issue-generate-hunts.yml

name: "Draft or Regenerate Hunt from Issue"

on:
  issues:
    types: [labeled]

jobs:
  generate_draft:
    if: >-
      github.event.label.name == 'intel-submission' || github.event.label.name == 'regenerate'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write
    steps:
      - name: "Checkout Repo"
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch all history for all branches and tags

      - name: "Check Regeneration Count"
        id: check_regen
        if: github.event.label.name == 'regenerate'
        uses: actions/github-script@v6
        with:
          github-token: ${{secrets.HEARTH_TOKEN}}
          script: |
            const { data: authenticatedUser } = await github.rest.users.getAuthenticated();
            const botUsername = authenticatedUser.login;
            console.log(`Searching for comments by user: ${botUsername}`);

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const regenComment = comments.reverse().find(comment => 
              comment.user.login === botUsername && /Attempt \d+\/5/.test(comment.body)
            );
            let attempt = 0;
            if (regenComment) {
              const match = regenComment.body.match(/Attempt (\d+)\/5/);
              if (match) {
                attempt = parseInt(match[1], 10);
              }
            }
            console.log(`Last attempt was: ${attempt}`);
            core.setOutput('attempt_count', attempt);
      
      - name: "Halt if Max Regenerations Reached"
        if: steps.check_regen.outputs.attempt_count >= 5
        uses: peter-evans/create-or-update-comment@v4
        with:
          token: ${{ secrets.HEARTH_TOKEN }}
          issue-number: ${{ github.event.issue.number }}
          body: |
            ⚠️ **Maximum Regeneration Limit Reached (5/5)**
            This hunt has been regenerated the maximum number of times. Please review the current draft or close this issue and start a new submission with different CTI.
      
      - name: "Fail workflow if max reached"
        if: steps.check_regen.outputs.attempt_count >= 5
        run: exit 1
      
      - name: "Set next attempt number"
        id: next_attempt
        run: |
          if [ "${{ github.event.label.name }}" == "regenerate" ]; then
            # For regeneration, increment the previous attempt count
            echo "attempt_number=$((${{ steps.check_regen.outputs.attempt_count || 0 }} + 1))" >> $GITHUB_OUTPUT
          else
            # For first generation, this is attempt 1
            echo "attempt_number=1" >> $GITHUB_OUTPUT
          fi
      
      - name: "Set up Python 3"
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: "Install Python dependencies"
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: "Install Playwright browser"
        run: python -m playwright install --with-deps chromium

      - name: "Download MITRE ATT&CK data"
        run: |
          mkdir -p data
          curl -s -o data/enterprise-attack.json https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json
          echo "✅ Downloaded MITRE ATT&CK Enterprise data ($(du -h data/enterprise-attack.json | cut -f1))"

      - name: "Setup Git Branch"
        run: |
          if [ "${{ github.event.label.name }}" == "regenerate" ]; then
            git checkout draft/issue-${{ github.event.issue.number }}
          else
            git checkout -b draft/issue-${{ github.event.issue.number }}
          fi
      
      - name: "Find existing hunt file if regenerating"
        id: find_hunt
        if: github.event.label.name == 'regenerate'
        run: |
          # Find the hunt file added by a previous attempt on THIS draft branch.
          # A bare glob is wrong twice over: Flames/H-*.md never matches (files
          # are HNNN.md, not H-NNN.md), and Flames/H*.md would match every hunt
          # already on main and overwrite a production file.
          HUNT_FILE=$(git diff --name-only origin/main...HEAD -- 'Flames/H*.md' | head -n 1)
          if [ -z "$HUNT_FILE" ]; then
            echo "::error::Regeneration requested but no hunt file was found on draft/issue-${{ github.event.issue.number }}."
            exit 1
          fi
          echo "Regenerating existing hunt file: $HUNT_FILE"
          echo "hunt_file_path=$HUNT_FILE" >> $GITHUB_OUTPUT

      - name: "Parse Issue Body"
        id: parse_issue
        env:
          ISSUE_BODY: ${{ github.event.issue.body }}
        run: |
          # Use environment variable to safely handle issue body with special characters
          printf '%s' "$ISSUE_BODY" > /tmp/issue_body.txt

          # Parse the content from the file instead of direct substitution
          file_url=$(grep -o 'https://github.com/.*/files/[0-9]*/.*' /tmp/issue_body.txt | head -n 1)

          # Parse the source URL from the issue body
          source_url=$(awk 'f{if(NF){print;f=0}} /### Link to Original Source/{f=1}' /tmp/issue_body.txt | xargs)

          # Parse submitter details
          submitter_name=$(awk 'f{if(NF){print;f=0}} /### Your Name \/ Handle/{f=1}' /tmp/issue_body.txt | xargs)
          profile_link=$(awk 'f{if(NF){print;f=0}} /### Link to Profile \(Optional\)/{f=1}' /tmp/issue_body.txt | xargs)

          if [ -z "$submitter_name" ]; then
            submitter_name="A Helpful Contributor"
          fi

          # Check if we have a downloaded CTI file
          cti_file=".hearth/intel-drops/issue-${{ github.event.issue.number }}-cti.txt"

          # Check if the issue has manually pasted content (not the placeholder text)
          has_manual_content="false"
          if grep -q "### CTI Content" /tmp/issue_body.txt; then
            # Check if it's not the placeholder or error message
            if ! grep -q "This will be processed automatically by our system" /tmp/issue_body.txt && \
               ! grep -q "Failed to retrieve or process content" /tmp/issue_body.txt && \
               ! grep -q "Content successfully downloaded" /tmp/issue_body.txt; then
              has_manual_content="true"
            fi
          fi

          echo "file_url=$file_url" >> $GITHUB_OUTPUT
          echo "source_url=$source_url" >> $GITHUB_OUTPUT
          echo "submitter_name=$submitter_name" >> $GITHUB_OUTPUT
          echo "profile_link=$profile_link" >> $GITHUB_OUTPUT
          echo "cti_file=$cti_file" >> $GITHUB_OUTPUT
          echo "has_manual_content=$has_manual_content" >> $GITHUB_OUTPUT

      - name: "Prepare CTI file"
        id: prepare_cti
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mkdir -p .hearth/intel-drops

          file_url="${{ steps.parse_issue.outputs.file_url }}"
          cti_file="${{ steps.parse_issue.outputs.cti_file }}"
          source_url="${{ steps.parse_issue.outputs.source_url }}"
          has_manual_content="${{ steps.parse_issue.outputs.has_manual_content }}"

          # First check if user has manually pasted content
          if [ "$has_manual_content" == "true" ]; then
            echo "✅ Using manually pasted content from issue"
            # Extract the CTI Content section and save it (preserve all lines including empty ones)
            awk '/### CTI Content/,/### Link to Original Source/' /tmp/issue_body.txt | \
              sed '1d;$d' > "$cti_file"

            if [ -s "$cti_file" ]; then
              echo "Successfully extracted $(wc -l < "$cti_file") lines of manually pasted content"
              cp "$cti_file" ".hearth/intel-drops/source_cti.txt"
            else
              echo "⚠️  Manual content section exists but appears empty"
              # Continue to try other methods
            fi
          fi

          # If we don't have a file yet, try other methods
          if [ ! -f "$cti_file" ]; then
            if [ -n "$file_url" ]; then
              echo "Downloading CTI file from URL..."
              # Preserve the original filename from the URL
              filename=$(basename "$file_url")
              curl -s -L -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/octet-stream" "$file_url" -o ".hearth/intel-drops/$filename"
            elif [ -f "$cti_file" ]; then
              echo "Using previously downloaded CTI file: $cti_file"
              cp "$cti_file" ".hearth/intel-drops/source_cti.txt"
            elif [ -n "$source_url" ]; then
              echo "CTI file not found, downloading from source URL: $source_url"
              # Fallback: download the content directly in this workflow
              # Use environment variable to safely pass issue body
              export ISSUE_BODY="$(cat /tmp/issue_body.txt)"
              GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} GITHUB_REPOSITORY=${{ github.repository }} ISSUE_NUMBER=${{ github.event.issue.number }} python .github/scripts/process_issue.py
              # Check if the download was successful
              if [ -f "$cti_file" ]; then
                echo "✅ Successfully downloaded CTI content"
                cp "$cti_file" ".hearth/intel-drops/source_cti.txt"
              else
                echo "❌ Auto-download failed. Please check the issue for details."
                echo "The script has updated issue #${{ github.event.issue.number }} with error information."
                echo ""
                echo "To proceed, please either:"
                echo "  1. Paste the article content directly into the issue (replace the CTI Content section)"
                echo "  2. Upload a text file with the content"
                echo "  3. Fix the URL and remove then re-add the 'intel-submission' label"
                exit 1
              fi
            else
              echo "❌ No CTI content found."
              exit 1
            fi
          fi

      - name: "Post manual content instructions on failure"
        if: failure() && steps.prepare_cti.conclusion == 'failure'
        uses: peter-evans/create-or-update-comment@v4
        with:
          token: ${{ secrets.HEARTH_TOKEN }}
          issue-number: ${{ github.event.issue.number }}
          body: |
            ## 📋 Manual Content Required

            The automatic download failed because the website is blocking automated access.

            **Please manually paste the article content to proceed:**

            ### Steps:
            1. **Open the article** in your browser: ${{ steps.parse_issue.outputs.source_url }}
            2. **Select all the article text** (Ctrl+A or Cmd+A)
            3. **Copy the content** (Ctrl+C or Cmd+C)
            4. **Edit this issue** and replace the entire `### CTI Content` section with the copied article text
            5. **Save the issue**
            6. **Remove and re-add the `intel-submission` label** to re-trigger the workflow

            ### Example of what to replace:
            Replace this section:
            ```
            ### CTI Content

            ❌ **Failed to retrieve or process content from the URL.**
            ...
            ```

            With the actual article content:
            ```
            ### CTI Content

            [PASTE THE FULL ARTICLE TEXT HERE - including title, headings, and all paragraphs]
            ```

            💡 **Tip:** For Medium articles, make sure to copy the entire article including all sections. The workflow will automatically detect and use your pasted content!

      - name: "Get latest feedback comment from author or admin"
        id: feedback
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const { data: issue } = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const issueAuthor = issue.user.login;

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            // Helper to check if user is admin/maintainer
            async function isAdminOrMaintainer(username) {
              try {
                const { data: membership } = await github.rest.repos.getCollaboratorPermissionLevel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  username,
                });
                return ['admin', 'maintain'].includes(membership.permission);
              } catch {
                return false;
              }
            }

            let feedback = '';
            for (let i = comments.length - 1; i >= 0; i--) {
              const comment = comments[i];
              if (comment.user.login === issueAuthor) {
                feedback = comment.body;
                break;
              }
              if (await isAdminOrMaintainer(comment.user.login)) {
                feedback = comment.body;
                break;
              }
            }
            core.setOutput('feedback', feedback);

      - name: "Run HEARTH draft generator"
        id: generate_draft_file
        env:
          AI_PROVIDER: ${{ vars.AI_PROVIDER || 'claude' }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          CLAUDE_MODEL: ${{ vars.CLAUDE_MODEL || 'claude-sonnet-5' }}
          CTI_SOURCE_URL: ${{ steps.parse_issue.outputs.source_url }}
          EXISTING_HUNT_FILE: ${{ steps.find_hunt.outputs.hunt_file_path }}
          SUBMITTER_NAME: ${{ steps.parse_issue.outputs.submitter_name }}
          PROFILE_LINK: ${{ steps.parse_issue.outputs.profile_link }}
          FEEDBACK: ${{ steps.feedback.outputs.feedback }}
        run: python scripts/generate_from_cti.py

      - name: "Commit and push generated hunt"
        run: |
          git config --global user.name 'hearthbot'
          git config --global user.email 'hearthbot@users.noreply.github.com'
          git add Flames/*.md
          git commit -m "feat(draft): Update hunt from issue #${{ github.event.issue.number }}"
          git remote set-url origin https://x-access-token:${{ secrets.HEARTH_TOKEN }}@github.com/${{ github.repository }}
          # Draft branches are disposable: a fresh submission or a regeneration
          # fully replaces any existing draft for the issue, so force-push in both
          # cases. Otherwise re-triggering an issue that already has a draft branch
          # fails with a non-fast-forward push rejection (issue #313).
          if [ "${{ github.event.label.name }}" == "regenerate" ]; then
            git push --force
          else
            git push --force --set-upstream origin draft/issue-${{ github.event.issue.number }}
          fi

      - name: "Comment on issue with draft link"
        uses: peter-evans/create-or-update-comment@v4
        with:
          token: ${{ secrets.HEARTH_TOKEN }}
          issue-number: ${{ github.event.issue.number }}
          body: |
            ${{ github.event.label.name == 'regenerate' && format('♻️ A new version of the hunt has been drafted! (Attempt {0}/5)', steps.next_attempt.outputs.attempt_number) || format('✅ A new hunt has been drafted from your submission! (Attempt {0}/5)', steps.next_attempt.outputs.attempt_number) }}
            
            **Hypothesis:** ${{ steps.generate_draft_file.outputs.HYPOTHESIS }}
            
            Please review the updated file here:
            [**View Hunt Draft**](https://github.com/${{ github.repository }}/blob/draft/issue-${{ github.event.issue.number }}/${{ steps.generate_draft_file.outputs.HUNT_FILE_PATH }})

            ---
            ${{ steps.generate_draft_file.outputs.DUPLICATE_ANALYSIS && format('

            **🔍 Duplicate Detection Results:**
            {0}

            ---', steps.generate_draft_file.outputs.DUPLICATE_ANALYSIS) || '' }}

            If you want to regenerate, **please leave a comment on this issue with your feedback or what you'd like changed, then add the `regenerate` label**.
            
            If it looks good, add the `approved` label.

      - name: "Remove 'needs-triage' label"
        if: success()
        uses: actions/github-script@v6
        with:
          github-token: ${{secrets.HEARTH_TOKEN}}
          script: |
            try {
              await github.rest.issues.removeLabel({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                name: 'needs-triage'
              });
            } catch (error) {
              if (error.status === 404) {
                console.log("Label 'needs-triage' not found, which is fine.");
              } else {
                throw error;
              }
            }

      - name: "Remove 'regenerate' label"
        if: github.event.label.name == 'regenerate'
        uses: actions/github-script@v6
        with:
          github-token: ${{secrets.HEARTH_TOKEN}}
          script: |
            github.rest.issues.removeLabel({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'regenerate'
            })