env0.plugin.yaml

name: Overmind
icon: https://avatars.githubusercontent.com/u/93521445
inputs:
  action:
    description: 'The action to perform. Must be one of: submit-plan, start-change, end-change, wait-for-simulation'
    required: true
  api_key:
    description: 'Overmind API key for authentication'
    required: true
  tags:
    description: 'A comma-separated list of key=value tags to attach to the change (only used with submit-plan action)'
    required: false
  app:
    description: 'The Overmind instance to connect to (defaults to https://app.overmind.tech)'
    required: false
  post_comment:
    description: 'Whether wait-for-simulation should post the Overmind markdown to the PR/MR. Defaults to true when ENV0_PR_NUMBER is set, otherwise false. When true, comment_provider must be set.'
    required: false
  comment_provider:
    description: 'Where to post PR/MR comments when wait-for-simulation runs with post_comment=true. Must be one of: github, gitlab.'
    required: false
  on_failure:
    description: "Behavior when an error occurs. 'fail' (default) fails the plugin step and blocks the deployment; 'pass' allows the deployment to continue even if this step errors."
    required: false
run:
  exec: |
    #!/bin/sh

    _on_failure="${inputs.on_failure}"
    ON_FAILURE="${_on_failure:-fail}"
    ON_FAILURE=$(echo "${ON_FAILURE}" | tr '[:upper:]' '[:lower:]')
    case "${ON_FAILURE}" in
        pass|fail) ;;
        *) echo "Error: on_failure must be 'pass' or 'fail'"; exit 1 ;;
    esac

    cleanup() {
        if [ -n "${TMP_DIR}" ] && [ -d "${TMP_DIR}" ]; then
            rm -rf "${TMP_DIR}"
        fi
        if [ -n "${GH_TMP_DIR}" ] && [ -d "${GH_TMP_DIR}" ]; then
            rm -rf "${GH_TMP_DIR}"
        fi
        if [ -n "${MARKDOWN_FILE}" ] && [ -f "${MARKDOWN_FILE}" ]; then
            rm -f "${MARKDOWN_FILE}"
        fi
        if [ -n "${JSON_PAYLOAD_FILE}" ] && [ -f "${JSON_PAYLOAD_FILE}" ]; then
            rm -f "${JSON_PAYLOAD_FILE}"
        fi
        if [ -n "${GITLAB_NOTES_PAGE_FILE}" ] && [ -f "${GITLAB_NOTES_PAGE_FILE}" ]; then
            rm -f "${GITLAB_NOTES_PAGE_FILE}"
        fi
        if [ -n "${GITLAB_FALLBACK_BODY_FILE}" ] && [ -f "${GITLAB_FALLBACK_BODY_FILE}" ]; then
            rm -f "${GITLAB_FALLBACK_BODY_FILE}"
        fi
        if [ -n "${GITLAB_USER_FILE}" ] && [ -f "${GITLAB_USER_FILE}" ]; then
            rm -f "${GITLAB_USER_FILE}"
        fi
    }
    main_script() {
        set -e
        trap cleanup EXIT
        TMP_DIR=""
        GH_TMP_DIR=""
        GH_BINARY=""
        MARKDOWN_FILE=""
        JSON_PAYLOAD_FILE=""
        GITLAB_NOTES_PAGE_FILE=""
        GITLAB_FALLBACK_BODY_FILE=""
        GITLAB_USER_FILE=""
        ORIGINAL_DIR=$(pwd)

    # Export API key as environment variable
    export OVM_API_KEY="${inputs.api_key}"

    # Install Overmind CLI
    REPO="overmindtech/cli"
    OS=$(uname -s)
    ARCH=$(uname -m)

    case "${ARCH}" in
        x86_64) ARCH="x86_64" ;;
        aarch64|arm64) ARCH="arm64" ;;
        i386|i686) ARCH="i386" ;;
        *) echo "Unsupported architecture: ${ARCH}"; exit 1 ;;
    esac

    case "${OS}" in
        Linux|Darwin) ARCHIVE_EXT="tar.gz" ;;
        MINGW*|MSYS*|CYGWIN*) OS="Windows"; ARCHIVE_EXT="zip" ;;
        *) echo "Unsupported OS: ${OS}"; exit 1 ;;
    esac

    # Function to find a writable directory in PATH
    find_install_dir() {
        IFS=':'
        for dir in $PATH; do
            [ -z "$dir" ] && continue

            # Create directory if it doesn't exist (if parent is writable)
            if [ ! -d "$dir" ]; then
                mkdir -p "$dir" 2>/dev/null || continue
            fi

            # Check if directory is writable
            if [ -w "$dir" ]; then
                echo "$dir"
                unset IFS
                return 0
            fi
        done
        unset IFS
        return 1
    }

    INSTALL_DIR=$(find_install_dir)
    if [ -z "${INSTALL_DIR}" ]; then
        echo "Error: No writable directory found in PATH"
        echo "Current PATH: ${PATH}"
        exit 1
    fi

    echo "Installing to: ${INSTALL_DIR}"
    echo "Downloading latest Overmind release..."

    FILENAME="overmind_cli_${OS}_${ARCH}.${ARCHIVE_EXT}"
    DOWNLOAD_URL="https://github.com/${REPO}/releases/latest/download/${FILENAME}"

    echo "Downloading ${FILENAME}..."
    TMP_DIR=$(mktemp -d)
    cd "${TMP_DIR}"

    curl -fsSL "${DOWNLOAD_URL}" -o archive

    if [ "${ARCHIVE_EXT}" = "tar.gz" ]; then
        tar -xzf archive
    else
        unzip -q archive
    fi

    if [ "${OS}" = "Windows" ]; then
        EXPECTED_BINARY="overmind.exe"
    else
        EXPECTED_BINARY="overmind"
    fi

    if [ -f "${EXPECTED_BINARY}" ]; then
        BINARY="./${EXPECTED_BINARY}"
    else
        BINARY=$(find . -maxdepth 2 -type f -executable -name "overmind*" ! -name "*.txt" ! -name "*.md" ! -name "LICENSE" | head -n 1)
    fi
    if [ -z "${BINARY}" ]; then
        echo "Error: Could not find binary in archive"
        ls -la
        exit 1
    fi

    cp "${BINARY}" "${INSTALL_DIR}/overmind"
    chmod +x "${INSTALL_DIR}/overmind"
    echo "✓ Overmind CLI installed to ${INSTALL_DIR}/overmind"

    # Verify installation
    "${INSTALL_DIR}/overmind" version 2>/dev/null || echo "Installation complete"
    cd "${ORIGINAL_DIR}"

    # Install GitHub CLI only when needed (wait-for-simulation + comment_provider=github)
    install_github_cli() {
        GH_REPO="cli/cli"
        echo "Installing GitHub CLI..."
        case "${ARCH}" in
            x86_64) GH_ARCH="amd64" ;;
            arm64) GH_ARCH="arm64" ;;
            i386) GH_ARCH="386" ;;
            *) echo "Unsupported architecture for GitHub CLI: ${ARCH}"; exit 1 ;;
        esac
        case "${OS}" in
            Linux) GH_OS="linux" ;;
            Darwin) GH_OS="macOS" ;;
            Windows) GH_OS="windows" ;;
            *) echo "Unsupported OS for GitHub CLI: ${OS}"; exit 1 ;;
        esac
        if [ "${OS}" = "Windows" ]; then
            GH_ARCHIVE_EXT="zip"
            GH_BINARY_NAME="gh.exe"
            GH_INSTALL_PATH="${INSTALL_DIR}/gh.exe"
        else
            GH_ARCHIVE_EXT="tar.gz"
            GH_BINARY_NAME="gh"
            GH_INSTALL_PATH="${INSTALL_DIR}/gh"
        fi
        GH_LATEST_VERSION=$(curl -fsSL "https://api.github.com/repos/${GH_REPO}/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
        if [ -z "${GH_LATEST_VERSION}" ]; then
            echo "Failed to fetch latest GitHub CLI version"
            exit 1
        fi
        GH_VERSION_NUMBER=$(echo "${GH_LATEST_VERSION}" | sed 's/^v//')
        GH_FILENAME="gh_${GH_VERSION_NUMBER}_${GH_OS}_${GH_ARCH}.${GH_ARCHIVE_EXT}"
        GH_DOWNLOAD_URL="https://github.com/${GH_REPO}/releases/download/${GH_LATEST_VERSION}/${GH_FILENAME}"
        echo "Downloading ${GH_FILENAME}..."
        GH_TMP_DIR=$(mktemp -d)
        cd "${GH_TMP_DIR}"
        curl -fsSL "${GH_DOWNLOAD_URL}" -o gh-archive
        if [ "${GH_ARCHIVE_EXT}" = "tar.gz" ]; then
            tar -xzf gh-archive
        else
            unzip -q gh-archive
        fi
        GH_EXTRACTED_DIR=$(find . -maxdepth 1 -type d -name "gh_*" | head -n 1)
        if [ -z "${GH_EXTRACTED_DIR}" ]; then
            echo "Error: Could not find extracted GitHub CLI directory"
            exit 1
        fi
        GH_BINARY_PATH="${GH_EXTRACTED_DIR}/bin/${GH_BINARY_NAME}"
        if [ ! -f "${GH_BINARY_PATH}" ]; then
            echo "Error: GitHub CLI binary not found in archive"
            exit 1
        fi
        cp "${GH_BINARY_PATH}" "${GH_INSTALL_PATH}"
        chmod +x "${GH_INSTALL_PATH}"
        echo "✓ GitHub CLI ${GH_LATEST_VERSION} installed to ${GH_INSTALL_PATH}"
        GH_BINARY="${GH_INSTALL_PATH}"
        cd "${ORIGINAL_DIR}"
    }

    # Construct the env0 deployment URL for the ticket-link
    ticket_link="https://app.env0.com/p/${ENV0_PROJECT_ID}/environments/${ENV0_ENVIRONMENT_ID}/deployments/${ENV0_DEPLOYMENT_LOG_ID}?organizationId=${ENV0_ORGANIZATION_ID}"

    # Override ticket_link with a stable MR/PR URL when available,
    # so Overmind deduplicates changes within the same MR/PR
    if [ -n "${ENV0_PR_NUMBER}" ]; then
        REPO_URL=""
        if [ -n "${ENV0_PR_SOURCE_REPOSITORY}" ]; then
            REPO_URL="${ENV0_PR_SOURCE_REPOSITORY}"
        elif [ -n "${ENV0_TEMPLATE_REPOSITORY}" ]; then
            REPO_URL="${ENV0_TEMPLATE_REPOSITORY}"
        fi
        if [ -n "${REPO_URL}" ]; then
            REPO_URL=$(echo "${REPO_URL}" | sed 's|\.git$||')
            ticket_link="${REPO_URL}/-/merge_requests/${ENV0_PR_NUMBER}"
        fi
    fi

    # Build description from env0 deployment info
    description="Env0 Deployment: ${ENV0_PROJECT_NAME} - ${ENV0_ENVIRONMENT_NAME} (${ENV0_DEPLOYMENT_TYPE})"
    if [ -n "${ENV0_DEPLOYER_NAME}" ]; then
        description="${description} by ${ENV0_DEPLOYER_NAME}"
    fi

    # Build title from env0 deployment info
    title="${ENV0_PROJECT_NAME} - ${ENV0_ENVIRONMENT_NAME}"
    if [ -n "${ENV0_TEMPLATE_NAME}" ]; then
        title="${ENV0_TEMPLATE_NAME} (${ENV0_ENVIRONMENT_NAME})"
    fi

    # Execute the appropriate action based on input
    case "${inputs.action}" in
        submit-plan)
            if [ -z "${ENV0_TF_PLAN_JSON}" ]; then
                echo "Error: ENV0_TF_PLAN_JSON environment variable is not set"
                exit 1
            fi
            echo "Submitting plan to Overmind..."

            # Generate code changes diff if in a git repository
            DIFF_FILE=""
            if [ -d "${ENV0_TEMPLATE_DIR}/.git" ] && [ -n "${ENV0_TEMPLATE_REVISION}" ]; then
                cd "${ENV0_TEMPLATE_DIR}"
                if git rev-parse HEAD~1 >/dev/null 2>&1; then
                    DIFF_FILE=$(mktemp)
                    git diff HEAD~1 HEAD > "${DIFF_FILE}" 2>/dev/null || true
                    if [ ! -s "${DIFF_FILE}" ]; then
                        rm -f "${DIFF_FILE}"
                        DIFF_FILE=""
                    fi
                fi
            fi

            # Find terraform plan output file if it exists
            PLAN_OUTPUT=""
            if [ -f "${ENV0_TEMPLATE_DIR}/.tf-plan-output" ]; then
                PLAN_OUTPUT="${ENV0_TEMPLATE_DIR}/.tf-plan-output"
            elif [ -f "${ENV0_ROOT_DIR}/.tf-plan-output" ]; then
                PLAN_OUTPUT="${ENV0_ROOT_DIR}/.tf-plan-output"
            fi

            # Determine owner (prefer name over email)
            OWNER=""
            if [ -n "${ENV0_DEPLOYER_NAME}" ]; then
                OWNER="${ENV0_DEPLOYER_NAME}"
            elif [ -n "${ENV0_DEPLOYER_EMAIL}" ]; then
                OWNER="${ENV0_DEPLOYER_EMAIL}"
            fi

            # Build submit-plan command with all available information
            set -- "${INSTALL_DIR}/overmind" changes submit-plan \
                "${ENV0_TF_PLAN_JSON}" \
                --title "${title}" \
                --description "${description}" \
                --ticket-link "${ticket_link}"
            if [ -n "${inputs.app}" ]; then
                set -- "$@" --app "${inputs.app}"
            fi
            if [ -n "${ENV0_TEMPLATE_REPOSITORY}" ]; then
                set -- "$@" --repo "${ENV0_TEMPLATE_REPOSITORY}"
            fi
            if [ -n "${OWNER}" ]; then
                set -- "$@" --owner "${OWNER}"
            fi
            if [ -n "${inputs.tags}" ]; then
                set -- "$@" --tags "${inputs.tags}"
            fi
            if [ -n "${PLAN_OUTPUT}" ]; then
                set -- "$@" --terraform-plan-output "${PLAN_OUTPUT}"
            fi
            if [ -n "${DIFF_FILE}" ]; then
                set -- "$@" --code-changes-diff "${DIFF_FILE}"
            fi
            "$@"

            # Clean up diff file if created
            if [ -n "${DIFF_FILE}" ] && [ -f "${DIFF_FILE}" ]; then
                rm -f "${DIFF_FILE}"
            fi
            ;;
        start-change)
            echo "Starting change in Overmind..."
            "${INSTALL_DIR}/overmind" changes start-change \
                --ticket-link "${ticket_link}"
            ;;
        end-change)
            echo "Ending change in Overmind..."
            "${INSTALL_DIR}/overmind" changes end-change \
                --ticket-link "${ticket_link}"
            ;;
        wait-for-simulation)
            echo "Waiting for Overmind simulation and commenting on PR/MR..."
            should_post_comment="${inputs.post_comment}"
            if [ -n "${should_post_comment}" ]; then
                should_post_comment=$(echo "${should_post_comment}" | tr '[:upper:]' '[:lower:]')
                case "${should_post_comment}" in
                    true|false) ;;
                    *)
                        echo "Error: post_comment must be 'true' or 'false'"
                        exit 1
                        ;;
                esac
            else
                if [ -n "${ENV0_PR_NUMBER}" ]; then
                    should_post_comment="true"
                else
                    should_post_comment="false"
                fi
            fi

            MARKDOWN_FILE=$(mktemp)
            set -- "${INSTALL_DIR}/overmind" changes get-change \
                --ticket-link "${ticket_link}" \
                --format markdown
            if [ -n "${inputs.app}" ]; then
                set -- "$@" --app "${inputs.app}"
            fi
            if ! "$@" > "${MARKDOWN_FILE}"; then
                echo "Error: Failed to retrieve change markdown from Overmind"
                exit 1
            fi

            if [ ! -s "${MARKDOWN_FILE}" ]; then
                echo "Error: Overmind did not return any markdown content"
                exit 1
            fi

            if [ "${should_post_comment}" = "true" ]; then
                if [ -z "${ENV0_PR_NUMBER}" ]; then
                    echo "Error: ENV0_PR_NUMBER environment variable is not set but post_comment=true"
                    exit 1
                fi

                comment_provider=$(echo "${inputs.comment_provider}" | tr '[:upper:]' '[:lower:]')
                if [ -z "${comment_provider}" ]; then
                    echo "Error: comment_provider input must be set to 'github' or 'gitlab' when post_comment=true"
                    exit 1
                fi

                case "${comment_provider}" in
                    gitlab)
                        # GitLab merge request — update existing Overmind note when possible
                        OVERMIND_MARKER='<!-- overmind-change-summary -->'
                        if ! grep -qF "${OVERMIND_MARKER}" "${MARKDOWN_FILE}"; then
                            echo "Warning: Overmind markdown lacks ${OVERMIND_MARKER}; appending it so this plugin can find and update this MR comment on future runs."
                            printf '\n\n%s\n' "${OVERMIND_MARKER}" >> "${MARKDOWN_FILE}"
                        fi

                        # Fall back to ENV0_TEMPLATE_REPOSITORY for self-hosted GitLab
                        # where ENV0_PR_SOURCE_REPOSITORY is not available
                        if [ -n "${ENV0_PR_SOURCE_REPOSITORY}" ]; then
                            REPO_STR="${ENV0_PR_SOURCE_REPOSITORY}"
                        elif [ -n "${ENV0_TEMPLATE_REPOSITORY}" ]; then
                            REPO_STR="${ENV0_TEMPLATE_REPOSITORY}"
                        else
                            echo "Error: Neither ENV0_PR_SOURCE_REPOSITORY nor ENV0_TEMPLATE_REPOSITORY is set"
                            exit 1
                        fi

                        # Fall back to ENV0_VCS_ACCESS_TOKEN for self-hosted GitLab
                        GITLAB_TOKEN="${GITLAB_TOKEN:-${ENV0_VCS_ACCESS_TOKEN}}"
                        if [ -z "${GITLAB_TOKEN}" ]; then
                            echo "Error: Neither GITLAB_TOKEN nor ENV0_VCS_ACCESS_TOKEN is set"
                            exit 1
                        fi

                        # Remove protocol and trailing .git if present
                        REPO_STR=$(echo "${REPO_STR}" | sed 's|^https\?://||')
                        REPO_STR=$(echo "${REPO_STR}" | sed 's|\.git$||')

                        # Extract host (default to gitlab.com if not specified)
                        if echo "${REPO_STR}" | grep -q "/"; then
                            GITLAB_HOST=$(echo "${REPO_STR}" | cut -d'/' -f1)
                            PROJECT_PATH=$(echo "${REPO_STR}" | cut -d'/' -f2-)
                        else
                            # If no host, assume gitlab.com
                            GITLAB_HOST="gitlab.com"
                            PROJECT_PATH="${REPO_STR}"
                        fi

                        # Ensure we have https:// prefix for API calls
                        if [ "${GITLAB_HOST}" != "gitlab.com" ] && ! echo "${GITLAB_HOST}" | grep -q "^https\?://"; then
                            GITLAB_BASE_URL="https://${GITLAB_HOST}"
                        elif [ "${GITLAB_HOST}" = "gitlab.com" ]; then
                            GITLAB_BASE_URL="https://gitlab.com"
                        else
                            GITLAB_BASE_URL="${GITLAB_HOST}"
                        fi

                        # URL encode the project path (handle spaces and special chars)
                        PROJECT_PATH_ENCODED=$(echo "${PROJECT_PATH}" | sed 's|/|%2F|g' | sed 's| |%20|g')

                        MR_IID="${ENV0_PR_NUMBER}"
                        API_URL="${GITLAB_BASE_URL}/api/v4/projects/${PROJECT_PATH_ENCODED}/merge_requests/${MR_IID}/notes"

                        GITLAB_USER_FILE=$(mktemp)
                        if ! curl -fsSL \
                            -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                            "${GITLAB_BASE_URL}/api/v4/user" \
                            -o "${GITLAB_USER_FILE}"; then
                            echo "Error: GitLab GET /api/v4/user failed (check token and ${GITLAB_BASE_URL})"
                            rm -f "${GITLAB_USER_FILE}"
                            GITLAB_USER_FILE=""
                            exit 1
                        fi
                        if ! GITLAB_USER_ID=$(jq -e -r '.id' "${GITLAB_USER_FILE}"); then
                            echo "Error: GitLab /user response missing id (bad token or wrong API URL?)"
                            rm -f "${GITLAB_USER_FILE}"
                            GITLAB_USER_FILE=""
                            exit 1
                        fi
                        rm -f "${GITLAB_USER_FILE}"
                        GITLAB_USER_FILE=""

                        echo "Posting simulation results to GitLab MR ${PROJECT_PATH}!${MR_IID}..."

                        page=1
                        per_page=100
                        NOTE_ID=""
                        while true; do
                            GITLAB_NOTES_PAGE_FILE=$(mktemp)
                            http_notes=$(curl -sS -o "${GITLAB_NOTES_PAGE_FILE}" -w "%{http_code}" \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                "${API_URL}?per_page=${per_page}&page=${page}&sort=desc&order_by=created_at")
                            if [ "${http_notes}" != "200" ]; then
                                echo "Error: Failed to list GitLab MR notes (HTTP ${http_notes})"
                                rm -f "${GITLAB_NOTES_PAGE_FILE}"
                                GITLAB_NOTES_PAGE_FILE=""
                                exit 1
                            fi
                            MATCH_ID=$(jq -r \
                                --argjson uid "${GITLAB_USER_ID}" \
                                --arg marker "${OVERMIND_MARKER}" \
                                '[.[] | select(.system == false and .author.id == $uid and (.body | type == "string") and (.body | contains($marker)))] | if length > 0 then .[0].id | tostring else empty end' \
                                "${GITLAB_NOTES_PAGE_FILE}")
                            notes_count=$(jq 'length' "${GITLAB_NOTES_PAGE_FILE}")
                            rm -f "${GITLAB_NOTES_PAGE_FILE}"
                            GITLAB_NOTES_PAGE_FILE=""

                            if [ -n "${MATCH_ID}" ]; then
                                NOTE_ID="${MATCH_ID}"
                                break
                            fi
                            if [ "${notes_count}" -eq 0 ]; then
                                break
                            fi
                            if [ "${notes_count}" -lt "${per_page}" ]; then
                                break
                            fi
                            page=$((page + 1))
                        done

                        gitlab_post_json_body() {
                            _target_file="$1"
                            jq -n --rawfile body "${MARKDOWN_FILE}" '{body: $body}' > "${_target_file}"
                        }

                        gitlab_post_fallback_note() {
                            put_code="$1"
                            echo "Warning: Could not update GitLab MR note ${NOTE_ID} (HTTP ${put_code}); posting a new comment with an explanatory banner."
                            GITLAB_FALLBACK_BODY_FILE=$(mktemp)
                            {
                                printf '%s\n\n' "Overmind env0 plugin: could not update existing MR note (HTTP ${put_code}). A new comment was posted below; you may remove duplicate threads manually."
                                cat "${MARKDOWN_FILE}"
                            } > "${GITLAB_FALLBACK_BODY_FILE}"
                            JSON_PAYLOAD_FILE=$(mktemp)
                            jq -n --rawfile body "${GITLAB_FALLBACK_BODY_FILE}" '{body: $body}' > "${JSON_PAYLOAD_FILE}"
                            rm -f "${GITLAB_FALLBACK_BODY_FILE}"
                            GITLAB_FALLBACK_BODY_FILE=""
                            HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                -H "Content-Type: application/json" \
                                --data-binary "@${JSON_PAYLOAD_FILE}" \
                                "${API_URL}")
                            rm -f "${JSON_PAYLOAD_FILE}"
                            JSON_PAYLOAD_FILE=""
                            if [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
                                echo "✓ Simulation results posted to GitLab MR (fallback after failed update)"
                            else
                                echo "Error: Failed to post fallback comment to GitLab MR (HTTP ${HTTP_CODE})"
                                exit 1
                            fi
                        }

                        if [ -n "${NOTE_ID}" ]; then
                            JSON_PAYLOAD_FILE=$(mktemp)
                            gitlab_post_json_body "${JSON_PAYLOAD_FILE}"
                            put_code=$(curl -sS -o /dev/null -w "%{http_code}" -X PUT \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                -H "Content-Type: application/json" \
                                --data-binary "@${JSON_PAYLOAD_FILE}" \
                                "${API_URL}/${NOTE_ID}")
                            rm -f "${JSON_PAYLOAD_FILE}"
                            JSON_PAYLOAD_FILE=""
                            if [ "${put_code}" -ge 200 ] && [ "${put_code}" -lt 300 ]; then
                                echo "✓ Simulation results updated on GitLab MR (note ${NOTE_ID})"
                            else
                                gitlab_post_fallback_note "${put_code}"
                            fi
                        else
                            JSON_PAYLOAD_FILE=$(mktemp)
                            gitlab_post_json_body "${JSON_PAYLOAD_FILE}"
                            HTTP_CODE=$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
                                -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
                                -H "Content-Type: application/json" \
                                --data-binary "@${JSON_PAYLOAD_FILE}" \
                                "${API_URL}")
                            rm -f "${JSON_PAYLOAD_FILE}"
                            JSON_PAYLOAD_FILE=""
                            if [ "${HTTP_CODE}" -ge 200 ] && [ "${HTTP_CODE}" -lt 300 ]; then
                                echo "✓ Simulation results posted to GitLab MR"
                            else
                                echo "Error: Failed to post comment to GitLab MR (HTTP ${HTTP_CODE})"
                                exit 1
                            fi
                        fi
                        ;;
                    github)
                        if [ -z "${ENV0_PR_SOURCE_REPOSITORY}" ]; then
                            echo "Error: ENV0_PR_SOURCE_REPOSITORY environment variable is not set but comment_provider=github"
                            exit 1
                        fi

                        install_github_cli

                        # GitHub pull request
                        if [ -z "${GH_BINARY}" ] || [ ! -x "${GH_BINARY}" ]; then
                            echo "Error: GitHub CLI was not installed correctly"
                            exit 1
                        fi

                        if ! "${GH_BINARY}" auth status >/dev/null 2>&1; then
                            echo "Warning: GitHub CLI authentication not detected. Ensure GH_TOKEN is configured."
                        fi

                        echo "Posting simulation results to ${ENV0_PR_SOURCE_REPOSITORY}#${ENV0_PR_NUMBER}..."
                        "${GH_BINARY}" pr comment "${ENV0_PR_NUMBER}" \
                            --repo "${ENV0_PR_SOURCE_REPOSITORY}" \
                            --body-file "${MARKDOWN_FILE}"
                        echo "✓ Simulation results posted to GitHub PR"
                        ;;
                    *)
                        echo "Error: comment_provider input must be 'github' or 'gitlab' when post_comment=true"
                        exit 1
                        ;;
                esac
            else
                if [ -n "${ENV0_PR_NUMBER}" ]; then
                    echo "Skipping comment because post_comment=false."
                else
                    echo "Skipping comment because ENV0_PR_NUMBER is not set."
                fi
            fi
            ;;
        *)
            echo "Error: Invalid action '${inputs.action}'. Must be one of: submit-plan, start-change, end-change, wait-for-simulation"
            exit 1
            ;;
    esac
    }
    if [ "${ON_FAILURE}" = "pass" ]; then
        ( main_script ) || { echo "Plugin step failed (on_failure=pass); deployment will continue."; exit 0; }
    else
        main_script
    fi