[Self-Heal] Add self-scheduling auto-repair workflow

.github/self-heal-schedule.yml

@@ -0,0 +1,3 @@
+schedule: "0 0 * * *"
+rationale: "low-churn velocity (>0 commits/wk)"
+last_computed: "2024-05-18T12:00:00.000Z"

.github/workflows/compute-schedule.yml

@@ -0,0 +1,68 @@
+name: Compute Self-Heal Schedule
+
+on:
+  schedule:
+    - cron: "0 0 * * 0" # Runs weekly on Sunday
+  workflow_dispatch:
+
+concurrency:
+  group: compute-schedule-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: read
+
+jobs:
+  compute-schedule:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Compute Optimal Schedule
+        id: compute
+        run: |
+          node scripts/compute_schedule.mjs || true
+
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "has_diff=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_diff=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create Pull Request
+        if: steps.compute.outputs.has_diff == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH_NAME="selfheal-schedule-$(date +%s)"
+          git checkout -b "$BRANCH_NAME"
+
+          git add .github/self-heal-schedule.yml .github/workflows/self-heal.yml
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -m "Auto-update self-heal schedule based on telemetry"
+          git push origin "$BRANCH_NAME"
+
+          gh pr create \
+            --title "[Self-Heal Schedule] Update cadence" \
+            --body "Automated PR created to update the self-healing schedule based on recent repository telemetry. Review the changes before merging." \
+            --label "automation,self-heal-schedule" \
+            --head "$BRANCH_NAME" \
+            --base main

.github/workflows/self-heal.yml

@@ -0,0 +1,129 @@
+name: Self-Heal Pipeline
+
+on:
+  schedule:
+    - cron: "0 0 * * *" # AUTO-UPDATED
+  workflow_dispatch:
+  workflow_run:
+    workflows: ["ci"]
+    types:
+      - completed
+
+concurrency:
+  group: selfheal-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: read
+
+jobs:
+  repair:
+    # 1) Scheduled only on default branch
+    # 2) CI failure reactive trigger
+    # 3) Loop prevention: don't run on selfheal PRs
+    if: >
+      !startsWith(github.ref_name, 'selfheal-') &&
+      ((github.event_name == 'schedule' && github.ref == 'refs/heads/main') ||
+       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'failure') ||
+       github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Check for open self-heal PRs
+        id: check_pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          count=$(gh pr list --label self-heal --state open --json number | jq length)
+          if [ "$count" -gt 0 ]; then
+            echo "An open self-heal PR already exists. Skipping repair."
+            echo "skip=true" >> $GITHUB_OUTPUT
+          else
+            echo "skip=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Pre-Repair Healthcheck
+        if: steps.check_pr.outputs.skip == 'false'
+        id: pre_healthcheck
+        run: |
+          npm ci
+          node scripts/healthcheck.mjs || true
+
+      - name: Execute Self-Healing Repairs
+        if: steps.check_pr.outputs.skip == 'false'
+        id: repair_script
+        run: |
+          node scripts/self_heal.mjs || true
+
+      - name: Post-Repair Checks (Diff & Secrets)
+        if: steps.check_pr.outputs.skip == 'false' && steps.repair_script.outcome == 'success'
+        id: post_checks
+        run: |
+          # Entropy / Secret scanning simple check (don't commit files with "BEGIN .* PRIVATE KEY" etc)
+          git add -A
+          if git diff --cached --unified=0 | grep -E -i '(password|secret|token|api[_-]?key|private[_-]?key)'; then
+             echo "Potential secrets found in diff. Aborting."
+             # Use a safer fail path avoiding exit command in interactive shells when generated but ok in GH action
+             echo "secrets_found=true" >> $GITHUB_OUTPUT
+          else
+             echo "secrets_found=false" >> $GITHUB_OUTPUT
+          fi
+          git reset HEAD
+
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "has_diff=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_diff=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Verify Secrets Scan
+        if: steps.check_pr.outputs.skip == 'false' && steps.post_checks.outputs.secrets_found == 'true'
+        run: |
+          echo "Secrets found, failing job."
+          exit 1
+
+      - name: Create Pull Request
+        if: steps.check_pr.outputs.skip == 'false' && steps.post_checks.outputs.has_diff == 'true' && steps.post_checks.outputs.secrets_found == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH_NAME="selfheal-repair-$(date +%s)"
+          git checkout -b "$BRANCH_NAME"
+
+          # Only stage safe files
+          for path in src/ package.json package-lock.json scripts/ tests/ docs/ tsconfig.json; do
+            git add "$path" 2>/dev/null || true
+          done
+
+          # Ensure .github/workflows/ci.yml is NOT staged
+          git reset HEAD .github/workflows/ci.yml 2>/dev/null || true
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -m "Auto-repair CI failures and code drift"
+          git push origin "$BRANCH_NAME"
+
+          TRIGGER_NAME="Scheduled"
+          if [ "${{ github.event_name }}" == "workflow_run" ]; then TRIGGER_NAME="Reactive"; fi
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then TRIGGER_NAME="Manual"; fi
+
+          gh pr create \
+            --title "[Self-Heal $TRIGGER_NAME] CI fix / code drift repair" \
+            --body "Automated PR created by self-healing pipeline due to $TRIGGER_NAME trigger. Review the changes before merging." \
+            --label "automation,self-heal" \
+            --head "$BRANCH_NAME" \
+            --base main

SELF_HEAL_SETUP.md

@@ -0,0 +1,48 @@
+# Self-Heal Pipeline Setup and Architecture
+
+This document describes the automated, self-adapting, self-healing CI pipeline configured for this repository.
+
+## Components
+
+1. **`scripts/healthcheck.mjs`**: Validates the codebase state via formatting checks, tests, and builds. Exits with 0 if healthy, or 1 if broken.
+2. **`scripts/self_heal.mjs`**: Six idempotent steps applied in sequential order. Checks health after each step and cleanly exits with 0 if it repaired the codebase and generated a diff.
+   - **Step 1**: Rebuild/Reinstall dependencies.
+   - **Step 2**: Lint and format files auto-fix.
+   - **Step 3**: Vitest snapshot updates.
+   - **Step 4**: Fetch updated type stubs using `typesync`.
+   - **Step 5**: Update dependencies.
+   - **Step 6**: Run production build.
+3. **`scripts/compute_schedule.mjs`**: Telemetry script calculating the optimal schedule depending on recent repository commit velocity.
+
+## Triggers
+
+The self-healing pipeline reacts to three primary events:
+1. **Scheduled Runs:** Periodically evaluated via `.github/workflows/self-heal.yml`.
+2. **Reactive (CI Failure):** Executes immediately after a `ci` workflow failure.
+3. **Manual Dispatch:** Can be manually triggered from the Actions tab.
+
+## Telemetry & Schedule Autonomics
+
+The scheduled run's frequency is not hardcoded but dynamically adjusts based on Git commit frequency in the preceding week. The `compute-schedule.yml` workflow recalculates this weekly using `compute_schedule.mjs`, producing a Pull Request if the required cadence shifts due to project activity.
+
+- **High Velocity (> 50 commits/wk):** Every 4 hours.
+- **Active Velocity (> 20 commits/wk):** Every 8 hours.
+- **Standard Velocity (> 5 commits/wk):** Twice daily.
+- **Low-Churn (> 0 commits/wk):** Daily.
+- **Dormant:** Weekly.
+
+## Manual Overrides
+
+If you need to manually enforce a schedule:
+1. Open `.github/self-heal-schedule.yml`.
+2. Modify the `schedule` variable to your desired Cron expression.
+3. Update `.github/workflows/self-heal.yml` to match if the auto-update scripts were bypassing.
+
+*Note: Ensure yaml is perfectly valid when modifying the metadata file, and avoid using raw `sed` across the files as the schedule mutator explicitly checks for a parseable round-trip state before replacing the `# AUTO-UPDATED` marker.*
+
+## Reviewer Checklist
+
+When reviewing a PR from this automation:
+- Check that the PR modifies safe targets (e.g., formatting, snapshots, lockfiles) and doesn't inject logic changes.
+- Verify `healthcheck` success on the PR artifact context.
+- Keep in mind the bot will not merge automatically; a human reviewer is strictly required.