Files
copilotkit__copilotkit/showcase/scripts/__tests__/aggregate-build-results.test.ts
Jordan Ritter a6239cde11 fix(showcase): close deploy-gate false-greens and broaden public-env lint rule
Seven-agent CR surfaced correctness defects in the build/deploy/promote
pipeline and in the no-public-env-shell-read oxlint rule. This commit
closes the false-green paths and broadens lint coverage.

Workflow fixes:
- showcase_deploy.yml: drop `continue-on-error: true` on the redeploy-summary
  artifact download. The dispatch path is already guarded by the `if:
  workflow_run` clause, so the bash "no summary" branch handles legitimate
  manual dispatches. A genuine workflow_run download failure must now fail
  loud instead of silently widening verify to the full service set against
  stale `:latest`.
- showcase_build.yml: redeploy-staging now intersects the build matrix with
  the aggregator success set (`needs.aggregate-build-results.outputs.results`,
  status == "success") before producing the redeploy CSV. Failed/skipped
  slots no longer get redeployed (which would just re-pull stale `:latest`
  and look healthy).
- showcase_build.yml: `notify-all-builds-failed` now additionally requires
  `needs.build.result == 'failure'` so it doesn't Slack-spam when the build
  job was SKIPPED (verify-image-refs upstream failure).
- showcase_build.yml: `notify` now lists [build, aggregate-build-results,
  redeploy-staging] in `needs:` so aggregator/redeploy failures still emit
  a Slack signal. `if: failure()` still skips when none of the needs failed.
- showcase_build.yml: `set -euo pipefail` on the Prepare build args step
  so a transient $GITHUB_OUTPUT write failure can't ship images without
  COMMIT_SHA/BRANCH baked in.
- showcase_deploy.yml: `enforce-redeploy-gate` now also trips on a
  resolve-matrix failure (`needs.resolve-matrix.result == 'failure'`) so
  an upstream crash that leaves `redeploy_red` empty can't bypass the gate.
- Doc-comment accuracy: drop stale `(PR #5093)` reference; correct the
  env-IDs source-of-truth comment; document the optional `skip_build` field
  in ALL_SERVICES; clarify that health_path is informational and verify
  uses per-service drivers; add the missing `resolve-targets` step 0 to the
  promote workflow's "Order:" header.

Aggregator fix (RED-GREEN):
- aggregate-build-results.ts: throw on zero slot dirs. The job is gated
  upstream on has_changes == 'true', so zero slot dirs is a broken artifact
  download, not a legitimate empty build set. Silently emitting
  any_success=false + results=[] is indistinguishable from "all builds
  failed" and lets the deploy workflow fall back to probing the full
  service set against stale `:latest`. Refuse the ambiguity.
- aggregate-build-results.test.ts: existing empty-INPUT_DIR test was
  updated to assert the throw (was: return []).

Oxlint rule (RED-GREEN):
- no-public-env-shell-read.mjs: handle destructuring reads
  (const { NEXT_PUBLIC_X } = process.env and aliased form), template-literal
  computed keys (process.env[\`NEXT_PUBLIC_X\`]), and explicitly skip
  assignment-LHS / `delete` targets (writes are not reads). Optional
  chaining already worked through the existing MemberExpression path.
  Aliasing (`const e = process.env; e.X`) is intentionally documented as
  out of scope (needs scope tracking). Description sharpened to say the
  rule guards a specific banned-key set, not all NEXT_PUBLIC_* reads.
- .oxlintrc.json: tighten the off-override glob from
  `showcase/**/*runtime-config*` to
  `showcase/**/lib/runtime-config*.{ts,tsx}` so it only silences the
  intended implementation files, not arbitrary paths containing that
  substring.
- lint-rule-no-public-env.test.ts: rewritten as table-driven coverage of
  every BANNED_KEYS entry (dotted + bracket-string forms), every ALLOWED
  key (asserting non-firing), all new variants from the rule expansion,
  the assignment/delete non-fire cases, and override scoping
  (runtime-config exempt; packages exempt; shell-tree non-runtime-config
  flagged).

Validation:
- actionlint on all three workflows: 8 pre-existing findings (depot label,
  pre-existing SC2086 infos in untouched steps); my edits add zero.
- python3 yaml.safe_load: all three workflows OK.
- vitest aggregate-build-results.test.ts: 6/6 pass (incl. new throw test).
- vitest lint-rule-no-public-env.test.ts: 34/34 pass.
- vitest full showcase/scripts suite: 1654/1654 pass across 46 files.
- ruby showcase/bin/spec/all_tests.rb: 87 runs, 0 failures.
- Intersection jq proof (matrix a,b,c × success a,c) → "a,c"; all-failed
  → ""; skipped status excluded.
2026-05-29 11:45:14 -07:00

156 lines
5.8 KiB
TypeScript

/**
* aggregate-build-results.test.ts — covers the per-slot aggregator that
* runs in the `aggregate-build-results` job of showcase_build.yml.
*
* The script's `run({inputDir, outputDir, githubOutput})` entrypoint is
* exercised directly with temp dirs (so we never touch tracked files or
* spawn subprocesses). We verify:
* 1. empty INPUT_DIR → results.json = `[]`, any_success=false, no throw
* 2. build-result-<x> dir missing result.json → throws naming the slot
* 3. non-`build-result-*` dirs are ignored
* 4. mixed success/failure → correct merged array + any_success=true
* 5. GITHUB_OUTPUT receives heredoc-form `results` block + any_success
*/
import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { afterEach, beforeEach, describe, expect, it } from "vitest";
import { run } from "../aggregate-build-results";
function makeSlot(
inputDir: string,
service: string,
status: "success" | "failure" | "skipped",
): void {
const dir = join(inputDir, `build-result-${service}`);
mkdirSync(dir, { recursive: true });
writeFileSync(join(dir, "result.json"), JSON.stringify({ service, status }));
}
describe("aggregate-build-results.run", () => {
let inputDir: string;
let outputDir: string;
let githubOutput: string;
beforeEach(() => {
const base = mkdtempSync(join(tmpdir(), "agg-build-"));
inputDir = join(base, "in");
outputDir = join(base, "out");
githubOutput = join(base, "gh_output");
mkdirSync(inputDir, { recursive: true });
// OUTPUT_DIR intentionally NOT pre-created — run() must mkdir -p.
writeFileSync(githubOutput, "");
});
afterEach(() => {
// Temp dirs are under os.tmpdir(); OS reaps them. No tracked files
// touched, so no cleanup needed.
});
it("empty INPUT_DIR → throws (broken artifact download — the aggregator only runs when >=1 service was scheduled)", () => {
// The aggregator is gated on `has_changes == 'true'` upstream, so the
// matrix is guaranteed non-empty by the time we run. A zero-slot input
// dir therefore means the per-slot artifact download produced nothing
// (broken download, expired artifacts, mis-scoped run-id). Silently
// emitting `any_success=false` with `results=[]` is indistinguishable
// from "all builds failed" — that's a false-green path because the
// deploy workflow then has no success set to intersect against and
// falls back to probing the full service set against stale :latest.
// We refuse the ambiguity and fail loud instead.
expect(() => run({ inputDir, outputDir, githubOutput })).toThrow(
/aggregate-build-results: found 0 build-result-\* slot dirs/,
);
});
it("throws naming the slot when build-result-<x>/result.json is missing", () => {
const slotDir = join(inputDir, "build-result-orphan");
mkdirSync(slotDir, { recursive: true });
// Note: NO result.json written.
expect(() => run({ inputDir, outputDir, githubOutput })).toThrow(
/aggregate-build-results: build-result-orphan is missing result\.json/,
);
});
it("ignores directories that do not match build-result-*", () => {
mkdirSync(join(inputDir, "some-other-artifact"), { recursive: true });
writeFileSync(
join(inputDir, "some-other-artifact", "result.json"),
JSON.stringify({ service: "noise", status: "success" }),
);
// A file (not a directory) at top level should also be ignored.
writeFileSync(join(inputDir, "build-result-not-a-dir"), "garbage");
makeSlot(inputDir, "real", "success");
run({ inputDir, outputDir, githubOutput });
const results = JSON.parse(
readFileSync(join(outputDir, "results.json"), "utf-8"),
);
expect(results).toEqual([{ service: "real", status: "success" }]);
});
it("merges mixed success/failure correctly and sets any_success=true", () => {
makeSlot(inputDir, "alpha", "success");
makeSlot(inputDir, "beta", "failure");
makeSlot(inputDir, "gamma", "skipped");
run({ inputDir, outputDir, githubOutput });
const results = JSON.parse(
readFileSync(join(outputDir, "results.json"), "utf-8"),
);
expect(results).toHaveLength(3);
const byName = new Map<string, string>(
(results as Array<{ service: string; status: string }>).map((r) => [
r.service,
r.status,
]),
);
expect(byName.get("alpha")).toBe("success");
expect(byName.get("beta")).toBe("failure");
expect(byName.get("gamma")).toBe("skipped");
const gh = readFileSync(githubOutput, "utf-8");
expect(gh).toContain("any_success=true");
});
it("writes results to GITHUB_OUTPUT in multi-line heredoc form", () => {
makeSlot(inputDir, "alpha", "success");
makeSlot(inputDir, "beta", "failure");
run({ inputDir, outputDir, githubOutput });
const gh = readFileSync(githubOutput, "utf-8");
// The heredoc form is:
// results<<EOF
// <json>
// EOF
// The delimiter token is implementation-defined but must match on
// both sides (GitHub Actions convention; commonly "EOF" or a unique
// token to avoid collision with embedded payloads).
const heredocRe = /results<<(\S+)\n([\s\S]*?)\n\1\n/;
const match = gh.match(heredocRe);
expect(match).not.toBeNull();
if (!match) return;
const [, , jsonBody] = match;
const parsed = JSON.parse(jsonBody);
expect(Array.isArray(parsed)).toBe(true);
expect(parsed).toHaveLength(2);
// any_success line is still a plain key=value.
expect(gh).toMatch(/any_success=true\n/);
});
it("results.json has a trailing newline", () => {
makeSlot(inputDir, "alpha", "success");
run({ inputDir, outputDir, githubOutput });
const raw = readFileSync(join(outputDir, "results.json"), "utf-8");
expect(raw.endsWith("\n")).toBe(true);
});
});