review.yaml

name: Inspector — Review and Merge Automated PRs

# Triggered when the self-improvement workflow finishes. A second local model
# (Inspector Clementine Zestworth) investigates the resulting PR and merges it
# only if it passes scrutiny AND touches nothing outside src/.
on:
  workflow_run:
    workflows: ["Recursive Repository Self Improvement"]
    types: [completed]

# Like the first workflow, the token is NOT granted `workflows` permission.
permissions:
  contents: write
  pull-requests: write

concurrency:
  group: inspector
  cancel-in-progress: false

jobs:
  inspect:
    # Only act when the improve run actually succeeded.
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      REVIEW_MODEL: "qwen2.5-coder:1.5b"
      # The improve workflow named its branch auto/improve-<run_id>, and that
      # run_id is exactly this event's workflow_run.id.
      PR_BRANCH: "auto/improve-${{ github.event.workflow_run.id }}"

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Find the PR for this run
        id: find
        run: |
          set -euo pipefail
          PR=$(gh pr list --head "$PR_BRANCH" --state open \
                 --json number --jq '.[0].number // empty')
          if [ -z "$PR" ]; then
            echo "No open PR found for branch $PR_BRANCH; nothing to review."
            echo "found=0" >> "$GITHUB_OUTPUT"
          else
            echo "Found PR #$PR for branch $PR_BRANCH"
            echo "found=1" >> "$GITHUB_OUTPUT"
            echo "pr=$PR" >> "$GITHUB_OUTPUT"
          fi

      - name: Independent safety check — PR must touch only src/
        if: steps.find.outputs.found == '1'
        id: scope
        env:
          PR: ${{ steps.find.outputs.pr }}
        run: |
          set -euo pipefail
          outside="$(gh pr diff "$PR" --name-only | grep -v '^src/' || true)"
          if [ -n "$outside" ]; then
            echo "::warning::PR #$PR touches files outside src/; refusing to merge:"
            echo "$outside"
            gh pr comment "$PR" --body \
              "🚫 Inspector aborted: this PR modifies files outside \`src/\`, which is not permitted for automated changes. Leaving it open for a human."
            echo "ok=0" >> "$GITHUB_OUTPUT"
          else
            echo "ok=1" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Python
        if: steps.scope.outputs.ok == '1'
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install and start Ollama
        if: steps.scope.outputs.ok == '1'
        run: |
          curl -fsSL https://ollama.com/install.sh | sh
          nohup ollama serve >/tmp/ollama.log 2>&1 &
          for i in $(seq 1 30); do
            if curl -fsS http://127.0.0.1:11434/api/version >/dev/null 2>&1; then
              echo "ollama is up"; break
            fi
            sleep 2
          done

      - name: Pull model
        if: steps.scope.outputs.ok == '1'
        run: ollama pull "$REVIEW_MODEL"

      - name: Run the Inspector
        if: steps.scope.outputs.ok == '1'
        env:
          PR_NUMBER: ${{ steps.find.outputs.pr }}
          REVIEW_VERDICT_FILE: ${{ runner.temp }}/review_verdict.txt
          REVIEW_BODY_FILE: ${{ runner.temp }}/review_body.md
        run: python .github/scripts/review.py

      - name: Post review, then approve and merge if the verdict is APPROVE
        if: steps.scope.outputs.ok == '1'
        env:
          PR: ${{ steps.find.outputs.pr }}
          REVIEW_VERDICT_FILE: ${{ runner.temp }}/review_verdict.txt
          REVIEW_BODY_FILE: ${{ runner.temp }}/review_body.md
        run: |
          set -euo pipefail
          VERDICT="$(cat "$REVIEW_VERDICT_FILE" 2>/dev/null || echo reject)"
          echo "Inspector verdict: $VERDICT"

          if [ "$VERDICT" = "approve" ]; then
            # Best-effort formal approval. GitHub blocks a token from approving
            # its own PR, so this may fail harmlessly — the merge is the real gate.
            gh pr review "$PR" --approve --body-file "$REVIEW_BODY_FILE" \
              || gh pr comment "$PR" --body-file "$REVIEW_BODY_FILE"
            gh pr merge "$PR" --squash --delete-branch
            echo "Merged PR #$PR. 🍊"
          else
            gh pr review "$PR" --request-changes --body-file "$REVIEW_BODY_FILE" \
              || gh pr comment "$PR" --body-file "$REVIEW_BODY_FILE"
            echo "PR #$PR left open for a human. The Inspector was not convinced."
          fi