ironclaw/.github/workflows/codebase-graph-refresh.yml

name: Codebase Graph Refresh

# Regenerate the shared codebase-memory bootstrap snapshot from the default
# branch and open a normal review PR. The GitHub App token is intentional:
# PRs created with GITHUB_TOKEN do not trigger the repository's required checks.

on:
  schedule:
    - cron: "30 2 * * *" # Daily at 02:30 UTC, before the deep-CI batch.
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codebase-graph-refresh
  cancel-in-progress: false

jobs:
  refresh:
    if: github.repository == 'nearai/ironclaw'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Mint GitHub App token
        id: app
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GH_RELEASES_MANAGER_APP_ID }}
          private-key: ${{ secrets.GH_RELEASES_MANAGER_APP_PRIVATE_KEY }}

      - name: Check out the default branch
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
        with:
          ref: ${{ github.event.repository.default_branch }}
          fetch-depth: 0
          token: ${{ steps.app.outputs.token }}
          persist-credentials: true

      - name: Install pinned codebase-memory-mcp
        env:
          CBM_VERSION: v0.9.0
          CBM_ARCHIVE: codebase-memory-mcp-linux-amd64-portable.tar.gz
          CBM_SHA256: 8459d5c9d1457f2c82de3de307ffc7641ecbba2dde893427be1e62eca8ef9b25
        run: |
          set -euo pipefail
          install_dir="${RUNNER_TEMP}/codebase-memory-mcp-bin"
          archive="${RUNNER_TEMP}/${CBM_ARCHIVE}"
          mkdir -p "${install_dir}"
          curl --proto '=https' --tlsv1.2 -fsSLo "${archive}" \
            "https://github.com/DeusData/codebase-memory-mcp/releases/download/${CBM_VERSION}/${CBM_ARCHIVE}"
          echo "${CBM_SHA256}  ${archive}" | sha256sum --check --strict
          tar -xzf "${archive}" -C "${install_dir}" codebase-memory-mcp
          chmod 0755 "${install_dir}/codebase-memory-mcp"
          echo "${install_dir}" >> "${GITHUB_PATH}"
          "${install_dir}/codebase-memory-mcp" --version

      - name: Regenerate and validate graph snapshot
        env:
          CBM_CACHE_DIR: ${{ runner.temp }}/codebase-memory-cache
        run: |
          set -euo pipefail
          codebase-memory-mcp cli index_repository \
            --repo-path "${GITHUB_WORKSPACE}" \
            --mode full \
            --persistence true

          python3 - <<'PY'
          import json
          import pathlib
          import subprocess

          root = pathlib.Path.cwd()
          artifact = json.loads(
              (root / ".codebase-memory" / "artifact.json").read_text(encoding="utf-8")
          )
          head = subprocess.check_output(
              ["git", "rev-parse", "HEAD"], cwd=root, text=True
          ).strip()
          if artifact.get("commit") != head:
              raise SystemExit(
                  "graph metadata commit does not match the checked-out default branch"
              )
          if artifact.get("nodes", 0) <= 0 or artifact.get("edges", 0) <= 0:
              raise SystemExit("graph metadata reports an empty graph")
          PY

          test -s .codebase-memory/graph.db.zst
          zstd --test .codebase-memory/graph.db.zst
          git diff --check

          changed="$(git diff --name-only)"
          if [ -n "${changed}" ] && [ "${changed}" != ".codebase-memory/graph.db.zst" ]; then
            echo "Graph refresh changed unexpected tracked paths:" >&2
            printf '%s\n' "${changed}" >&2
            exit 1
          fi

      - name: Open graph refresh PR
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
        with:
          token: ${{ steps.app.outputs.token }}
          add-paths: .codebase-memory/graph.db.zst
          branch: automation/codebase-graph-refresh
          delete-branch: true
          commit-message: "chore(agents): refresh codebase knowledge graph"
          title: "chore(agents): refresh codebase knowledge graph"
          body: |
            ## Summary

            - Refresh the committed codebase-memory bootstrap snapshot from the current default branch.
            - Generated by the nightly `Codebase Graph Refresh` workflow; review and merge normally.

            ## Change Type

            - [x] CI/Infrastructure

            ## Linked Issue

            None.

            ## Validation

            - [x] Relevant tests pass: full graph indexing completed and reported non-zero nodes and edges.
            - [x] Manual testing: snapshot metadata matches the indexed default-branch commit and `zstd --test` passes.

            ## Test Strategy

            User behavior: Agents cloning the repository receive a recent bootstrap graph.

            Risk areas:
            - [x] Persistence
            - [x] Side effect

            Tests added or updated:
            - Unit or contract: Not applicable: generated binary snapshot only.
            - Reborn integration: Not applicable: no Reborn behavior changes.
            - Recorded fixture: Not applicable: no model behavior changes.
            - Browser E2E: Not applicable: no browser behavior changes.
            - Backend or runtime: Not applicable: no Ironclaw runtime behavior changes.
            - Live canary: Not applicable: the generator is local and deterministic.

            What the tests prove: The snapshot is non-empty, readable, and indexed from the expected commit.

            Commands run: `codebase-memory-mcp cli index_repository --mode full --persistence true`; `zstd --test .codebase-memory/graph.db.zst`; `git diff --check`.

            ## Security Impact

            The generating workflow keeps credentials host-side and limits the committed path to `.codebase-memory/graph.db.zst`.

            ## Reborn Trust-Boundary Checklist

            N/A: agent bootstrap data only; no Reborn trust boundary changes.

            ## Database Impact

            None.

            ## Blast Radius

            Agent code-discovery bootstrap data only.

            ## Rollback Plan

            Close this PR, or revert the snapshot commit after merge.

            ## Review Follow-Through

            Confirm the snapshot size and CI results before merging.

            ---

            **Review track**: A (generated chore)