docs(handoff): execution playbook — parallel & effective methods #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ── TypeScript (Cloudflare Workers / D1 via vitest-pool-workers) ── | |
| typescript-tests: | |
| name: TypeScript tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| - run: npm ci | |
| - name: Typecheck (tsc --noEmit) | |
| run: npm run typecheck | |
| - name: Run vitest + redaction check | |
| run: | | |
| npm test 2>&1 | tee /tmp/ts-test-output.txt | |
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/ts-test-output.txt; then | |
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in test output" | |
| exit 1 | |
| fi | |
| echo "No sentinel secrets detected." | |
| # ── sandbox-runtime Python ── | |
| sandbox-runtime-tests: | |
| name: sandbox-runtime tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: packages/sandbox-runtime | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "latest" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: uv sync --frozen --extra dev | |
| - name: Run pytest | |
| run: uv run pytest tests/ -x --ignore=tests/test_codex_auth_plugin_setup.py 2>&1 | tee /tmp/sandbox-pytest-output.txt | |
| - name: Redaction check | |
| run: | | |
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/sandbox-pytest-output.txt; then | |
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in test output" | |
| exit 1 | |
| fi | |
| echo "No sentinel secrets detected." | |
| sandbox-runtime-lint: | |
| name: sandbox-runtime lint | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: packages/sandbox-runtime | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "latest" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: uv sync --frozen --extra dev | |
| - name: Run ruff check | |
| run: uv run ruff check src/ tests/ | |
| # ── modal-infra Python ── | |
| modal-infra-tests: | |
| name: modal-infra tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: packages/modal-infra | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "latest" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: uv sync --frozen --extra dev | |
| - name: Run pytest | |
| run: uv run pytest tests/ -x 2>&1 | tee /tmp/modal-pytest-output.txt | |
| - name: Redaction check | |
| run: | | |
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/modal-pytest-output.txt; then | |
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in test output" | |
| exit 1 | |
| fi | |
| echo "No sentinel secrets detected." | |
| modal-infra-lint: | |
| name: modal-infra lint | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: packages/modal-infra | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "latest" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: uv sync --frozen --extra dev | |
| - name: Run ruff check | |
| run: uv run ruff check src/ tests/ | |
| # ── Live smoke (secret-gated, optional) ── | |
| # | |
| # `secrets` is NOT in scope in a job-level `if:` — referencing it there makes | |
| # the whole workflow file invalid (every run fails to start at 0s). Instead we | |
| # map the secret into a job-level `env:` (secrets ARE allowed there) and guard | |
| # each step on the `env` context, which IS available in a step-level `if:`. | |
| # With no AC_API_KEY configured, every step skips and the job is a green no-op. | |
| live-smoke: | |
| name: Live SDK smoke test | |
| runs-on: ubuntu-latest | |
| needs: [typescript-tests, sandbox-runtime-tests, modal-infra-tests] | |
| env: | |
| AC_API_KEY: ${{ secrets.AC_API_KEY }} | |
| AC_URL: ${{ secrets.AC_URL }} | |
| steps: | |
| - if: ${{ env.AC_API_KEY != '' }} | |
| uses: actions/checkout@v4 | |
| - if: ${{ env.AC_API_KEY != '' }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| - if: ${{ env.AC_API_KEY != '' }} | |
| run: npm ci | |
| - name: Run smoke test | |
| if: ${{ env.AC_API_KEY != '' }} | |
| run: npx vitest run packages/sdk/test/smoke.test.ts 2>&1 | tee /tmp/smoke-output.txt | |
| - name: Redaction check | |
| if: ${{ env.AC_API_KEY != '' }} | |
| run: | | |
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/smoke-output.txt; then | |
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in smoke output" | |
| exit 1 | |
| fi | |
| echo "No sentinel secrets detected." |