Files
copilotkit__copilotkit/.github/workflows/test_smoke-starter.yml
Jordan Ritter 385f412fba Fix GitHub Actions template injection (CWE-78) in workflow shell commands
Move untrusted PR event data (title, head ref, base ref, SHAs) from
inline ${{ }} interpolation in shell run: blocks to env: blocks,
referencing them as shell variables instead. This prevents arbitrary
code execution via crafted PR titles or branch names.

Affected workflows:
- test_smoke-starter.yml: PR title, user login, head SHA
- publish-release.yml: PR head ref (branch name)
- static_quality.yml: PR base ref, base SHA, head SHA
2026-05-03 13:27:35 -07:00

168 lines
7.5 KiB
YAML

name: test / smoke / starter
on:
schedule:
# Every 6 hours — catches floating dep breakage
- cron: "0 */6 * * *"
workflow_run:
workflows: ["publish / release"]
types: [completed]
pull_request:
paths:
- "examples/integrations/**"
- ".github/workflows/test_smoke-starter.yml"
workflow_dispatch: {}
permissions:
contents: read
packages: read
jobs:
smoke-starter:
runs-on: ubuntu-latest
timeout-minutes: 20
strategy:
matrix:
starter:
- langgraph-python
- mastra
- langgraph-js
- crewai-crews
- pydantic-ai
- adk
- agno
- llamaindex
- langgraph-fastapi
- strands-python
- ms-agent-framework-python
- ms-agent-framework-dotnet
fail-fast: false
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 1
lfs: false
- name: Run starter smoke tests
working-directory: examples/integrations/${{ matrix.starter }}
env:
STARTER: ${{ matrix.starter }}
# Starters whose SDK can't be intercepted by aimock (currently
# google-adk — google-genai ignores endpoint overrides) need a
# real provider key. docker-compose.test.yml for those starters
# reads this via `${GOOGLE_API_KEY:-test-key-for-aimock}` so
# unaffected starters still run offline against aimock.
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
run: |
docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from tests
- name: Capture failure cause
if: failure()
id: failure-cause
working-directory: examples/integrations/${{ matrix.starter }}
env:
EVENT_NAME: ${{ github.event_name }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_USER_LOGIN: ${{ github.event.pull_request.user.login }}
PR_TITLE: ${{ github.event.pull_request.title }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
{
echo "summary<<CAUSE_EOF"
# Capture error from container logs (containers still running at this point)
build_err=$(docker compose -f docker-compose.test.yml logs app 2>&1 | grep -E "ERR_|Error:|error:|Build error|failed to" | head -3)
agent_err=$(docker compose -f docker-compose.test.yml logs agent 2>&1 | grep -E "Error:|Traceback|ModuleNotFoundError|ImportError" | head -3)
test_err=$(docker compose -f docker-compose.test.yml logs tests 2>&1 | grep -E "✘|FAIL|Error:|expect\(" | head -5)
if [ -n "$build_err" ]; then
echo "Build failure:"
echo "$build_err"
elif [ -n "$agent_err" ]; then
echo "Agent crash:"
echo "$agent_err"
elif [ -n "$test_err" ]; then
echo "Test failure:"
echo "$test_err"
else
echo "Unknown failure — check run logs"
fi
echo ""
# Identify recent changes that may have caused the failure
if [ "$EVENT_NAME" = "pull_request" ]; then
echo "Triggered by PR #${PR_NUMBER} (${PR_USER_LOGIN}): ${PR_TITLE}"
echo "Head: ${PR_HEAD_SHA}"
elif [ "$EVENT_NAME" = "schedule" ] || [ "$EVENT_NAME" = "workflow_run" ]; then
# Use GitHub API instead of git log (avoids needing deep clone)
echo "Recent commits touching this starter (last 12h):"
gh api "repos/${{ github.repository }}/commits?path=examples/integrations/${{ matrix.starter }}&since=$(date -u -d '12 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-12H +%Y-%m-%dT%H:%M:%SZ)&per_page=5" \
--jq '.[] | "\(.sha[0:7]) \(.commit.message | split("\n")[0])"' 2>/dev/null || true
starter_commits=$(gh api "repos/${{ github.repository }}/commits?path=examples/integrations/${{ matrix.starter }}&since=$(date -u -d '12 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-12H +%Y-%m-%dT%H:%M:%SZ)&per_page=1" --jq 'length' 2>/dev/null || echo "0")
if [ "$starter_commits" = "0" ]; then
echo "No starter code changes — likely a floating dependency update or upstream CopilotKit release"
echo "Recent releases:"
gh api "repos/${{ github.repository }}/releases?per_page=3" \
--jq '.[] | "\(.tag_name) (\(.published_at[0:10]))"' 2>/dev/null | head -3 || true
fi
fi
echo "CAUSE_EOF"
} >> "$GITHUB_OUTPUT"
- name: Tear down
if: always()
working-directory: examples/integrations/${{ matrix.starter }}
run: docker compose -f docker-compose.test.yml down -v
- name: Upload test artifacts on failure
if: failure()
uses: actions/upload-artifact@v4
with:
name: smoke-starter-${{ matrix.starter }}
path: showcase/tests/test-results/
retention-days: 7
# Sanitize the failure summary and stash it in $GITHUB_ENV so the
# inline Slack payload can reference it via `env.summary`. We don't
# write to a payload file because slackapi/slack-github-action@v2.1.0
# rejects payload files that don't end in `.json`/`.yaml`/`.yml`
# (mktemp produces extensionless files), and `jq --rawfile` can also
# crash under `set -e` on edge-case inputs, leaving an empty/missing
# payload and silently suppressing the alert. Inline `payload:` with
# `toJSON(format(...))` sidesteps both failure modes — quotes,
# backslashes, newlines in the summary are safely JSON-encoded by
# toJSON, and there's no intermediate file to mishandle. This is the
# same pattern used in test_smoke-starter-deployed.yml (PR #4068) and
# showcase_validate.yml.
- name: Prepare Slack alert fields
if: failure() && (github.event_name == 'schedule' || github.event_name == 'workflow_run')
env:
SUMMARY_RAW: ${{ steps.failure-cause.outputs.summary }}
run: |
# Strip ANSI sequences (SGR, OSC, and G0/G1 charset designators), then truncate
# to 200 bytes and drop any trailing partial UTF-8 bytes so we don't emit mojibake.
SUMMARY=$(printf '%s' "$SUMMARY_RAW" | head -3 \
| sed -E 's/\x1b\[[0-9;?]*[A-Za-z]//g; s/\x1b\][^\x07]*\x07//g; s/\x1b[()][A-Za-z0-9]//g' \
| head -c 200 | iconv -f UTF-8 -t UTF-8//IGNORE)
if [ -z "$SUMMARY" ]; then
SUMMARY="(no failure detail captured — see job log)"
fi
# Emit via heredoc so embedded `=`, quotes, or newlines don't
# break KEY=VALUE parsing in $GITHUB_ENV.
{
echo "summary<<EOF_SUMMARY_7a4c"
printf '%s\n' "$SUMMARY"
echo "EOF_SUMMARY_7a4c"
} >> "$GITHUB_ENV"
- name: Alert Slack on failure
if: failure() && (github.event_name == 'schedule' || github.event_name == 'workflow_run')
uses: slackapi/slack-github-action@v2.1.0
with:
webhook: ${{ secrets.SLACK_WEBHOOK_OSS_ALERTS }}
webhook-type: incoming-webhook
payload: |
{ "text": ${{ toJSON(format(':x: *Starter smoke test failing: {0}*\n<{1}/{2}/actions/runs/{3}|View run> · <{1}/{2}/actions/runs/{3}/job/{4}|View job>\n```{5}```', matrix.starter, github.server_url, github.repository, github.run_id, github.job, env.summary)) }} }