From f338f2f54a4bb1a542d154a9e2997563595346b3 Mon Sep 17 00:00:00 2001 From: Manas Srivastava Date: Thu, 21 May 2026 09:28:54 +0530 Subject: [PATCH] ci: add api sibling checkout so cross-repo wire-value gate runs in CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The registry-iterating tests in internal/jobs/coverage_registry_test.go (TestWorkerAuditKinds_ValuesMatchApiConstants + TestSupportedAuditKinds_CoveredByApiSpecOrDocumentedWorkerOnly) text-walk api/internal/models/audit_kinds.go + api/e2e/reliability_contract_test.go to assert worker auditKind* wire values match the api source. Before this patch, ci.yml + deploy.yml only checked out common + proto siblings — never api — so findApiRepoRoot() returned "" and both tests silently t.Skip'd. The cross-repo drift gate ran on developer machines (via the ~/Documents/InstaNode/api fallback) but never in CI. Wave-3 CI coverage audit (2026-05-21) caught this. Per CLAUDE.md rule 18 (registry-iterating regression tests), a guard that skips in CI is no guard at all. Patch: - ci.yml: add a third actions/checkout@v4 step for InstaNode-dev/api using REPO_ACCESS_TOKEN (same PAT pattern as common+proto), move it to ../api via the existing _common_ci-style trick, then set INSTANT_API_REPO=$GITHUB_WORKSPACE/../api on the test step. - deploy.yml: same checkout (path: api alongside path: worker/common/proto) + INSTANT_API_REPO=$GITHUB_WORKSPACE/api on the test step. Local verification (with INSTANT_API_REPO set): $ make gate ok instant.dev/worker/internal/jobs 24.074s gate: green — matches deploy.yml test step Both target tests now run instead of skip: --- PASS: TestWorkerAuditKinds_ValuesMatchApiConstants (0.00s) --- PASS: TestSupportedAuditKinds_CoveredByApiSpecOrDocumentedWorkerOnly (0.00s) Operator note: this assumes REPO_ACCESS_TOKEN's fine-grained PAT scope includes read on InstaNode-dev/api. If the PAT was minted with only {common, proto} repo-allowlist, the new checkout step will 404 and CI will fail loud (clean fail-stop, not silent SKIP). Extending the PAT scope to include api takes ~30s in the GitHub PAT settings page; until then this PR's CI run will fail on the api checkout step and the operator should add api to the PAT's repository-access list before re-running. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/ci.yml | 20 +++++++++++++++++++- .github/workflows/deploy.yml | 21 +++++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a69326d..04d66f5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,10 +52,28 @@ jobs: path: _common_ci - run: mv _common_ci ../common + # Cross-repo registry-iterating tests (CLAUDE.md rule 18) text-walk + # api/internal/models/audit_kinds.go and api/e2e/reliability_contract_test.go + # to assert worker auditKind* wire values match the api source. Without + # this checkout the tests SKIP in CI, leaving cross-repo drift detection + # to developer machines only. INSTANT_API_REPO is set on the test step + # below so findApiRepoRoot() locates the sibling deterministically. + - name: Checkout api sibling (for cross-repo registry-iterating tests) + uses: actions/checkout@v4 + with: + repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }} + token: ${{ secrets.REPO_ACCESS_TOKEN }} + path: _api_ci + fetch-depth: 1 + - run: mv _api_ci ../api + - uses: actions/setup-go@v5 with: go-version: '1.24' - run: go build ./... - run: go vet ./... - - run: go test ./... -v -race -count=1 + - name: Run tests (with INSTANT_API_REPO for cross-repo gate) + env: + INSTANT_API_REPO: ${{ github.workspace }}/../api + run: go test ./... -v -race -count=1 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 0a02bc6..679b416 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -70,6 +70,20 @@ jobs: token: ${{ secrets.REPO_ACCESS_TOKEN }} path: proto + # Cross-repo registry-iterating tests (CLAUDE.md rule 18) text-walk + # api/internal/models/audit_kinds.go and api/e2e/reliability_contract_test.go + # to assert worker auditKind* wire values match the api source. Without + # this checkout the tests SKIP in deploy CI, leaving cross-repo drift + # detection to developer machines only. INSTANT_API_REPO is set on the + # test step below so findApiRepoRoot() locates the sibling deterministically. + - name: Checkout api sibling into ./api (for cross-repo registry-iterating tests) + uses: actions/checkout@v4 + with: + repository: ${{ vars.API_REPO || format('{0}/api', github.repository_owner) }} + token: ${{ secrets.REPO_ACCESS_TOKEN }} + path: api + fetch-depth: 1 + - name: Compute build metadata id: meta run: | @@ -91,7 +105,14 @@ jobs: # `replace instant.dev/proto => ../proto`. When `go test` runs # inside ./worker, the relative paths resolve to ./common and # ./proto in the workspace root — already correct, no mv needed. + # INSTANT_API_REPO points findApiRepoRoot() (used by + # TestWorkerAuditKinds_ValuesMatchApiConstants + + # TestSupportedAuditKinds_CoveredByApiSpecOrDocumentedWorkerOnly) + # at the api sibling checked out above; without this they SKIP + # and the cross-repo wire-value drift gate doesn't run in CI. working-directory: worker + env: + INSTANT_API_REPO: ${{ github.workspace }}/api run: go test ./... -short -count=1 - name: Set up Docker Buildx