env0.plugin.yaml

name: Overmind
icon: https://avatars.githubusercontent.com/u/93521445
inputs:
  action:
    description: 'The action to perform. Must be one of: submit-plan, start-change, end-change, wait-for-simulation'
    required: true
  api_key:
    description: 'Overmind API key for authentication'
    required: true
  tags:
    description: 'A comma-separated list of key=value tags to attach to the change (only used with submit-plan action)'
    required: false
  app:
    description: 'The Overmind instance to connect to (defaults to https://app.overmind.tech)'
    required: false
  post_comment:
    description: 'Whether wait-for-simulation should post the Overmind markdown to the PR/MR. Defaults to true when ENV0_PR_NUMBER is set, otherwise false. When true, comment_provider must be set.'
    required: false
  comment_provider:
    description: 'Where to post PR/MR comments when wait-for-simulation runs with post_comment=true. Must be one of: github, gitlab.'
    required: false
  on_failure:
    description: "Behavior when an error occurs. 'fail' (default) fails the plugin step and blocks the deployment; 'pass' allows the deployment to continue even if this step errors."
    required: false
  skip_after_approval:
    description: "When true (default), submit-plan exits early once a deployment has been approved (ENV0_REVIEWER_NAME is set), avoiding wasted resubmission of the post-approval re-plan. Set to false to submit on every plan, including the apply pipeline's re-plan."
    required: false
  timeout:
    description: "Wall-clock time limit for the entire Overmind CLI invocation after login, including any polling for analysis or snapshot completion (e.g. '45m'). Accepts any Go duration string. Defaults to the CLI default of 31m. Must be longer than the expected analysis time; the 30-minute service hard cap on analysis is separate from this value."
    required: false
  change_analysis_target_duration:
    description: "Soft server-side target duration for change analysis planning used with submit-plan (e.g. '5m', '20m'). The blast-radius phase uses 67% of this value; the remaining 33% covers hypothesis formation. Valid range: 1m–30m. Defaults to account-level settings."
    required: false
  blast_radius_link_depth:
    description: "How many relationship levels deep to traverse when calculating the blast radius (used with submit-plan). Larger values give a more complete picture but take longer. Defaults to account-level settings."
    required: false
  blast_radius_max_items:
    description: "Maximum number of resources to include in the blast radius calculation (used with submit-plan). Larger values give a more complete picture but take longer. Defaults to account-level settings."
    required: false
  risk_levels:
    description: "Comma-separated list of risk severities to include in the wait-for-simulation output (e.g. 'high,medium'). Allowed values: high, medium, low. Defaults to all three."
    required: false
  wait_for_snapshot:
    description: "When true, start-change blocks until the pre-change snapshot is fully captured before returning. Defaults to false (snapshot runs in background)."
    required: false
run:
  exec: |
    #!/bin/sh

    _on_failure="${inputs.on_failure}"
    ON_FAILURE="${_on_failure:-fail}"
    ON_FAILURE=$(echo "${ON_FAILURE}" | tr '[:upper:]' '[:lower:]')
    case "${ON_FAILURE}" in
        pass|fail) ;;
        *) echo "Error: on_failure must be 'pass' or 'fail'"; exit 1 ;;
    esac

    cleanup() {
        if [ -n "${TMP_DIR}" ] && [ -d "${TMP_DIR}" ]; then
            rm -rf "${TMP_DIR}"
        fi
        if [ -n "${GH_TMP_DIR}" ] && [ -d "${GH_TMP_DIR}" ]; then
            rm -rf "${GH_TMP_DIR}"
        fi
        if [ -n "${COSIGN_DIR}" ] && [ -d "${COSIGN_DIR}" ]; then
            rm -rf "${COSIGN_DIR}"
        fi
        if [ -n "${MARKDOWN_FILE}" ] && [ -f "${MARKDOWN_FILE}" ]; then
            rm -f "${MARKDOWN_FILE}"
        fi
        if [ -n "${JSON_PAYLOAD_FILE}" ] && [ -f "${JSON_PAYLOAD_FILE}" ]; then
            rm -f "${JSON_PAYLOAD_FILE}"
        fi
        if [ -n "${GITLAB_NOTES_PAGE_FILE}" ] && [ -f "${GITLAB_NOTES_PAGE_FILE}" ]; then
            rm -f "${GITLAB_NOTES_PAGE_FILE}"
        fi
        if [ -n "${GITLAB_FALLBACK_BODY_FILE}" ] && [ -f "${GITLAB_FALLBACK_BODY_FILE}" ]; then
            rm -f "${GITLAB_FALLBACK_BODY_FILE}"
        fi
        if [ -n "${GITLAB_USER_FILE}" ] && [ -f "${GITLAB_USER_FILE}" ]; then
            rm -f "${GITLAB_USER_FILE}"
        fi
    }

    # ---------------------------------------------------------------------
    # Supply-chain verification: every binary we download from GitHub Releases
    # is verified against the producer workflow's GitHub Artifact Attestation
    # (SLSA build provenance v1) before we execute it. ENG-4087.
    #
    # Path 1 (preferred): if `gh` (GitHub CLI 2.49+) is on PATH, use
    # `gh attestation verify`. One command, no new binaries.
    # Path 2 (fallback): download cosign from GitHub Releases, verify it
    # against a pinned SHA256, fetch the attestation bundle from the GitHub
    # API by archive digest, and run `cosign verify-blob-attestation`.
    #
    # Failures exit with ATTESTATION_FAIL_EXIT (99). The on_failure=pass
    # wrapper at the bottom of this script does NOT swallow that code:
    # supply-chain failures are intentionally non-bypassable.
    # ---------------------------------------------------------------------

    ATTESTATION_FAIL_EXIT=99

    # Pinned cosign release. Renovate keeps COSIGN_VERSION and the per-platform
    # SHA256 digests in sync; refresh both together (see the customManager in
    # renovate.json).
    # renovate: datasource=github-releases depName=sigstore/cosign
    COSIGN_VERSION="v3.0.6"
    COSIGN_SHA256_linux_amd64="c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74"
    COSIGN_SHA256_linux_arm64="bedac92e8c3729864e13d4a17048007cfafa79d5deca993a43a90ffe018ef2b8"
    COSIGN_SHA256_darwin_amd64="4c3e7af8372d3ca3296e62fa56f23fcbb5721cc6ac1827900d398f110d7cd280"
    COSIGN_SHA256_darwin_arm64="5fadd012ae6381a6a29ff86a7d39aa873878852f1073fc90b15995961ecfb084"
    COSIGN_SHA256_windows_amd64="9b85a88ebff2d9dd30ff4984a6f61f2cedc232dd87d81fa7f2ff3c0ed96c241c"

    attestation_fail() {
        echo "ERROR: $1" >&2
        echo "Refusing to install unverified binary. Supply-chain verification failures are not bypassed by on_failure=pass." >&2
        exit "${ATTESTATION_FAIL_EXIT}"
    }

    compute_sha256() {
        _csha_file="$1"
        if command -v sha256sum >/dev/null 2>&1; then
            sha256sum "${_csha_file}" | awk '{print $1}'
        elif command -v shasum >/dev/null 2>&1; then
            shasum -a 256 "${_csha_file}" | awk '{print $1}'
        elif command -v openssl >/dev/null 2>&1; then
            openssl dgst -sha256 "${_csha_file}" | awk '{print $NF}'
        else
            return 1
        fi
    }

    # Extract the value of an HTTP response header from a curl -D dump file.
    # Case-insensitive; returns the last occurrence (handles redirects) with
    # CR/LF stripped. Empty output if the header is absent.
    extract_header_value() {
        _ehv_file="$1"; _ehv_name="$2"
        grep -i "^${_ehv_name}:" "${_ehv_file}" 2>/dev/null \
            | tail -n 1 \
            | awk '{print $2}' \
            | tr -d '\r\n'
    }

    cosign_platform_id() {
        case "${OS}_${ARCH}" in
            Linux_x86_64)   echo "linux_amd64" ;;
            Linux_arm64)    echo "linux_arm64" ;;
            Darwin_x86_64)  echo "darwin_amd64" ;;
            Darwin_arm64)   echo "darwin_arm64" ;;
            Windows_x86_64) echo "windows_amd64" ;;
            *)              return 1 ;;
        esac
    }

    cosign_asset_for_platform() {
        case "$1" in
            linux_amd64)   echo "cosign-linux-amd64" ;;
            linux_arm64)   echo "cosign-linux-arm64" ;;
            darwin_amd64)  echo "cosign-darwin-amd64" ;;
            darwin_arm64)  echo "cosign-darwin-arm64" ;;
            windows_amd64) echo "cosign-windows-amd64.exe" ;;
            *)             return 1 ;;
        esac
    }

    cosign_pinned_sha256() {
        case "$1" in
            linux_amd64)   echo "${COSIGN_SHA256_linux_amd64}" ;;
            linux_arm64)   echo "${COSIGN_SHA256_linux_arm64}" ;;
            darwin_amd64)  echo "${COSIGN_SHA256_darwin_amd64}" ;;
            darwin_arm64)  echo "${COSIGN_SHA256_darwin_arm64}" ;;
            windows_amd64) echo "${COSIGN_SHA256_windows_amd64}" ;;
            *)             return 1 ;;
        esac
    }

    ensure_cosign() {
        if [ -n "${COSIGN_BIN}" ] && [ -x "${COSIGN_BIN}" ]; then
            return 0
        fi
        if ! _plat=$(cosign_platform_id); then
            attestation_fail "No cosign binary published for ${OS}/${ARCH} (cosign ${COSIGN_VERSION}). Install GitHub CLI 2.49+ on the runner so the plugin can use 'gh attestation verify' instead, or run on a platform cosign supports (Linux/Darwin amd64+arm64, Windows amd64)."
        fi
        _asset=$(cosign_asset_for_platform "${_plat}")
        _expected=$(cosign_pinned_sha256 "${_plat}")
        if [ -z "${_expected}" ]; then
            attestation_fail "Pinned SHA256 for cosign ${_plat} is empty; refusing to download. Update COSIGN_SHA256_${_plat} in env0.plugin.yaml."
        fi
        COSIGN_DIR=$(mktemp -d)
        case "${_asset}" in
            *.exe) COSIGN_BIN="${COSIGN_DIR}/cosign.exe" ;;
            *)     COSIGN_BIN="${COSIGN_DIR}/cosign" ;;
        esac
        _url="https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/${_asset}"
        echo "Downloading cosign ${COSIGN_VERSION} (${_plat}) for attestation verification..."
        if ! curl -fsSL "${_url}" -o "${COSIGN_BIN}"; then
            attestation_fail "Failed to download cosign from ${_url}"
        fi
        if ! _actual=$(compute_sha256 "${COSIGN_BIN}"); then
            attestation_fail "No SHA256 tool available on this runner (need sha256sum, shasum, or openssl)"
        fi
        if [ "${_actual}" != "${_expected}" ]; then
            attestation_fail "cosign SHA256 mismatch for ${_plat} (expected ${_expected}, got ${_actual}). Pinned digest may be stale or download corrupted."
        fi
        chmod +x "${COSIGN_BIN}"
        echo "✓ cosign ${COSIGN_VERSION} verified against pinned SHA256"
    }

    verify_with_cosign() {
        _vc_archive="$1"; _vc_repo="$2"; _vc_wf_path="$3"
        ensure_cosign
        if ! _vc_digest=$(compute_sha256 "${_vc_archive}"); then
            attestation_fail "Could not compute SHA256 of ${_vc_archive}"
        fi
        _vc_bundle="${COSIGN_DIR}/bundle-${_vc_digest}.json"
        _vc_response="${COSIGN_DIR}/response-${_vc_digest}.json"
        _vc_headers="${COSIGN_DIR}/headers-${_vc_digest}.txt"
        _vc_api_url="https://api.github.com/repos/${_vc_repo}/attestations/sha256:${_vc_digest}"
        _vc_gh_token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
        echo "Fetching attestation bundle for ${_vc_repo} sha256:${_vc_digest}..."
        # Try authenticated first (raises rate limits) but fall back to
        # unauthenticated on 401/403. env0 runners often expose a fine-grained
        # PAT scoped only to the customer's own repos, which would 401 here;
        # the attestations endpoint is publicly readable for public repos and
        # the actual trust boundary is the cosign verify step below.
        _vc_authed_ok=0
        if [ -n "${_vc_gh_token}" ]; then
            _vc_http=$(curl -sSL -o "${_vc_response}" -D "${_vc_headers}" -w '%{http_code}' \
                -H "Authorization: Bearer ${_vc_gh_token}" \
                -H "Accept: application/vnd.github+json" \
                "${_vc_api_url}" || echo "000")
            _vc_msg=$(jq -r '.message // empty' "${_vc_response}" 2>/dev/null || true)
            case "${_vc_http}" in
                200)
                    _vc_authed_ok=1
                    ;;
                401|403)
                    echo "  GH_TOKEN/GITHUB_TOKEN rejected by GitHub (HTTP ${_vc_http}): ${_vc_msg:-<no body>}. Retrying without auth since attestations on public repos are publicly readable." >&2
                    ;;
                *)
                    attestation_fail "Failed to fetch attestation bundle from ${_vc_api_url} (HTTP ${_vc_http}). GitHub response: ${_vc_msg:-<no body>}"
                    ;;
            esac
        fi
        if [ "${_vc_authed_ok}" -eq 0 ]; then
            # Unauthenticated fallback. GitHub's unauthenticated REST API limit
            # is 60 requests/hour per IPv4, and env0's shared egress IPs
            # exhaust that quickly. On rate-limit responses (HTTP 403/429 with
            # X-RateLimit-Remaining=0) sleep up to X-RateLimit-Reset (bounded
            # at 60s) and retry once before giving up. Capture status code +
            # body via -D/-o so the failure surfaces GitHub's own "API rate
            # limit exceeded for <ip>..." message instead of a bare curl 22.
            _vc_attempt=1
            _vc_max_attempts=2
            _vc_max_wait=60
            while :; do
                _vc_http=$(curl -sSL -o "${_vc_response}" -D "${_vc_headers}" -w '%{http_code}' \
                    -H "Accept: application/vnd.github+json" \
                    "${_vc_api_url}" || echo "000")
                if [ "${_vc_http}" = "200" ]; then
                    break
                fi
                _vc_msg=$(jq -r '.message // empty' "${_vc_response}" 2>/dev/null || true)
                if [ "${_vc_http}" = "403" ] || [ "${_vc_http}" = "429" ]; then
                    _vc_remaining=$(extract_header_value "${_vc_headers}" 'x-ratelimit-remaining')
                    _vc_reset=$(extract_header_value "${_vc_headers}" 'x-ratelimit-reset')
                    _vc_now=$(date +%s 2>/dev/null || echo 0)
                    _vc_wait=0
                    if [ -n "${_vc_reset}" ] && [ "${_vc_reset}" -gt "${_vc_now}" ] 2>/dev/null; then
                        _vc_wait=$((_vc_reset - _vc_now))
                    fi
                    if [ "${_vc_attempt}" -lt "${_vc_max_attempts}" ] \
                       && [ "${_vc_remaining}" = "0" ] \
                       && [ "${_vc_wait}" -gt 0 ] \
                       && [ "${_vc_wait}" -le "${_vc_max_wait}" ]; then
                        echo "  GitHub API rate-limit hit (HTTP ${_vc_http}; x-ratelimit-remaining=0). Sleeping ${_vc_wait}s until x-ratelimit-reset and retrying once." >&2
                        sleep "${_vc_wait}"
                        _vc_attempt=$((_vc_attempt + 1))
                        continue
                    fi
                    attestation_fail "Failed to fetch attestation bundle from ${_vc_api_url} (HTTP ${_vc_http}). GitHub response: ${_vc_msg:-<no body>}. This is almost certainly GitHub's REST API rate limit. Unauthenticated requests are capped at 60/hour per IP, and env0's shared egress IPs hit that limit quickly. Set GH_TOKEN or GITHUB_TOKEN in your env0 environment to authenticate; a GitHub classic personal access token with NO scopes is sufficient and raises the limit to 5000/hour. See README 'Supply-chain verification' for setup details."
                fi
                attestation_fail "Failed to fetch attestation bundle from ${_vc_api_url} (HTTP ${_vc_http}). GitHub response: ${_vc_msg:-<no body>}"
            done
        fi
        if ! jq -e '.attestations | length > 0' "${_vc_response}" >/dev/null 2>&1; then
            attestation_fail "No GitHub Artifact Attestations found for ${_vc_repo} digest sha256:${_vc_digest}. The producer release may not have been signed."
        fi
        if ! jq -r '.attestations[0].bundle' "${_vc_response}" > "${_vc_bundle}"; then
            attestation_fail "Could not extract attestation bundle from GitHub API response"
        fi
        _vc_identity_re="^https://github\\.com/${_vc_repo}/${_vc_wf_path}@refs/tags/v.*\$"
        echo "Verifying ${_vc_archive} via cosign verify-blob-attestation (${_vc_repo})..."
        if ! "${COSIGN_BIN}" verify-blob-attestation \
            --bundle "${_vc_bundle}" \
            --new-bundle-format \
            --type slsaprovenance1 \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            --certificate-identity-regexp "${_vc_identity_re}" \
            "${_vc_archive}"; then
            attestation_fail "cosign verify-blob-attestation failed for ${_vc_archive} (${_vc_repo})"
        fi
        echo "✓ Attestation verified via cosign (${_vc_repo})"
    }

    verify_attestation() {
        _va_archive="$1"; _va_repo="$2"; _va_wf_path="$3"
        if [ ! -f "${_va_archive}" ]; then
            attestation_fail "Cannot verify ${_va_archive}: file not found"
        fi
        if command -v gh >/dev/null 2>&1 && gh attestation verify --help >/dev/null 2>&1; then
            echo "Verifying ${_va_archive} via gh attestation verify (${_va_repo})..."
            if gh attestation verify "${_va_archive}" \
                --repo "${_va_repo}" \
                --signer-workflow "${_va_repo}/${_va_wf_path}" \
                --cert-oidc-issuer "https://token.actions.githubusercontent.com"; then
                echo "✓ Attestation verified via gh (${_va_repo})"
                return 0
            fi
            attestation_fail "gh attestation verify failed for ${_va_archive} (${_va_repo})"
        fi
        verify_with_cosign "${_va_archive}" "${_va_repo}" "${_va_wf_path}"
    }

    main_script() {
        set -e
        trap cleanup EXIT
        TMP_DIR=""
        GH_TMP_DIR=""
        GH_BINARY=""
        COSIGN_DIR=""
        COSIGN_BIN=""
        MARKDOWN_FILE=""
        JSON_PAYLOAD_FILE=""
        GITLAB_NOTES_PAGE_FILE=""
        GITLAB_FALLBACK_BODY_FILE=""
        GITLAB_USER_FILE=""
        ORIGINAL_DIR=$(pwd)

    # Export API key as environment variable
    export OVM_API_KEY="${inputs.api_key}"

    # Install Overmind CLI
    REPO="overmindtech/cli"
    OS=$(uname -s)
    ARCH=$(uname -m)

    case "${ARCH}" in
        x86_64) ARCH="x86_64" ;;
        aarch64|arm64) ARCH="arm64" ;;
        i386|i686) ARCH="i386" ;;
        *) echo "Unsupported architecture: ${ARCH}"; exit 1 ;;
    esac

    case "${OS}" in
        Linux|Darwin) ARCHIVE_EXT="tar.gz" ;;
        MINGW*|MSYS*|CYGWIN*) OS="Windows"; ARCHIVE_EXT="zip" ;;
        *) echo "Unsupported OS: ${OS}"; exit 1 ;;
    esac

    # Function to find a writable directory in PATH
    find_install_dir() {
        IFS=':'
        for dir in $PATH; do
            [ -z "$dir" ] && continue

            # Create directory if it doesn't exist (if parent is writable)
            if [ ! -d "$dir" ]; then
                mkdir -p "$dir" 2>/dev/null || continue
            fi

            # Check if directory is writable
            if [ -w "$dir" ]; then
                echo "$dir"
                unset IFS
                return 0
            fi
        done
        unset IFS
        return 1
    }

    INSTALL_DIR=$(find_install_dir)
    if [ -z "${INSTALL_DIR}" ]; then
        echo "Error: No writable directory found in PATH"
        echo "Current PATH: ${PATH}"
        exit 1
    fi

    echo "Installing to: ${INSTALL_DIR}"
    echo "Downloading latest Overmind release..."

    FILENAME="overmind_cli_${OS}_${ARCH}.${ARCHIVE_EXT}"
    DOWNLOAD_URL="https://github.com/${REPO}/releases/latest/download/${FILENAME}"

    echo "Downloading ${FILENAME}..."
    TMP_DIR=$(mktemp -d)
    cd "${TMP_DIR}"

    curl -fsSL "${DOWNLOAD_URL}" -o archive

    verify_attestation "archive" "${REPO}" ".github/workflows/release.yml"

    if [ "${ARCHIVE_EXT}" = "tar.gz" ]; then
        tar -xzf archive
    else
        unzip -q archive
    fi

    if [ "${OS}" = "Windows" ]; then
        EXPECTED_BINARY="overmind.exe"
    else
        EXPECTED_BINARY="overmind"
    fi

    if [ -f "${EXPECTED_BINARY}" ]; then
        BINARY="./${EXPECTED_BINARY}"
    else
        BINARY=$(find . -maxdepth 2 -type f -executable -name "overmind*" ! -name "*.txt" ! -name "*.md" ! -name "LICENSE" | head -n 1)
    fi
    if [ -z "${BINARY}" ]; then
        echo "Error: Could not find binary in archive"
        ls -la
        exit 1
    fi

    cp "${BINARY}" "${INSTALL_DIR}/overmind"
    chmod +x "${INSTALL_DIR}/overmind"
    echo "✓ Overmind CLI installed to ${INSTALL_DIR}/overmind"

    # Verify installation
    "${INSTALL_DIR}/overmind" version 2>/dev/null || echo "Installation complete"
    cd "${ORIGINAL_DIR}"

    # Install GitHub CLI only when needed (wait-for-simulation + comment_provider=github)
    install_github_cli() {
        GH_REPO="cli/cli"
        echo "Installing GitHub CLI..."
        case "${ARCH}" in
            x86_64) GH_ARCH="amd64" ;;
            arm64) GH_ARCH="arm64" ;;
            i386) GH_ARCH="386" ;;
            *) echo "Unsupported architecture for GitHub CLI: ${ARCH}"; exit 1 ;;
        esac
        case "${OS}" in
            Linux) GH_OS="linux" ;;
            Darwin) GH_OS="macOS" ;;
            Windows) GH_OS="windows" ;;
            *) echo "Unsupported OS for GitHub CLI: ${OS}"; exit 1 ;;
        esac
        if [ "${OS}" = "Windows" ]; then
            GH_ARCHIVE_EXT="zip"
            GH_BINARY_NAME="gh.exe"
            GH_INSTALL_PATH="${INSTALL_DIR}/gh.exe"
        else
            GH_ARCHIVE_EXT="tar.gz"
            GH_BINARY_NAME="gh"
            GH_INSTALL_PATH="${INSTALL_DIR}/gh"
        fi
        GH_LATEST_VERSION=$(curl -fsSL "https://api.github.com/repos/${GH_REPO}/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
        if [ -z "${GH_LATEST_VERSION}" ]; then
            echo "Failed to fetch latest GitHub CLI version"
            exit 1
        fi
        GH_VERSION_NUMBER=$(echo "${GH_LATEST_VERSION}" | sed 's/^v//')
        GH_FILENAME="gh_${GH_VERSION_NUMBER}_${GH_OS}_${GH_ARCH}.${GH_ARCHIVE_EXT}"
        GH_DOWNLOAD_URL="https://github.com/${GH_REPO}/releases/download/${GH_LATEST_VERSION}/${GH_FILENAME}"
        echo "Downloading ${GH_FILENAME}..."
        GH_TMP_DIR=$(mktemp -d)
        cd "${GH_TMP_DIR}"
        curl -fsSL "${GH_DOWNLOAD_URL}" -o gh-archive
        verify_attestation "gh-archive" "${GH_REPO}" ".github/workflows/release.yml"
        if [ "${GH_ARCHIVE_EXT}" = "tar.gz" ]; then
            tar -xzf gh-archive
        else
            unzip -q gh-archive
        fi
        GH_EXTRACTED_DIR=$(find . -maxdepth 1 -type d -name "gh_*" | head -n 1)
        if [ -z "${GH_EXTRACTED_DIR}" ]; then
            echo "Error: Could not find extracted GitHub CLI directory"
            exit 1
        fi
        GH_BINARY_PATH="${GH_EXTRACTED_DIR}/bin/${GH_BINARY_NAME}"
        if [ ! -f "${GH_BINARY_PATH}" ]; then
            echo "Error: GitHub CLI binary not found in archive"
            exit 1
        fi
        cp "${GH_BINARY_PATH}" "${GH_INSTALL_PATH}"
        chmod +x "${GH_INSTALL_PATH}"
        echo "✓ GitHub CLI ${GH_LATEST_VERSION} installed to ${GH_INSTALL_PATH}"
        GH_BINARY="${GH_INSTALL_PATH}"
        cd "${ORIGINAL_DIR}"
    }

    # Construct the env0 deployment URL for the ticket-link
    ticket_link="https://app.env0.com/p/${ENV0_PROJECT_ID}/environments/${ENV0_ENVIRONMENT_ID}/deployments/${ENV0_DEPLOYMENT_LOG_ID}?organizationId=${ENV0_ORGANIZATION_ID}"

    # Override ticket_link with a stable MR/PR URL when available,
    # so Overmind deduplicates changes within the same MR/PR
    if [ -n "${ENV0_PR_NUMBER}" ]; then
        REPO_URL=""
        if [ -n "${ENV0_PR_SOURCE_REPOSITORY}" ]; then
            REPO_URL="${ENV0_PR_SOURCE_REPOSITORY}"
        elif [ -n "${ENV0_TEMPLATE_REPOSITORY}" ]; then
            REPO_URL="${ENV0_TEMPLATE_REPOSITORY}"
        fi
        if [ -n "${REPO_URL}" ]; then
            REPO_URL=$(echo "${REPO_URL}" | sed 's|\.git$||')
            ticket_link="${REPO_URL}/-/merge_requests/${ENV0_PR_NUMBER}"
        fi
    fi

    # Build description from env0 deployment info
    description="Env0 Deployment: ${ENV0_PROJECT_NAME} - ${ENV0_ENVIRONMENT_NAME} (${ENV0_DEPLOYMENT_TYPE})"
    if [ -n "${ENV0_DEPLOYER_NAME}" ]; then
        description="${description} by ${ENV0_DEPLOYER_NAME}"
    fi

    # Build title from env0 deployment info
    title="${ENV0_PROJECT_NAME} - ${ENV0_ENVIRONMENT_NAME}"
    if [ -n "${ENV0_TEMPLATE_NAME}" ]; then
        title="${ENV0_TEMPLATE_NAME} (${ENV0_ENVIRONMENT_NAME})"
    fi

    # Execute the appropriate action based on input
    case "${inputs.action}" in
        submit-plan)
            _skip_after_approval="${inputs.skip_after_approval}"
            _skip_after_approval=$(echo "${_skip_after_approval:-true}" | tr '[:upper:]' '[:lower:]')
            case "${_skip_after_approval}" in
                true|false) ;;
                *) echo "Error: skip_after_approval must be 'true' or 'false'"; exit 1 ;;
            esac
            if [ "${_skip_after_approval}" = "true" ] && [ -n "${ENV0_REVIEWER_NAME}" ]; then
                echo "Skipping submit-plan: deployment past approval (ENV0_REVIEWER_NAME=${ENV0_REVIEWER_NAME}). Set skip_after_approval=false to override."
                exit 0
            fi
            if [ -z "${ENV0_TF_PLAN_JSON}" ]; then
                echo "Error: ENV0_TF_PLAN_JSON environment variable is not set"
                exit 1
            fi
            echo "Submitting plan to Overmind..."

            # Generate code changes diff if in a git repository
            DIFF_FILE=""
            if [ -d "${ENV0_TEMPLATE_DIR}/.git" ] && [ -n "${ENV0_TEMPLATE_REVISION}" ]; then
                cd "${ENV0_TEMPLATE_DIR}"
                if git rev-parse HEAD~1 >/dev/null 2>&1; then
                    DIFF_FILE=$(mktemp)
                    git diff HEAD~1 HEAD > "${DIFF_FILE}" 2>/dev/null || true
                    if [ ! -s "${DIFF_FILE}" ]; then
                        rm -f "${DIFF_FILE}"
                        DIFF_FILE=""
                    fi
                fi
            fi

            # Find terraform plan output file if it exists
            PLAN_OUTPUT=""
            if [ -f "${ENV0_TEMPLATE_DIR}/.tf-plan-output" ]; then
                PLAN_OUTPUT="${ENV0_TEMPLATE_DIR}/.tf-plan-output"
            elif [ -f "${ENV0_ROOT_DIR}/.tf-plan-output" ]; then
                PLAN_OUTPUT="${ENV0_ROOT_DIR}/.tf-plan-output"
            fi

            # Determine owner (prefer name over email)
            OWNER=""
            if [ -n "${ENV0_DEPLOYER_NAME}" ]; then
                OWNER="${ENV0_DEPLOYER_NAME}"
            elif [ -n "${ENV0_DEPLOYER_EMAIL}" ]; then
                OWNER="${ENV0_DEPLOYER_EMAIL}"
            fi

            # Build submit-plan command with all available information
            set -- "${INSTALL_DIR}/overmind" changes submit-plan \
                "${ENV0_TF_PLAN_JSON}" \
                --title "${title}" \
                --description "${description}" \
                --ticket-link "${ticket_link}"
            if [ -n "${inputs.app}" ]; then
                set -- "$@" --app "${inputs.app}"
            fi
            if [ -n "${ENV0_TEMPLATE_REPOSITORY}" ]; then
                set -- "$@" --repo "${ENV0_TEMPLATE_REPOSITORY}"
            fi
            if [ -n "${OWNER}" ]; then
                set -- "$@" --owner "${OWNER}"
            fi
            if [ -n "${inputs.tags}" ]; then
                set -- "$@" --tags "${inputs.tags}"
            fi
            if [ -n "${PLAN_OUTPUT}" ]; then
                set -- "$@" --terraform-plan-output "${PLAN_OUTPUT}"
            fi
            if [ -n "${DIFF_FILE}" ]; then
                set -- "$@" --code-changes-diff "${DIFF_FILE}"
            fi
            if [ -n "${inputs.change_analysis_target_duration}" ]; then
                set -- "$@" --change-analysis-target-duration "${inputs.change_analysis_target_duration}"
            fi
            if [ -n "${inputs.blast_radius_link_depth}" ]; then
                set -- "$@" --blast-radius-link-depth "${inputs.blast_radius_link_depth}"
            fi
            if [ -n "${inputs.blast_radius_max_items}" ]; then
                set -- "$@" --blast-radius-max-items "${inputs.blast_radius_max_items}"
            fi
            if [ -n "${inputs.timeout}" ]; then
                set -- "$@" --timeout "${inputs.timeout}"
            fi
            "$@"

            # Clean up diff file if created
            if [ -n "${DIFF_FILE}" ] && [ -f "${DIFF_FILE}" ]; then
                rm -f "${DIFF_FILE}"
            fi
            ;;
        start-change)
            echo "Starting change in Overmind..."
            set -- "${INSTALL_DIR}/overmind" changes start-change \
                --ticket-link "${ticket_link}"
            if [ -n "${inputs.app}" ]; then
                set -- "$@" --app "${inputs.app}"
            fi
            if [ "$(echo "${inputs.wait_for_snapshot}" | tr '[:upper:]' '[:lower:]')" = "true" ]; then
                set -- "$@" --wait-for-snapshot
            fi
            if [ -n "${inputs.timeout}" ]; then
                set -- "$@" --timeout "${inputs.timeout}"
            fi
            "$@"
            ;;
        end-change)
            echo "Ending change in Overmind..."
            set -- "${INSTALL_DIR}/overmind" changes end-change \
                --ticket-link "${ticket_link}"
            if [ -n "${inputs.app}" ]; then
                set -- "$@" --app "${inputs.app}"
            fi
            if [ -n "${inputs.timeout}" ]; then
                set -- "$@" --timeout "${inputs.timeout}"
            fi
            "$@"
            ;;
        wait-for-simulation)
            echo "Waiting for Overmind simulation and commenting on PR/MR..."
            should_post_comment="${inputs.post_comment}"
            if [ -n "${should_post_comment}" ]; then
                should_post_comment=$(echo "${should_post_comment}" | tr '[:upper:]' '[:lower:]')
                case "${should_post_comment}" in
                    true|false) ;;
                    *)
                        echo "Error: post_comment must be 'true' or 'false'"
                        exit 1
                        ;;
                esac
            else
                if [ -n "${ENV0_PR_NUMBER}" ]; then
                    should_post_comment="true"
                else
                    should_post_comment="false"
                fi
            fi

            MARKDOWN_FILE=$(mktemp)
            set -- "${INSTALL_DIR}/overmind" changes get-change \
                --ticket-link "${ticket_link}" \
                --format markdown
            if [ -n "${inputs.app}" ]; then
                set -- "$@" --app "${inputs.app}"
            fi
            if [ -n "${inputs.risk_levels}" ]; then
                set -- "$@" --risk-levels "${inputs.risk_levels}"
            fi
            if [ -n "${inputs.timeout}" ]; then
                set -- "$@" --timeout "${inputs.timeout}"
            fi
            if ! "$@" > "${MARKDOWN_FILE}"; then
                echo "Error: Failed to retrieve change markdown from Overmind"
                exit 1
            fi

            if [ ! -s "${MARKDOWN_FILE}" ]; then
                echo "Error: Overmind did not return any markdown content"
                exit 1
            fi

            if [ "${should_post_comment}" = "true" ]; then
                if [ -z "${ENV0_PR_NUMBER}" ]; then
                    echo "Error: ENV0_PR_NUMBER environment variable is not set but post_comment=true"
                    exit 1
                fi

                comment_provider=$(echo "${inputs.comment_provider}" | tr '[:upper:]' '[:lower:]')
                if [ -z "${comment_provider}" ]; then
                    echo "Error: comment_provider input must be set to 'github' or 'gitlab' when post_comment=true"
                    exit 1
                fi

                case "${comment_provider}" in
                    gitlab)
                        # GitLab merge request — update existing Overmind note when possible
                        OVERMIND_MARKER='<!-- overmind-change-summary -->'
                        if ! grep -qF "${OVERMIND_MARKER}" "${MARKDOWN_FILE}"; then
                            echo "Warning: Overmind markdown lacks ${OVERMIND_MARKER}; appending it so this plugin can find and update this MR comment on future runs."
                            printf '\n\n%s\n' "${OVERMIND_MARKER}" >> "${MARKDOWN_FILE}"
                        fi

                        # Fall back to ENV0_TEMPLATE_REPOSITORY for self-hosted GitLab
                        # where ENV0_PR_SOURCE_REPOSITORY is not available
                        if [ -n "${ENV0_PR_SOURCE_REPOSITORY}" ]; then
                            REPO_STR="${ENV0_PR_SOURCE_REPOSITORY}"
                        elif [ -n "${ENV0_TEMPLATE_REPOSITORY}" ]; then
                            REPO_STR="${ENV0_TEMPLATE_REPOSITORY}"
                        else
                            echo "Error: Neither ENV0_PR_SOURCE_REPOSITORY nor ENV0_TEMPLATE_REPOSITORY is set"
                            exit 1
                        fi

                        # Fall back to ENV0_VCS_ACCESS_TOKEN for self-hosted GitLab
                        GITLAB_TOKEN="${GITLAB_TOKEN:-${ENV0_VCS_ACCESS_TOKEN}}"
                        if [ -z "${GITLAB_TOKEN}" ]; then
                            echo "Error: Neither GITLAB_TOKEN nor ENV0_VCS_ACCESS_TOKEN is set"
                            exit 1
                        fi

                        # Remove protocol and trailing .git if present
                        REPO_STR=$(echo "${REPO_STR}" | sed 's|^https\?://||')
                        REPO_STR=$(echo "${REPO_STR}" | sed 's|\.git$||')

                        # Extract host (default to gitlab.com if not specified)
                        if echo "${REPO_STR}" | grep -q "/"; then
                            GITLAB_HOST=$(echo "${REPO_STR}" | cut -d'/' -f1)
                            PROJECT_PATH=$(echo "${REPO_STR}" | cut -d'/' -f2-)
                        else
                            # If no host, assume gitlab.com
                            GITLAB_HOST="gitlab.com"
                            PROJECT_PATH="${REPO_STR}"
                        fi

                        # Ensure we have https:// prefix for API calls
                        if [ "${GITLAB_HOST}" != "gitlab.com" ] && ! echo "${GITLAB_HOST}" | grep -q "^https\?://"; then
                            GITLAB_BASE_URL="https://${GITLAB_HOST}"
                        elif [ "${GITLAB_HOST}" = "gitlab.com" ]; then
                            GITLAB_BASE_URL="https://gitlab.com"
                        else
                            GITLAB_BASE_URL="${GITLAB_HOST}"
                        fi

                        # URL encode the project path (handle spaces and special chars)
                        PROJECT_PATH_ENCODED=$(echo "${PROJECT_PATH}" | sed 's|/|%2F|g' | sed 's| |%20|g')

                        MR_IID="${ENV0_PR_NUMBER}"
                        API_URL="${GITLAB_BASE_URL}/api/v4/projects/${PROJECT_PATH_ENCODED}/merge_requests/${MR_IID}/notes"

                        GITLAB_USER_FILE=$(mktemp)
                        if ! curl -fsSL \
                            -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                            "${GITLAB_BASE_URL}/api/v4/user" \
                            -o "${GITLAB_USER_FILE}"; then
                            echo "Error: GitLab GET /api/v4/user failed (check token and ${GITLAB_BASE_URL})"
                            rm -f "${GITLAB_USER_FILE}"
                            GITLAB_USER_FILE=""
                            exit 1
                        fi
                        if ! GITLAB_USER_ID=$(jq -e -r '.id' "${GITLAB_USER_FILE}"); then
                            echo "Error: GitLab /user response missing id (bad token or wrong API URL?)"
                            rm -f "${GITLAB_USER_FILE}"
                            GITLAB_USER_FILE=""
                            exit 1
                        fi
                        rm -f "${GITLAB_USER_FILE}"
                        GITLAB_USER_FILE=""

                        echo "Posting simulation results to GitLab MR ${PROJECT_PATH}!${MR_IID}..."

                        page=1
                        per_page=100
                        NOTE_ID=""
                        while true; do
                            GITLAB_NOTES_PAGE_FILE=$(mktemp)
                            http_notes=$(curl -sS -o "${GITLAB_NOTES_PAGE_FILE}" -w "%{http_code}" \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                "${API_URL}?per_page=${per_page}&page=${page}&sort=desc&order_by=created_at")
                            if [ "${http_notes}" != "200" ]; then
                                echo "Error: Failed to list GitLab MR notes (HTTP ${http_notes})"
                                rm -f "${GITLAB_NOTES_PAGE_FILE}"
                                GITLAB_NOTES_PAGE_FILE=""
                                exit 1
                            fi
                            MATCH_ID=$(jq -r \
                                --argjson uid "${GITLAB_USER_ID}" \
                                --arg marker "${OVERMIND_MARKER}" \
                                '[.[] | select(.system == false and .author.id == $uid and (.body | type == "string") and (.body | contains($marker)))] | if length > 0 then .[0].id | tostring else empty end' \
                                "${GITLAB_NOTES_PAGE_FILE}")
                            notes_count=$(jq 'length' "${GITLAB_NOTES_PAGE_FILE}")
                            rm -f "${GITLAB_NOTES_PAGE_FILE}"
                            GITLAB_NOTES_PAGE_FILE=""

                            if [ -n "${MATCH_ID}" ]; then
                                NOTE_ID="${MATCH_ID}"
                                break
                            fi
                            if [ "${notes_count}" -eq 0 ]; then
                                break
                            fi
                            if [ "${notes_count}" -lt "${per_page}" ]; then
                                break
                            fi
                            page=$((page + 1))
                        done

                        gitlab_post_json_body() {
                            _target_file="$1"
                            jq -n --rawfile body "${MARKDOWN_FILE}" '{body: $body}' > "${_target_file}"
                        }

                        gitlab_post_fallback_note() {
                            put_code="$1"
                            echo "Warning: Could not update GitLab MR note ${NOTE_ID} (HTTP ${put_code}); posting a new comment with an explanatory banner."
                            GITLAB_FALLBACK_BODY_FILE=$(mktemp)
                            {
                                printf '%s\n\n' "Overmind env0 plugin: could not update existing MR note (HTTP ${put_code}). A new comment was posted below; you may remove duplicate threads manually."
                                cat "${MARKDOWN_FILE}"
                            } > "${GITLAB_FALLBACK_BODY_FILE}"
                            JSON_PAYLOAD_FILE=$(mktemp)
                            jq -n --rawfile body "${GITLAB_FALLBACK_BODY_FILE}" '{body: $body}' > "${JSON_PAYLOAD_FILE}"
                            rm -f "${GITLAB_FALLBACK_BODY_FILE}"
                            GITLAB_FALLBACK_BODY_FILE=""
                            HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                -H "Content-Type: application/json" \
                                --data-binary "@${JSON_PAYLOAD_FILE}" \
                                "${API_URL}")
                            rm -f "${JSON_PAYLOAD_FILE}"
                            JSON_PAYLOAD_FILE=""
                            if [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
                                echo "✓ Simulation results posted to GitLab MR (fallback after failed update)"
                            else
                                echo "Error: Failed to post fallback comment to GitLab MR (HTTP ${HTTP_CODE})"
                                exit 1
                            fi
                        }

                        if [ -n "${NOTE_ID}" ]; then
                            JSON_PAYLOAD_FILE=$(mktemp)
                            gitlab_post_json_body "${JSON_PAYLOAD_FILE}"
                            put_code=$(curl -sS -o /dev/null -w "%{http_code}" -X PUT \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                -H "Content-Type: application/json" \
                                --data-binary "@${JSON_PAYLOAD_FILE}" \
                                "${API_URL}/${NOTE_ID}")
                            rm -f "${JSON_PAYLOAD_FILE}"
                            JSON_PAYLOAD_FILE=""
                            if [ "${put_code}" -ge 200 ] && [ "${put_code}" -lt 300 ]; then
                                echo "✓ Simulation results updated on GitLab MR (note ${NOTE_ID})"
                            else
                                gitlab_post_fallback_note "${put_code}"
                            fi
                        else
                            JSON_PAYLOAD_FILE=$(mktemp)
                            gitlab_post_json_body "${JSON_PAYLOAD_FILE}"
                            HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                -H "Content-Type: application/json" \
                                --data-binary "@${JSON_PAYLOAD_FILE}" \
                                "${API_URL}")
                            rm -f "${JSON_PAYLOAD_FILE}"
                            JSON_PAYLOAD_FILE=""
                            if [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
                                echo "✓ Simulation results posted to GitLab MR"
                            else
                                echo "Error: Failed to post comment to GitLab MR (HTTP ${HTTP_CODE})"
                                exit 1
                            fi
                        fi
                        ;;
                    github)
                        if [ -z "${ENV0_PR_SOURCE_REPOSITORY}" ]; then
                            echo "Error: ENV0_PR_SOURCE_REPOSITORY environment variable is not set but comment_provider=github"
                            exit 1
                        fi

                        install_github_cli

                        # GitHub pull request
                        if [ -z "${GH_BINARY}" ] || [ ! -x "${GH_BINARY}" ]; then
                            echo "Error: GitHub CLI was not installed correctly"
                            exit 1
                        fi

                        if ! "${GH_BINARY}" auth status >/dev/null 2>&1; then
                            echo "Warning: GitHub CLI authentication not detected. Ensure GH_TOKEN is configured."
                        fi

                        echo "Posting simulation results to ${ENV0_PR_SOURCE_REPOSITORY}#${ENV0_PR_NUMBER}..."
                        "${GH_BINARY}" pr comment "${ENV0_PR_NUMBER}" \
                            --repo "${ENV0_PR_SOURCE_REPOSITORY}" \
                            --body-file "${MARKDOWN_FILE}"
                        echo "✓ Simulation results posted to GitHub PR"
                        ;;
                    *)
                        echo "Error: comment_provider input must be 'github' or 'gitlab' when post_comment=true"
                        exit 1
                        ;;
                esac
            else
                if [ -n "${ENV0_PR_NUMBER}" ]; then
                    echo "Skipping comment because post_comment=false."
                else
                    echo "Skipping comment because ENV0_PR_NUMBER is not set."
                fi
            fi
            ;;
        *)
            echo "Error: Invalid action '${inputs.action}'. Must be one of: submit-plan, start-change, end-change, wait-for-simulation"
            exit 1
            ;;
    esac
    }
    if [ "${ON_FAILURE}" = "pass" ]; then
        ( main_script )
        rc=$?
        if [ "${rc}" -eq "${ATTESTATION_FAIL_EXIT}" ]; then
            echo "Supply-chain verification failed (exit ${rc}); refusing to honor on_failure=pass." >&2
            exit "${rc}"
        elif [ "${rc}" -ne 0 ]; then
            echo "Plugin step failed (on_failure=pass); deployment will continue."
            exit 0
        fi
    else
        main_script
    fi