mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
a6239cde11
Seven-agent CR surfaced correctness defects in the build/deploy/promote pipeline and in the no-public-env-shell-read oxlint rule. This commit closes the false-green paths and broadens lint coverage. Workflow fixes: - showcase_deploy.yml: drop `continue-on-error: true` on the redeploy-summary artifact download. The dispatch path is already guarded by the `if: workflow_run` clause, so the bash "no summary" branch handles legitimate manual dispatches. A genuine workflow_run download failure must now fail loud instead of silently widening verify to the full service set against stale `:latest`. - showcase_build.yml: redeploy-staging now intersects the build matrix with the aggregator success set (`needs.aggregate-build-results.outputs.results`, status == "success") before producing the redeploy CSV. Failed/skipped slots no longer get redeployed (which would just re-pull stale `:latest` and look healthy). - showcase_build.yml: `notify-all-builds-failed` now additionally requires `needs.build.result == 'failure'` so it doesn't Slack-spam when the build job was SKIPPED (verify-image-refs upstream failure). - showcase_build.yml: `notify` now lists [build, aggregate-build-results, redeploy-staging] in `needs:` so aggregator/redeploy failures still emit a Slack signal. `if: failure()` still skips when none of the needs failed. - showcase_build.yml: `set -euo pipefail` on the Prepare build args step so a transient $GITHUB_OUTPUT write failure can't ship images without COMMIT_SHA/BRANCH baked in. - showcase_deploy.yml: `enforce-redeploy-gate` now also trips on a resolve-matrix failure (`needs.resolve-matrix.result == 'failure'`) so an upstream crash that leaves `redeploy_red` empty can't bypass the gate. - Doc-comment accuracy: drop stale `(PR #5093)` reference; correct the env-IDs source-of-truth comment; document the optional `skip_build` field in ALL_SERVICES; clarify that health_path is informational and verify uses per-service drivers; add the missing `resolve-targets` step 0 to the promote workflow's "Order:" header. Aggregator fix (RED-GREEN): - aggregate-build-results.ts: throw on zero slot dirs. The job is gated upstream on has_changes == 'true', so zero slot dirs is a broken artifact download, not a legitimate empty build set. Silently emitting any_success=false + results=[] is indistinguishable from "all builds failed" and lets the deploy workflow fall back to probing the full service set against stale `:latest`. Refuse the ambiguity. - aggregate-build-results.test.ts: existing empty-INPUT_DIR test was updated to assert the throw (was: return []). Oxlint rule (RED-GREEN): - no-public-env-shell-read.mjs: handle destructuring reads (const { NEXT_PUBLIC_X } = process.env and aliased form), template-literal computed keys (process.env[\`NEXT_PUBLIC_X\`]), and explicitly skip assignment-LHS / `delete` targets (writes are not reads). Optional chaining already worked through the existing MemberExpression path. Aliasing (`const e = process.env; e.X`) is intentionally documented as out of scope (needs scope tracking). Description sharpened to say the rule guards a specific banned-key set, not all NEXT_PUBLIC_* reads. - .oxlintrc.json: tighten the off-override glob from `showcase/**/*runtime-config*` to `showcase/**/lib/runtime-config*.{ts,tsx}` so it only silences the intended implementation files, not arbitrary paths containing that substring. - lint-rule-no-public-env.test.ts: rewritten as table-driven coverage of every BANNED_KEYS entry (dotted + bracket-string forms), every ALLOWED key (asserting non-firing), all new variants from the rule expansion, the assignment/delete non-fire cases, and override scoping (runtime-config exempt; packages exempt; shell-tree non-runtime-config flagged). Validation: - actionlint on all three workflows: 8 pre-existing findings (depot label, pre-existing SC2086 infos in untouched steps); my edits add zero. - python3 yaml.safe_load: all three workflows OK. - vitest aggregate-build-results.test.ts: 6/6 pass (incl. new throw test). - vitest lint-rule-no-public-env.test.ts: 34/34 pass. - vitest full showcase/scripts suite: 1654/1654 pass across 46 files. - ruby showcase/bin/spec/all_tests.rb: 87 runs, 0 failures. - Intersection jq proof (matrix a,b,c × success a,c) → "a,c"; all-failed → ""; skipped status excluded.
156 lines
5.8 KiB
TypeScript
156 lines
5.8 KiB
TypeScript
/**
|
|
* aggregate-build-results.test.ts — covers the per-slot aggregator that
|
|
* runs in the `aggregate-build-results` job of showcase_build.yml.
|
|
*
|
|
* The script's `run({inputDir, outputDir, githubOutput})` entrypoint is
|
|
* exercised directly with temp dirs (so we never touch tracked files or
|
|
* spawn subprocesses). We verify:
|
|
* 1. empty INPUT_DIR → results.json = `[]`, any_success=false, no throw
|
|
* 2. build-result-<x> dir missing result.json → throws naming the slot
|
|
* 3. non-`build-result-*` dirs are ignored
|
|
* 4. mixed success/failure → correct merged array + any_success=true
|
|
* 5. GITHUB_OUTPUT receives heredoc-form `results` block + any_success
|
|
*/
|
|
import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { afterEach, beforeEach, describe, expect, it } from "vitest";
|
|
import { run } from "../aggregate-build-results";
|
|
|
|
function makeSlot(
|
|
inputDir: string,
|
|
service: string,
|
|
status: "success" | "failure" | "skipped",
|
|
): void {
|
|
const dir = join(inputDir, `build-result-${service}`);
|
|
mkdirSync(dir, { recursive: true });
|
|
writeFileSync(join(dir, "result.json"), JSON.stringify({ service, status }));
|
|
}
|
|
|
|
describe("aggregate-build-results.run", () => {
|
|
let inputDir: string;
|
|
let outputDir: string;
|
|
let githubOutput: string;
|
|
|
|
beforeEach(() => {
|
|
const base = mkdtempSync(join(tmpdir(), "agg-build-"));
|
|
inputDir = join(base, "in");
|
|
outputDir = join(base, "out");
|
|
githubOutput = join(base, "gh_output");
|
|
mkdirSync(inputDir, { recursive: true });
|
|
// OUTPUT_DIR intentionally NOT pre-created — run() must mkdir -p.
|
|
writeFileSync(githubOutput, "");
|
|
});
|
|
|
|
afterEach(() => {
|
|
// Temp dirs are under os.tmpdir(); OS reaps them. No tracked files
|
|
// touched, so no cleanup needed.
|
|
});
|
|
|
|
it("empty INPUT_DIR → throws (broken artifact download — the aggregator only runs when >=1 service was scheduled)", () => {
|
|
// The aggregator is gated on `has_changes == 'true'` upstream, so the
|
|
// matrix is guaranteed non-empty by the time we run. A zero-slot input
|
|
// dir therefore means the per-slot artifact download produced nothing
|
|
// (broken download, expired artifacts, mis-scoped run-id). Silently
|
|
// emitting `any_success=false` with `results=[]` is indistinguishable
|
|
// from "all builds failed" — that's a false-green path because the
|
|
// deploy workflow then has no success set to intersect against and
|
|
// falls back to probing the full service set against stale :latest.
|
|
// We refuse the ambiguity and fail loud instead.
|
|
expect(() => run({ inputDir, outputDir, githubOutput })).toThrow(
|
|
/aggregate-build-results: found 0 build-result-\* slot dirs/,
|
|
);
|
|
});
|
|
|
|
it("throws naming the slot when build-result-<x>/result.json is missing", () => {
|
|
const slotDir = join(inputDir, "build-result-orphan");
|
|
mkdirSync(slotDir, { recursive: true });
|
|
// Note: NO result.json written.
|
|
|
|
expect(() => run({ inputDir, outputDir, githubOutput })).toThrow(
|
|
/aggregate-build-results: build-result-orphan is missing result\.json/,
|
|
);
|
|
});
|
|
|
|
it("ignores directories that do not match build-result-*", () => {
|
|
mkdirSync(join(inputDir, "some-other-artifact"), { recursive: true });
|
|
writeFileSync(
|
|
join(inputDir, "some-other-artifact", "result.json"),
|
|
JSON.stringify({ service: "noise", status: "success" }),
|
|
);
|
|
// A file (not a directory) at top level should also be ignored.
|
|
writeFileSync(join(inputDir, "build-result-not-a-dir"), "garbage");
|
|
|
|
makeSlot(inputDir, "real", "success");
|
|
|
|
run({ inputDir, outputDir, githubOutput });
|
|
|
|
const results = JSON.parse(
|
|
readFileSync(join(outputDir, "results.json"), "utf-8"),
|
|
);
|
|
expect(results).toEqual([{ service: "real", status: "success" }]);
|
|
});
|
|
|
|
it("merges mixed success/failure correctly and sets any_success=true", () => {
|
|
makeSlot(inputDir, "alpha", "success");
|
|
makeSlot(inputDir, "beta", "failure");
|
|
makeSlot(inputDir, "gamma", "skipped");
|
|
|
|
run({ inputDir, outputDir, githubOutput });
|
|
|
|
const results = JSON.parse(
|
|
readFileSync(join(outputDir, "results.json"), "utf-8"),
|
|
);
|
|
expect(results).toHaveLength(3);
|
|
const byName = new Map<string, string>(
|
|
(results as Array<{ service: string; status: string }>).map((r) => [
|
|
r.service,
|
|
r.status,
|
|
]),
|
|
);
|
|
expect(byName.get("alpha")).toBe("success");
|
|
expect(byName.get("beta")).toBe("failure");
|
|
expect(byName.get("gamma")).toBe("skipped");
|
|
|
|
const gh = readFileSync(githubOutput, "utf-8");
|
|
expect(gh).toContain("any_success=true");
|
|
});
|
|
|
|
it("writes results to GITHUB_OUTPUT in multi-line heredoc form", () => {
|
|
makeSlot(inputDir, "alpha", "success");
|
|
makeSlot(inputDir, "beta", "failure");
|
|
|
|
run({ inputDir, outputDir, githubOutput });
|
|
|
|
const gh = readFileSync(githubOutput, "utf-8");
|
|
|
|
// The heredoc form is:
|
|
// results<<EOF
|
|
// <json>
|
|
// EOF
|
|
// The delimiter token is implementation-defined but must match on
|
|
// both sides (GitHub Actions convention; commonly "EOF" or a unique
|
|
// token to avoid collision with embedded payloads).
|
|
const heredocRe = /results<<(\S+)\n([\s\S]*?)\n\1\n/;
|
|
const match = gh.match(heredocRe);
|
|
expect(match).not.toBeNull();
|
|
if (!match) return;
|
|
const [, , jsonBody] = match;
|
|
const parsed = JSON.parse(jsonBody);
|
|
expect(Array.isArray(parsed)).toBe(true);
|
|
expect(parsed).toHaveLength(2);
|
|
|
|
// any_success line is still a plain key=value.
|
|
expect(gh).toMatch(/any_success=true\n/);
|
|
});
|
|
|
|
it("results.json has a trailing newline", () => {
|
|
makeSlot(inputDir, "alpha", "success");
|
|
|
|
run({ inputDir, outputDir, githubOutput });
|
|
|
|
const raw = readFileSync(join(outputDir, "results.json"), "utf-8");
|
|
expect(raw.endsWith("\n")).toBe(true);
|
|
});
|
|
});
|