[Refactoring] Split scripts/ci/postprocess-smoke-workflows.ts into focused modules

[github-actions]

Refactoring Opportunity

Summary

• File: scripts/ci/postprocess-smoke-workflows.ts
• Current size: 874 lines
• Responsibilities identified: 4 distinct concerns

Evidence

The file mixes four clearly separable responsibilities in a single flat script:

1. Regex constants and sentinel library (lines 45–341, ~300 lines)
Twenty-plus module-level const declarations defining regex patterns, sentinel strings, and replacement payloads. These are defined at module scope and interleaved with business logic, making them hard to maintain in isolation:

const installStepRegex = ...       (line 51)
const imageTagRegex = ...           (line 104)
const sessionStateDirInjectionRegex = ... (line 117)
const copySessionStateStepRegex = ...  (line 144)
const SAFE_XPIA_CONTENT = `...`     (line 333)
const codexConfigTomlHeredocRegex = ... (line 758)

2. Step-builder functions (lines 55–341, ~290 lines)
Five named functions that generate YAML step fragments:

function buildLocalInstallSteps(indent)        (line 55, 95 lines)
function buildCopySessionStateStep(indent)     (line 150, 85 lines)
function buildStripExecBitsStep(indent)        (line 235, 22 lines)
function buildScanInjectionStep(indent)        (line 257, 38 lines)
function buildCacheDateStep(indent)            (line 295, 12 lines)

3. General workflow mutation loop (lines 343–775, 432 inline lines)
A single for loop (not a named function) that applies ~15 distinct transformations to each lock file. This 432-line imperative block is the hardest section to navigate and test:

• install step replacement
• duplicate Setup Node.js collapse
• sparse-checkout removal
• image tag/skip-pull replacement
• session-state-dir injection
• checkout step injection
• cache-memory security hardening (3 sub-transforms)
• issue-duplication-detector concurrency scoping
• smoke-copilot excluded-tools injection
• BYOK model override rewrite
• update_cache_memory setup script removal
• and more

4. Codex-specific mutations loop (lines 779–874, 95 lines)
A second for loop that applies OpenAI/Codex-only transforms (openai-proxy provider injection, env_key removal, xpia.md safe replacement). This is entirely separate from the general transforms above.

The companion test file (scripts/ci/postprocess-smoke-workflows.test.ts, 591 lines) mirrors the module-internal regex patterns directly in test code, which is a code smell indicating the patterns should be exported from a shared constants module.

Proposed Split

scripts/ci/workflow-patch-patterns.ts (~120 lines)
All regex constants, sentinel strings, and replacement payloads (installStepRegex, imageTagRegex, SAFE_XPIA_CONTENT, etc.). Exporting these allows the test file to import and test them directly instead of duplicating.

scripts/ci/workflow-step-builders.ts (~130 lines)
The five build*Step() functions with their YAML generation logic.

scripts/ci/apply-general-workflow-patches.ts (~250 lines)
A named, exported applyGeneralWorkflowPatches(content: string, workflowPath: string): { content: string; log: string[] } function extracted from the 432-line loop body. Each transform becomes a clearly named sub-step; the loop in the main script shrinks to ~15 lines.

scripts/ci/apply-codex-workflow-patches.ts (~80 lines)
The Codex-specific transforms extracted to applyCodexWorkflowPatches(content: string): { content: string; log: string[] }.

scripts/ci/postprocess-smoke-workflows.ts (~60 lines)
Thin orchestration: reads file list, calls the two apply* functions, writes if modified.

Affected Callers

The script is invoked as a standalone binary — no TypeScript imports to update:

.github/skills/pr-finisher/SKILL.md:  npx ts-node scripts/ci/postprocess-smoke-workflows.ts
.github/workflows/copilot-token-optimizer.md:  npx tsx scripts/ci/postprocess-smoke-workflows.ts
.github/workflows/claude-token-optimizer.md:   npx tsx scripts/ci/postprocess-smoke-workflows.ts

The test file scripts/ci/postprocess-smoke-workflows.test.ts (591 lines) duplicates ~10 regex patterns from the source to work around them being module-internal. After the split, these should be imported from workflow-patch-patterns.ts directly, eliminating the duplication.

Effort Estimate

Medium — the logic is well-defined; the main risk is ensuring the extract-and-delegate refactor doesn't alter existing behavior. The existing test suite provides a safety net.

Benefits

• Each module is navigable in isolation (~60–130 lines each)
• Step builders and regex patterns are independently testable without running the full script
• The test file can import constants directly instead of duplicating them
• The general and Codex transform paths have clear ownership boundaries
• New transforms are added to the correct module rather than growing the monolithic loop

---

Detected by Refactoring Scanner workflow. Run date: 2026-07-04

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Refactoring Opportunity Scanner · 136.2 AIC · ⊞ 6.6K · ◷

• expires on Sep 2, 2026, 5:36 AM UTC