🤖 Codex: 🩺 Global Healthcheck / Code Audit Tracker

.github/workflows/repo-healthcheck.yml

@@ -0,0 +1,126 @@
+name: Repo Healthcheck
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+    inputs:
+      issue_number:
+        description: "Issue number to comment on when failing"
+        required: false
+        default: "25"
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: repo-healthcheck-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  healthcheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      ISSUE_NUMBER: ${{ github.event.inputs.issue_number || '25' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.6
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libsqlite3-dev
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Remote-only constraint (src)
+        shell: bash
+        run: |
+          set -euo pipefail
+          if grep -RInE "(node-llama-cpp|ollama|LlamaCpp|local-llm)" src; then
+            echo "Found forbidden local-LLM references in src/."
+            exit 1
+          fi
+
+      - name: package.json must not reference local-LLM deps
+        shell: bash
+        run: |
+          set -euo pipefail
+          if grep -nE "\"(node-llama-cpp|ollama)\"" package.json; then
+            echo "package.json references forbidden dependencies."
+            exit 1
+          fi
+
+      - name: Type check
+        run: bun run typecheck
+
+      - name: Run tests
+        run: bun test
+
+      - name: CLI smoke (qmd --help)
+        shell: bash
+        run: |
+          set -euo pipefail
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+          bun link
+          qmd --help >/dev/null
+
+      - name: Comment on tracker issue (only on failure)
+        if: failure()
+        continue-on-error: true
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issue_number = Number(process.env.ISSUE_NUMBER || "25");
+            const marker = "<!-- repo-healthcheck -->";
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            const body = [
+              marker,
+              "🩺 **Repo Healthcheck failed**",
+              "",
+              `- Run: ${runUrl}`,
+              `- SHA: ${context.sha}`,
+              `- Trigger: ${context.eventName}`,
+              `- Time (UTC): ${new Date().toISOString()}`,
+            ].join("\n");
+
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner,
+              repo,
+              issue_number,
+              per_page: 100,
+            });
+
+            const existing = [...comments]
+              .reverse()
+              .find(
+                (c) =>
+                  c.user?.login === "github-actions[bot]" &&
+                  typeof c.body === "string" &&
+                  c.body.includes(marker)
+              );
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner,
+                repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number,
+                body,
+              });
+            }