improve.yaml

name: Recursive Repository Self Improvement

# Runs on a schedule and on demand. A small local model proposes a single
# improvement to files under src/, and the change is opened as a pull request.
on:
  schedule:
    - cron: "0 1/4 * * *"
  workflow_dispatch:
    inputs:
      model:
        description: "Ollama model to run"
        required: false
        default: "qwen2.5-coder:0.5b"

# NOTE on security: the token below is intentionally NOT granted `workflows`
# permission, so GitHub itself will reject any push that touches
# .github/workflows/**. Combined with the path validation in improve.py and the
# diff gate below, the generated PR can only ever modify files under src/.
permissions:
  contents: write
  pull-requests: write
  issues: read

concurrency:
  group: self-improve
  cancel-in-progress: false

jobs:
  improve:
    runs-on: ubuntu-latest
    timeout-minutes: 40
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      IMPROVE_MODEL: ${{ github.event.inputs.model || 'qwen2.5-coder:0.5b' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install and start Ollama
        run: |
          curl -fsSL https://ollama.com/install.sh | sh
          nohup ollama serve >/tmp/ollama.log 2>&1 &
          # Wait for the server to accept connections.
          for i in $(seq 1 30); do
            if curl -fsS http://127.0.0.1:11434/api/version >/dev/null 2>&1; then
              echo "ollama is up"; break
            fi
            sleep 2
          done

      - name: Pull model
        run: ollama pull "$IMPROVE_MODEL"

      - name: Generate improvement (src/ only)
        env:
          IMPROVE_PR_BODY: ${{ runner.temp }}/improve_pr_body.md
        run: python .github/scripts/improve.py

      - name: Safety net — undo any change outside src/
        id: gate
        run: |
          set -uo pipefail
          # Report anything that was touched outside src/ before we undo it.
          # (Destination path only, so renames collapse to their target.)
          outside="$(git -c core.quotepath=false status --porcelain=v1 \
            | sed -E 's/^.{3}//; s/.* -> //' | grep -v '^src/' || true)"
          if [ -n "$outside" ]; then
            echo "::warning::Reverting changes made outside src/:"
            echo "$outside"
            # Unstage, then restore tracked files (modified/deleted) outside src/.
            git reset -q -- . ':(exclude)src' || true
            git checkout -- . ':(exclude)src' || true
            # Remove any untracked files/dirs outside src/.
            git clean -fd -- . ':(exclude)src' || true
          fi
          # Proceed only if a change under src/ remains after cleanup.
          if [ -n "$(git status --porcelain=v1 -- src)" ]; then
            echo "changed=1" >> "$GITHUB_OUTPUT"
          else
            echo "No changes under src/ remain; nothing to do."
            echo "changed=0" >> "$GITHUB_OUTPUT"
          fi

      - name: Create pull request
        if: steps.gate.outputs.changed == '1'
        env:
          PR_BODY_FILE: ${{ runner.temp }}/improve_pr_body.md
        run: |
          set -euo pipefail
          BRANCH="auto/improve-${{ github.run_id }}"
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git checkout -b "$BRANCH"
          git add src
          git commit -m "Automated improvement to src/ (run ${{ github.run_id }})"
          git push origin "$BRANCH"
          gh pr create \
            --title "Automated improvement to src/ (#${{ github.run_id }})" \
            --body-file "$PR_BODY_FILE" \
            --base "${{ github.ref_name }}" \
            --head "$BRANCH" \
            --label "automated" || \
          gh pr create \
            --title "Automated improvement to src/ (#${{ github.run_id }})" \
            --body-file "$PR_BODY_FILE" \
            --base "${{ github.ref_name }}" \
            --head "$BRANCH"