name: Nightly Security Updates

on:
  schedule:
    - cron: '0 1 * * *' # Every day at 1am
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write

jobs:
  security:
    uses: ./.github/workflows/reusable-claude-dotnet-setup.yml
    with:
      prompt: "Follow @docs/ai/commands/update-packages.md to fix security vulnerabilities"
      max_turns: '100'
    secrets: inherit

name: Reusable Claude .NET Setup

on:
  workflow_call:
    inputs:
      max_turns:
        required: false
        type: string
        default: '100'
      model:
        required: false
        type: string
        default: 'claude-opus-4-5-20251101'

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write

jobs:
  update:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6.0.1

      # ... setup steps (dotnet, node, dependencies, infrastructure, MCP server) ...

      - name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            You are running as Cloud AI inside a GitHub Actions workflow.

            ${{ inputs.prompt }}
          claude_args: |
            --max-turns ${{ inputs.max_turns }}
            --model ${{ inputs.model }}
            --mcp-config '{"mcpServers":{"dotnet-knowledge-base":{"type":"sse","url":"http://localhost:7929/mcp"},"context7":{"type":"sse","url":"https://mcp.context7.com/mcp","headers":{}}}}'
            --allowedTools "Edit,Write,Read,Glob,Grep,WebSearch,Bash(dotnet:*),mcp__dotnet-knowledge-base__*,mcp__context7__*"
            --strict-mcp-config
          show_full_output: true