docs(handoff): mark #2 private-repo clone DONE (Modal clone_token fix… #154
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | ||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| concurrency: | ||
| group: ci-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| # ── TypeScript (Cloudflare Workers / Postgres + vitest-pool-workers) ── | ||
| typescript-tests: | ||
| name: TypeScript tests | ||
| runs-on: ubuntu-latest | ||
| # App Postgres for the suite. pg-global-setup connects to TEST_DATABASE_URL | ||
| # and replays the drizzle-pg migrations from scratch into this empty DB (the | ||
| # deferred-FK loop tolerates 0006's ordering). postgres:18 matches local pg0. | ||
| services: | ||
| postgres: | ||
| image: postgres:18 | ||
| env: | ||
| POSTGRES_USER: postgres | ||
| POSTGRES_PASSWORD: postgres | ||
| POSTGRES_DB: agent_coordinator_test | ||
| ports: | ||
| - 5440:5432 | ||
| options: >- | ||
| --health-cmd "pg_isready -U postgres" | ||
| --health-interval 10s | ||
| --health-timeout 5s | ||
| --health-retries 5 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "22" | ||
| cache: npm | ||
| - run: npm ci | ||
| - name: Build acp-client (file: dep — dist is gitignored) | ||
| run: npm run build --prefix packages/acp-client | ||
| - name: Typecheck (tsc --noEmit) | ||
| run: npm run typecheck | ||
| - name: Architectural gate — composition root (hard) | ||
| run: npm run check:composition-root | ||
| - name: Node lane — bridge transport over real WebSocket (hard) | ||
| # LocalSandboxBridge + WsBridgeTransport ↔ FakeControlPlane over a real | ||
| # socket: round-trip, reconnect-resume, fatal-handshake exit. Cannot run | ||
| # in the Workers pool (needs a Node WS client/server). | ||
| run: npm run test:node | ||
| - name: Architectural gate — adapter coverage (hard) | ||
| # Every real adapter REACHABLE from a composition root must be run | ||
| # through a conformance suite or carry a written waiver. Scaffolded-but- | ||
| # unwired adapters are tracked WIP (non-fatal) and auto-escalate to a | ||
| # red build the instant a composition root constructs them uncovered. | ||
| run: npm run check:adapter-coverage | ||
| - name: Architectural rules report (R2/R32/R33 — non-blocking) | ||
| continue-on-error: true | ||
| run: npm run check:architectural-rules | ||
| - name: Run vitest + redaction check | ||
| env: | ||
| # Postgres service above (empty agent_coordinator_test); pg-global-setup | ||
| # replays the schema. Set explicitly (not a secret) so the suite is | ||
| # self-contained and never targets an external DB. | ||
| TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5440/agent_coordinator_test | ||
| run: | | ||
| npm test 2>&1 | tee /tmp/ts-test-output.txt | ||
| test_rc=${PIPESTATUS[0]} | ||
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/ts-test-output.txt; then | ||
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in test output" | ||
| exit 1 | ||
| fi | ||
| echo "No sentinel secrets detected." | ||
| exit "$test_rc" | ||
| # ── sandbox-runtime Python ── | ||
| sandbox-runtime-tests: | ||
| name: sandbox-runtime tests | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: packages/sandbox-runtime | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| version: "latest" | ||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.12" | ||
| - name: Install dependencies | ||
| run: uv sync --frozen --extra dev | ||
| - name: Run pytest | ||
| run: | | ||
| set -o pipefail | ||
| uv run pytest tests/ -x --ignore=tests/test_codex_auth_plugin_setup.py 2>&1 | tee /tmp/sandbox-pytest-output.txt | ||
| - name: Redaction check | ||
| run: | | ||
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/sandbox-pytest-output.txt; then | ||
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in test output" | ||
| exit 1 | ||
| fi | ||
| echo "No sentinel secrets detected." | ||
| sandbox-runtime-lint: | ||
| name: sandbox-runtime lint | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: packages/sandbox-runtime | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| version: "latest" | ||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.12" | ||
| - name: Install dependencies | ||
| run: uv sync --frozen --extra dev | ||
| - name: Run ruff check | ||
| run: uv run ruff check src/ tests/ | ||
| # ── modal-infra Python ── | ||
| modal-infra-tests: | ||
| name: modal-infra tests | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: packages/modal-infra | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| version: "latest" | ||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.12" | ||
| - name: Install dependencies | ||
| run: uv sync --frozen --extra dev | ||
| - name: Run pytest | ||
| run: | | ||
| set -o pipefail | ||
| uv run pytest tests/ -x 2>&1 | tee /tmp/modal-pytest-output.txt | ||
| - name: Redaction check | ||
| run: | | ||
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/modal-pytest-output.txt; then | ||
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in test output" | ||
| exit 1 | ||
| fi | ||
| echo "No sentinel secrets detected." | ||
| modal-infra-lint: | ||
| name: modal-infra lint | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: packages/modal-infra | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: astral-sh/setup-uv@v4 | ||
| with: | ||
| version: "latest" | ||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.12" | ||
| - name: Install dependencies | ||
| run: uv sync --frozen --extra dev | ||
| - name: Run ruff check | ||
| run: uv run ruff check src/ tests/ | ||
| # ── Live smoke (secret-gated, optional) ── | ||
| # | ||
| # `secrets` is NOT in scope in a job-level `if:` — referencing it there makes | ||
| # the whole workflow file invalid (every run fails to start at 0s). Instead we | ||
| # map the secret into a job-level `env:` (secrets ARE allowed there) and guard | ||
| # each step on the `env` context, which IS available in a step-level `if:`. | ||
| # With no AC_API_KEY configured, every step skips and the job is a green no-op. | ||
| live-smoke: | ||
| name: Live SDK smoke test | ||
| runs-on: ubuntu-latest | ||
| needs: [typescript-tests, sandbox-runtime-tests, modal-infra-tests] | ||
| env: | ||
| AC_API_KEY: ${{ secrets.AC_API_KEY }} | ||
| AC_URL: ${{ secrets.AC_URL }} | ||
| steps: | ||
| - if: ${{ env.AC_API_KEY != '' }} | ||
| uses: actions/checkout@v4 | ||
| - if: ${{ env.AC_API_KEY != '' }} | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "22" | ||
| cache: npm | ||
| - if: ${{ env.AC_API_KEY != '' }} | ||
| run: npm ci | ||
| - name: Run smoke test | ||
| if: ${{ env.AC_API_KEY != '' }} | ||
| run: | | ||
| set -o pipefail | ||
| npx vitest run packages/sdk/test/smoke.test.ts 2>&1 | tee /tmp/smoke-output.txt | ||
| - name: Redaction check | ||
| if: ${{ env.AC_API_KEY != '' }} | ||
| run: | | ||
| if grep -q 'SHOULD_NOT_APPEAR_IN_LOGS' /tmp/smoke-output.txt; then | ||
| echo "::error::Sentinel string SHOULD_NOT_APPEAR_IN_LOGS found in smoke output" | ||
| exit 1 | ||
| fi | ||
| echo "No sentinel secrets detected." | ||
