mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
385f412fba
Move untrusted PR event data (title, head ref, base ref, SHAs) from
inline ${{ }} interpolation in shell run: blocks to env: blocks,
referencing them as shell variables instead. This prevents arbitrary
code execution via crafted PR titles or branch names.
Affected workflows:
- test_smoke-starter.yml: PR title, user login, head SHA
- publish-release.yml: PR head ref (branch name)
- static_quality.yml: PR base ref, base SHA, head SHA
168 lines
7.5 KiB
YAML
168 lines
7.5 KiB
YAML
name: test / smoke / starter
|
|
|
|
on:
|
|
schedule:
|
|
# Every 6 hours — catches floating dep breakage
|
|
- cron: "0 */6 * * *"
|
|
workflow_run:
|
|
workflows: ["publish / release"]
|
|
types: [completed]
|
|
pull_request:
|
|
paths:
|
|
- "examples/integrations/**"
|
|
- ".github/workflows/test_smoke-starter.yml"
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
jobs:
|
|
smoke-starter:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
strategy:
|
|
matrix:
|
|
starter:
|
|
- langgraph-python
|
|
- mastra
|
|
- langgraph-js
|
|
- crewai-crews
|
|
- pydantic-ai
|
|
- adk
|
|
- agno
|
|
- llamaindex
|
|
- langgraph-fastapi
|
|
- strands-python
|
|
- ms-agent-framework-python
|
|
- ms-agent-framework-dotnet
|
|
fail-fast: false
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 1
|
|
lfs: false
|
|
|
|
- name: Run starter smoke tests
|
|
working-directory: examples/integrations/${{ matrix.starter }}
|
|
env:
|
|
STARTER: ${{ matrix.starter }}
|
|
# Starters whose SDK can't be intercepted by aimock (currently
|
|
# google-adk — google-genai ignores endpoint overrides) need a
|
|
# real provider key. docker-compose.test.yml for those starters
|
|
# reads this via `${GOOGLE_API_KEY:-test-key-for-aimock}` so
|
|
# unaffected starters still run offline against aimock.
|
|
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
|
|
run: |
|
|
docker compose -f docker-compose.test.yml up --abort-on-container-exit --exit-code-from tests
|
|
|
|
- name: Capture failure cause
|
|
if: failure()
|
|
id: failure-cause
|
|
working-directory: examples/integrations/${{ matrix.starter }}
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
PR_USER_LOGIN: ${{ github.event.pull_request.user.login }}
|
|
PR_TITLE: ${{ github.event.pull_request.title }}
|
|
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
{
|
|
echo "summary<<CAUSE_EOF"
|
|
|
|
# Capture error from container logs (containers still running at this point)
|
|
build_err=$(docker compose -f docker-compose.test.yml logs app 2>&1 | grep -E "ERR_|Error:|error:|Build error|failed to" | head -3)
|
|
agent_err=$(docker compose -f docker-compose.test.yml logs agent 2>&1 | grep -E "Error:|Traceback|ModuleNotFoundError|ImportError" | head -3)
|
|
test_err=$(docker compose -f docker-compose.test.yml logs tests 2>&1 | grep -E "✘|FAIL|Error:|expect\(" | head -5)
|
|
|
|
if [ -n "$build_err" ]; then
|
|
echo "Build failure:"
|
|
echo "$build_err"
|
|
elif [ -n "$agent_err" ]; then
|
|
echo "Agent crash:"
|
|
echo "$agent_err"
|
|
elif [ -n "$test_err" ]; then
|
|
echo "Test failure:"
|
|
echo "$test_err"
|
|
else
|
|
echo "Unknown failure — check run logs"
|
|
fi
|
|
|
|
echo ""
|
|
|
|
# Identify recent changes that may have caused the failure
|
|
if [ "$EVENT_NAME" = "pull_request" ]; then
|
|
echo "Triggered by PR #${PR_NUMBER} (${PR_USER_LOGIN}): ${PR_TITLE}"
|
|
echo "Head: ${PR_HEAD_SHA}"
|
|
elif [ "$EVENT_NAME" = "schedule" ] || [ "$EVENT_NAME" = "workflow_run" ]; then
|
|
# Use GitHub API instead of git log (avoids needing deep clone)
|
|
echo "Recent commits touching this starter (last 12h):"
|
|
gh api "repos/${{ github.repository }}/commits?path=examples/integrations/${{ matrix.starter }}&since=$(date -u -d '12 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-12H +%Y-%m-%dT%H:%M:%SZ)&per_page=5" \
|
|
--jq '.[] | "\(.sha[0:7]) \(.commit.message | split("\n")[0])"' 2>/dev/null || true
|
|
starter_commits=$(gh api "repos/${{ github.repository }}/commits?path=examples/integrations/${{ matrix.starter }}&since=$(date -u -d '12 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-12H +%Y-%m-%dT%H:%M:%SZ)&per_page=1" --jq 'length' 2>/dev/null || echo "0")
|
|
if [ "$starter_commits" = "0" ]; then
|
|
echo "No starter code changes — likely a floating dependency update or upstream CopilotKit release"
|
|
echo "Recent releases:"
|
|
gh api "repos/${{ github.repository }}/releases?per_page=3" \
|
|
--jq '.[] | "\(.tag_name) (\(.published_at[0:10]))"' 2>/dev/null | head -3 || true
|
|
fi
|
|
fi
|
|
echo "CAUSE_EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Tear down
|
|
if: always()
|
|
working-directory: examples/integrations/${{ matrix.starter }}
|
|
run: docker compose -f docker-compose.test.yml down -v
|
|
|
|
- name: Upload test artifacts on failure
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: smoke-starter-${{ matrix.starter }}
|
|
path: showcase/tests/test-results/
|
|
retention-days: 7
|
|
|
|
# Sanitize the failure summary and stash it in $GITHUB_ENV so the
|
|
# inline Slack payload can reference it via `env.summary`. We don't
|
|
# write to a payload file because slackapi/slack-github-action@v2.1.0
|
|
# rejects payload files that don't end in `.json`/`.yaml`/`.yml`
|
|
# (mktemp produces extensionless files), and `jq --rawfile` can also
|
|
# crash under `set -e` on edge-case inputs, leaving an empty/missing
|
|
# payload and silently suppressing the alert. Inline `payload:` with
|
|
# `toJSON(format(...))` sidesteps both failure modes — quotes,
|
|
# backslashes, newlines in the summary are safely JSON-encoded by
|
|
# toJSON, and there's no intermediate file to mishandle. This is the
|
|
# same pattern used in test_smoke-starter-deployed.yml (PR #4068) and
|
|
# showcase_validate.yml.
|
|
- name: Prepare Slack alert fields
|
|
if: failure() && (github.event_name == 'schedule' || github.event_name == 'workflow_run')
|
|
env:
|
|
SUMMARY_RAW: ${{ steps.failure-cause.outputs.summary }}
|
|
run: |
|
|
# Strip ANSI sequences (SGR, OSC, and G0/G1 charset designators), then truncate
|
|
# to 200 bytes and drop any trailing partial UTF-8 bytes so we don't emit mojibake.
|
|
SUMMARY=$(printf '%s' "$SUMMARY_RAW" | head -3 \
|
|
| sed -E 's/\x1b\[[0-9;?]*[A-Za-z]//g; s/\x1b\][^\x07]*\x07//g; s/\x1b[()][A-Za-z0-9]//g' \
|
|
| head -c 200 | iconv -f UTF-8 -t UTF-8//IGNORE)
|
|
if [ -z "$SUMMARY" ]; then
|
|
SUMMARY="(no failure detail captured — see job log)"
|
|
fi
|
|
# Emit via heredoc so embedded `=`, quotes, or newlines don't
|
|
# break KEY=VALUE parsing in $GITHUB_ENV.
|
|
{
|
|
echo "summary<<EOF_SUMMARY_7a4c"
|
|
printf '%s\n' "$SUMMARY"
|
|
echo "EOF_SUMMARY_7a4c"
|
|
} >> "$GITHUB_ENV"
|
|
|
|
- name: Alert Slack on failure
|
|
if: failure() && (github.event_name == 'schedule' || github.event_name == 'workflow_run')
|
|
uses: slackapi/slack-github-action@v2.1.0
|
|
with:
|
|
webhook: ${{ secrets.SLACK_WEBHOOK_OSS_ALERTS }}
|
|
webhook-type: incoming-webhook
|
|
payload: |
|
|
{ "text": ${{ toJSON(format(':x: *Starter smoke test failing: {0}*\n<{1}/{2}/actions/runs/{3}|View run> · <{1}/{2}/actions/runs/{3}/job/{4}|View job>\n```{5}```', matrix.starter, github.server_url, github.repository, github.run_id, github.job, env.summary)) }} }
|