# Plan: GHA CI Executor — macOS Build + Peekaboo

**Date**: 2026-05-14
**Status**: Planning

## Goal

Migrate executor workers from Eagle's local Mac to GitHub Actions macOS runners:
- Each task spawns a GHA job
- Job installs Claude Code + Peekaboo + builds the app
- Executor (Claude Code) runs the fix, opens PR, posts report to Asana
- Eagle orchestrates: queues task → triggers GHA → monitors job → handles result

## Architecture

```
Eagle (orchestrator) → triggers GHA workflow via gh CLI
                                    ↓
                    GHA macOS runner (macos-15-xlarge or self-hosted)
                                    ↓
                    Install: Xcode, Claude Code, Peekaboo, Simulator
                                    ↓
                    claude -p executor-worker.md  (non-interactive)
                                    ↓
                    Claude Code: fix → build → UI test via Peekaboo → PR
                                    ↓
                    Post result to Asana (gh pr comment + asana-bot)
```

## Analysis Agent (Cloud-side)

Separate from the executor worker:
- Runs in Claude Cloud (or Eagle's Mac)
- Picks task tagged "обработать" from Asana
- Reads full task context (description, stories, user reports)
- Generates detailed executor prompt (investigation plan + acceptance criteria)
- Triggers GHA workflow with this prompt as input

## GHA Workflow Design

```yaml
name: Executor Worker
on:
  workflow_dispatch:
    inputs:
      task_gid:
        description: 'Asana task GID'
      executor_prompt:
        description: 'Base64-encoded executor prompt'
      branch_name:
        description: 'Git branch to create'

jobs:
  executor:
    runs-on: macos-15  # or self-hosted M-series
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v4
      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code
      - name: Install Peekaboo
        run: # brew install or download binary
      - name: Bootstrap Xcode
        run: # select Xcode version, accept license
      - name: Run Executor
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_CI_KEY }}
          ASANA_TOKEN: ${{ secrets.ASANA_CI_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "${{ inputs.executor_prompt }}" | base64 -d > /tmp/prompt.md
          claude -p /tmp/prompt.md \
            --branch "${{ inputs.branch_name }}" \
            --no-interactive
      - name: Post Result
        if: always()
        run: # Post summary to Asana task + open PR if not already
```

## Key Questions to Investigate

1. **macOS runner availability**: GitHub-hosted `macos-15` or `macos-15-xlarge`?
   - Large runners cost more but needed for Xcode + Simulator
   - Self-hosted M4 Mac runner on Eagle itself? (no cloud cost but uses Eagle)

2. **Peekaboo on GHA**: Does Peekaboo work on GHA macOS runners?
   - Needs Screen Recording permission → headless runner may not grant it
   - Alternative: use `xcrun simctl` directly for UI tests
   - Or: spin up VM via ddg-vm (if GHA runner has the VM tool)

3. **Build time**: Full prod build on GHA macos-15?
   - Estimated 15-30 min cold, 5-10 min with cache
   - DerivedData caching via `actions/cache` is critical

4. **Claude Code non-interactive**: Does `claude -p` (non-interactive) work for complex fix tasks?
   - Yes — `claude -p` is the standard non-interactive mode
   - Needs `--dangerously-skip-permissions` or pre-approved tool config

5. **Secrets**: Need in GHA:
   - `ANTHROPIC_CI_KEY` — separate key for CI (not user key)
   - `ASANA_CI_TOKEN` — for posting results
   - `GITHUB_TOKEN` — auto-provided

## Validation Steps

Before full implementation:
1. Test prod build on `macos-15` runner: does it succeed without signing?
2. Test Peekaboo install + basic screenshot on GHA runner
3. Test `claude -p` with a simple prompt on GHA runner
4. Verify DerivedData caching works (build time < 10 min cached)

## Phased Implementation

### Phase 1: Validation (1-2 days)
- Create a test GHA workflow that: checks out repo, builds, runs basic UI test
- Verify Peekaboo accessibility permissions on headless runner
- Document what works / what doesn't

### Phase 2: Claude Code Integration (2-3 days)
- Add Claude Code step to workflow
- Test with a trivial fix prompt
- Verify PR creation from GHA bot context

### Phase 3: Analysis Agent (3-5 days)
- Cloud-side agent that picks Asana tasks + generates prompts
- Triggers GHA workflow via `gh workflow run`
- Monitors job, posts result to Asana

### Phase 4: Eagle Integration (1 day)
- Eagle can trigger Phase 3 analysis agent on demand
- `#executor` topic shows GHA job status
- Auto-approval for GHA-spawned actions

## Relation to Sentry Bot

Sentry bot pattern (already working):
- Cloud agent monitors Sentry errors
- Generates structured report
- Posts to Asana/Slack

GHA executor follows same pattern:
- Cloud agent picks Asana bug tasks
- Generates fix prompt
- GHA runner executes fix + validation

## Notes

- GHA macos-15 runners do NOT have Xcode pre-cached — each run installs from scratch
- Self-hosted runner on Eagle avoids this but ties up the main Mac
- DuckDuckGo likely has existing GHA macOS setup — check existing workflows first
- Peekaboo may need `tccutil` or System Preferences pre-grant on runner