Guardian: Codex-driven incremental TypeScript migration

1name: Daily TypeScript migration2

3on:4  push:5    branches: [main]6    paths:7      - '.github/workflows/typescript-migration.yml'8  schedule:9    - cron: '23 7 * * *'10  workflow_dispatch:1112concurrency:13  group: typescript-migration14  cancel-in-progress: false15

16permissions:17  contents: read18  pull-requests: read1920env:21  MIGRATION_BRANCH: ${{ github.ref_name == github.event.repository.default_branch && 'automation/typescript-migration' || 'automation/typescript-migration-test' }}22

23jobs:24  check:25    runs-on: ubuntu-latest26    timeout-minutes: 1527    outputs:28      ready: ${{ steps.check.outputs.ready }}

29    steps:30      - name: Wait for the previous migration to be reviewed31        id: check32        env:33          GH_TOKEN: ${{ github.token }}34          GH_REPO: ${{ github.repository }}35        run: |36          count=$(gh pr list --state open --head "$MIGRATION_BRANCH" --json number --jq 'length')37          if [ "$count" = 0 ]; then38            echo 'ready=true' >> "$GITHUB_OUTPUT"39          else40            echo 'Skipping: a TypeScript migration PR is still open.' >> "$GITHUB_STEP_SUMMARY"41          fi4243  migrate:44    needs: check45    if: needs.check.outputs.ready == 'true'46    runs-on: ubuntu-latest47    timeout-minutes: 15

48    permissions:49      contents: write50      pull-requests: write

51    steps:52      - uses: actions/checkout@v753        with:54          ref: ${{ github.ref_name }}55          persist-credentials: false5657      - name: Check for remaining JavaScript58        id: candidates59        run: |60          if [ -n "$(git ls-files 'frontend/src/*.js' 'frontend/src/*.jsx')" ]; then61            echo 'remaining=true' >> "$GITHUB_OUTPUT"62          else63            echo 'No JavaScript source files remain to migrate.' >> "$GITHUB_STEP_SUMMARY"64          fi6566      - uses: actions/setup-node@v767        if: steps.candidates.outputs.remaining == 'true'68        with:69          node-version-file: .nvmrc70          cache: npm71          cache-dependency-path: frontend/package-lock.json7273      - name: Install dependencies and check the baseline74        if: steps.candidates.outputs.remaining == 'true'75        working-directory: frontend76        run: |77          npm ci78          npm run build79          npm run lint80          npm test81          npm run prettier:check8283      - name: Migrate a small batch84        id: codex85        if: steps.candidates.outputs.remaining == 'true'

86        uses: openai/codex-action@v1.1187        with:88          openai-api-key: ${{ secrets.OPENAI_API_KEY }}89          prompt-file: .github/codex/typescript-migration.md90          model: ${{ vars.TYPESCRIPT_MIGRATION_MODEL }}91          sandbox: workspace-write92          safety-strategy: drop-sudo9394      - name: Check migration scope95        if: steps.candidates.outputs.remaining == 'true'96        run: |97          git add --intent-to-add .98          python3 - <<'PY'99          import pathlib100          import subprocess101102          def changed(*args):103              return subprocess.check_output(104                  ['git', 'diff', '--name-only', '--no-renames', '-z', *args, 'HEAD']105              ).decode().split('\0')[:-1]106107          paths = changed()108          if not paths:109              raise SystemExit('No migration produced; no PR will be opened.')110          plan = '.github/codex/typescript-migration-plan.md'111          if any(not p.startswith('frontend/src/') and p != plan for p in paths):112              raise SystemExit('Migration changed files outside frontend/src and the migration plan.')113          if not pathlib.Path(plan).is_file():114              raise SystemExit('Keep the migration plan file, even when all steps are complete.')115          deleted = changed('--diff-filter=D')116          migrated = [p for p in deleted if pathlib.Path(p).suffix in ('.js', '.jsx')117                      and any(pathlib.Path(p).with_suffix(ext).is_file() for ext in ('.ts', '.tsx'))]118          if not migrated:119              raise SystemExit('No JavaScript files were converted to TypeScript.')120          print(f'Migrated {len(migrated)} JavaScript files; {len(paths)} changed paths including renames.')121          PY122          git diff --check HEAD123124      - name: Validate the migration125        if: steps.candidates.outputs.remaining == 'true'126        working-directory: frontend127        run: |128          npm run build129          npm run lint130          npm test131          npm run prettier:check132133      - name: Open a pull request134        if: steps.candidates.outputs.remaining == 'true'135        uses: peter-evans/create-pull-request@v7136        with:137          token: ${{ github.token }}138          branch: ${{ env.MIGRATION_BRANCH }}139          base: ${{ github.ref_name }}140          add-paths: |141            frontend/src/142            .github/codex/typescript-migration-plan.md143          commit-message: 'Migrate a batch of frontend files to TypeScript'144          title: 'Migrate a batch of frontend files to TypeScript'145          labels: maintenance146          body: |147            ${{ steps.codex.outputs.final-message }}148149            The workflow passed the frontend build (including typecheck), lint, tests, and formatting checks.150            [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})151152            Generated automatically; human review is required before merging.