attempt" -eq 3 ]; then
              echo "❌ apt-get install graphviz failed after 3 attempts"
              exit 1
            fi
          done

          echo "✅ environment setup complete"
 
      # JavaScript/TypeScript setup
      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "26"
          cache: 'npm'
          cache-dependency-path: |
            package-lock.json
            .github/workflows/copilot-setup-steps.yml

      - name: Install gh-aw CLI
        run: |
          GH_AW_VERSION="v0.82.9"
          gh extension install github/gh-aw --pin "$GH_AW_VERSION"
        env:
          GH_TOKEN: ${{ secrets.COPILOT_MCP_GITHUB_PERSONAL_ACCESS_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Install dependencies (resilient npm ci)
        timeout-minutes: 15
        run: |
          npm config set fetch-retries 5
          npm config set fetch-retry-mintimeout 20000
          npm config set fetch-retry-maxtimeout 120000
          for attempt in 1 2 3; do
            if npm ci; then
              echo "✅ npm ci succeeded (attempt $attempt)"
              break
            fi
            echo "⚠️ npm ci failed (attempt $attempt) — retrying in $((attempt * 10))s"
            sleep $((attempt * 10))
            if [ "$attempt" -eq 3 ]; then
              echo "❌ npm ci failed after 3 attempts"
              exit 1
            fi
          done

      # Pre-install MCP server packages globally
      - name: Install MCP server packages globally (resilient)
        timeout-minutes: 20
        run: |
          echo "📦 Installing MCP server packages globally..."

          npm config set fetch-retries 5
          npm config set fetch-retry-mintimeout 20000
          npm config set fetch-retry-maxtimeout 120000

          install_global_retry() {
            pkg="$1"
            for attempt in 1 2 3; do
              if npm install -g "$pkg"; then
                echo "✅ Installed $pkg (attempt $attempt)"
                return 0
              fi
              echo "⚠️ Failed installing $pkg (attempt $attempt) — retrying in $((attempt * 10))s"
              sleep $((attempt * 10))
            done
            echo "❌ Failed installing $pkg after 3 attempts"
            return 1
          }

          # Install Node.js MCP servers that exist on npm
          install_global_retry @modelcontextprotocol/server-filesystem
          install_global_retry @modelcontextprotocol/server-memory
          install_global_retry @modelcontextprotocol/server-sequential-thinking

          # Pre-cache @playwright/mcp for faster startup
          install_global_retry @playwright/mcp

          # Do not pre-install Playwright browser binaries in setup.
          # Browser downloads are large and can exceed this workflow's setup budget;
          # agents can install browsers on demand when browser automation is required.

          # Install World Bank MCP server for economic data
          install_global_retry worldbank-mcp@1.0.1

          # Install PxWeb MCP server for SCB (Statistics Sweden) data
          install_global_retry @jarib/pxweb-mcp@2.0.0

          echo "✅ Node.js MCP server packages installed globally"

      # Verify all MCP server installations
      - name: Verify MCP server installations
        run: |
          echo "🔍 Verifying MCP server installations..."
          
          echo "=== Node.js MCP Servers ==="
          echo "Checking mcp-server-filesystem..."
          which mcp-server-filesystem && echo "✅ mcp-server-filesystem found" || echo "❌ mcp-server-filesystem NOT found"
          
          echo "Checking mcp-server-memory..."
          which mcp-server-memory && echo "✅ mcp-server-memory found" || echo "❌ mcp-server-memory NOT found"
          
          echo "Checking mcp-server-sequential-thinking..."
          which mcp-server-sequential-thinking && echo "✅ mcp-server-sequential-thinking found" || echo "❌ mcp-server-sequential-thinking NOT found"
          
          echo "Checking @playwright/mcp..."
          which mcp-server-playwright 2>/dev/null && echo "✅ mcp-server-playwright found" || echo "ℹ️ @playwright/mcp available via npx"
          
          echo "Checking worldbank-mcp..."
          which worldbank-mcp && echo "✅ worldbank-mcp found" || echo "❌ worldbank-mcp NOT found"
          
          echo "Checking @jarib/pxweb-mcp..."
          which pxweb-mcp && echo "✅ pxweb-mcp (SCB) found" || echo "❌ pxweb-mcp NOT found"

          echo ""
          echo "=== HTTP MCP Servers ==="
          echo "📍 GitHub MCP Server: Using HTTP endpoint (https://api.githubcopilot.com/mcp/insiders)"
          echo "📍 Riksdag-Regering MCP Server: Using HTTP endpoint (https://riksdag-regering-ai.onrender.com/mcp)"
          echo "=== Local stdio MCP Servers ==="
          echo "📍 World Bank MCP Server: worldbank-mcp (stdio)"
          echo "📍 SCB MCP Server: @jarib/pxweb-mcp --url https://api.scb.se/OV0104/v2beta (stdio)"
          echo "=== TypeScript clients (invoked via tsx, no MCP) ==="
          echo "📍 IMF: scripts/imf-client.ts + scripts/imf-fetch.ts — direct HTTPS to data.imf.org / www.imf.org"
          echo "✅ MCP server verification complete"