* fix: skip orphan cleanup when running inside a Docker container
When agent-ci runs nested inside a container (e.g. smoke-bun-setup step 8),
it shares the host's Docker socket. killOrphanedContainers() checks
agent-ci.pid labels using process.kill(pid, 0), but host PIDs don't
exist in the container's PID namespace — so every container looks like
an orphan. This caused the nested agent-ci to force-remove its own
parent container (exit 137).
Both pruneOrphanedDockerResources() and killOrphanedContainers() now
bail out when /.dockerenv exists.
Fixes#228
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: ignore inherited AGENT_CI_DTU_HOST inside containers
When agent-ci runs nested inside a container (e.g. smoke-bun-setup),
the outer container's AGENT_CI_DTU_HOST=host.docker.internal is
inherited. The nested agent-ci used this to tell the inner container
where the DTU is, but the nested DTU is inside the outer container,
not on the host. The inner container got "Connection refused" trying
to reach host.docker.internal:PORT.
Now when /.dockerenv exists, AGENT_CI_DTU_HOST is ignored and the
container's own IP (via hostname -I) is used instead, so sibling
containers can reach the DTU.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: move /.dockerenv guard to call site so tests still work
The /.dockerenv check inside killOrphanedContainers() broke the
shutdown integration tests — they run inside a Docker container (the
test runner) and need the function to work. Moved the guard to the
session bootstrap in cli.ts where the nested agent-ci problem occurs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add global concurrency limiter across all workflows
In --all mode, each workflow created its own per-wave limiter, allowing
20+ containers to run simultaneously and exhaust available memory (OOM
kills with exit 137). Now a single global limiter (CPU/2) is created in
the orchestrator and shared by all handleWorkflow calls, including
single-job workflows and cold-cache first jobs.
Closes#225
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: factor Docker VM memory into concurrency limit
CPU-based limit alone (cpuCount/2 = 7) still causes OOM kills. Now
reads MemAvailable from /proc/meminfo inside the Docker VM and caps
at floor(available / 3GB per container). Falls back to docker info
with a 4GB reserve if busybox isn't available.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: guard orphan cleanup in the function, not just the call site
The /.dockerenv guard was only in cli.ts, but killOrphanedContainers
is also called directly by the Docker integration tests (via a spawned
tsx subprocess). Inside a container, the test's subprocess would see
the parent container's PID label, misidentify it as an orphan, and
kill the container running the tests.
Put the guard back in both functions AND keep the cli.ts guard.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: increase per-container memory estimate to 4 GB
3 GB per container wasn't enough — tests.yml (vitest + Docker
integration tests) and smoke-binary.yml (full build) both got killed
at 3 concurrent containers. 4 GB gives 2 concurrent containers on a
12 GB Docker VM, with ~5.4 GB each.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: mock fs.existsSync in shutdown unit tests for /.dockerenv guard
The unit tests mock execSync but not fs. Inside a runner container,
the real fs.existsSync("/.dockerenv") returns true, causing
killOrphanedContainers to bail before reaching the mocked execSync.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: skip Docker integration tests for orphan cleanup inside containers
The integration tests spawn a real killOrphanedContainers() subprocess.
Inside a container, the function bails due to /.dockerenv (PID namespace
mismatch), so the tests can't exercise it. Skip them with insideDocker().
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add --jobs flag and document concurrency
Adds -j/--jobs <n> to override the auto-detected concurrency limit.
Adds a Concurrency section to the README explaining how the limit is
calculated and how to override it.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat(website): include install steps in copy agent instructions
The "Copy agent instructions" button and Terminal preview now include
setup steps: installing the package (with package manager detection for
Node.js projects, or npx for non-Node projects) and installing the
agent skill.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: unify agent instructions across repo, README, and website
Remove the .agents/ hook system and Machinen-specific CLAUDE.md instructions.
Public-facing docs (README, website) now show generic commands that work with
any agent harness. CLAUDE.md uses the /validate skill directly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: mention /validate skill on website
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add Agent Skills spec skill and update docs with `npx skills add`
Ship an agentskills.io-compatible skill at skills/agent-ci/SKILL.md so
users can install with `npx skills add redwoodjs/agent-ci --skill agent-ci`.
Works with Claude Code, Cursor, Codex, and 40+ other agents.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: add penberg testimonial, update bebraw quote
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: simplify agent instructions to reference the skill
Instead of repeating raw commands, tell agents to run the `agent-ci` skill
that was installed via `npx skills add`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: add AI disclosure to blog posts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: move AI disclosure to top of blog posts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: clarify runner image vs VM image in blog post
Explain that agent-ci uses the ~400 MB official runner binary, not
GitHub's ~30 GB VM image.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show nav links on mobile across all pages
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: wrap nav links to second row on mobile
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: show Star us button on mobile
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Test files (*.test.ts) were being compiled into dist/ and included in
the npm package. Add tsconfig exclude to keep them out of the build.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The release workflow failed because changeset-generated CHANGELOGs weren't
formatted. Fix the existing files and run oxfmt after `changeset version`
so future Version Packages PRs include formatted markdown.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: update compatibility.md to reflect current behavior
- GITHUB_TOKEN: no longer auto-injected, requires --github-token or AGENT_CI_GITHUB_TOKEN
- github.sha: now uses real commit SHA from HEAD, not hardcoded zeros
- secrets: documents env var fallback and --github-token auto-population
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update github.sha to reflect dirty-tree SHA support
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: service containers leak on unclean shutdown
Problem: Service containers (e.g. `agent-ci-*-svc-cache-db`) were created
without the `agent-ci.pid` label, making them invisible to the bootstrap
orphan cleanup (`killOrphanedContainers`). When the parent process died
without hitting its signal handler (crash, SIGKILL, Bash tool timeout),
these containers leaked permanently. Additionally, SIGHUP was not handled,
so closing a tmux pane or SSH disconnect also leaked runner containers.
Containers stuck in `created` state were also missed by the prune logic.
Solution: Label service containers with `agent-ci.pid` at creation time.
Update `killOrphanedContainers` to clean up unlabeled containers (handles
pre-fix containers) and derive the runner name from svc container names
(strip `-svc-*` suffix) with deduplication. Add SIGHUP to signal handlers
in both `cli.ts` and `local-job.ts`. Extend `pruneOrphanedDockerResources`
to also prune `status=created` containers.
Fixes#216
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add Docker integration smoke tests for orphan cleanup
Spawn real Docker containers (unlabeled, dead-PID-labeled, alive-PID-labeled)
and verify killOrphanedContainers handles each case correctly against the
real Docker daemon. Tests are skipped when Docker is unavailable.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: correct import path in orphan cleanup smoke test
The test spawns a subprocess via `npx tsx -e` which imports
shutdown.ts. The path was relative to the repo root but vitest
runs with cwd=packages/cli/, causing MODULE_NOT_FOUND in CI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: smoke repro for setup-bun cache collision (#212)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: setup-bun fails in bun projects (#212)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: service containers leak on unclean shutdown
Problem: Service containers (e.g. `agent-ci-*-svc-cache-db`) were created
without the `agent-ci.pid` label, making them invisible to the bootstrap
orphan cleanup (`killOrphanedContainers`). When the parent process died
without hitting its signal handler (crash, SIGKILL, Bash tool timeout),
these containers leaked permanently. Additionally, SIGHUP was not handled,
so closing a tmux pane or SSH disconnect also leaked runner containers.
Containers stuck in `created` state were also missed by the prune logic.
Solution: Label service containers with `agent-ci.pid` at creation time.
Update `killOrphanedContainers` to clean up unlabeled containers (handles
pre-fix containers) and derive the runner name from svc container names
(strip `-svc-*` suffix) with deduplication. Add SIGHUP to signal handlers
in both `cli.ts` and `local-job.ts`. Extend `pruneOrphanedDockerResources`
to also prune `status=created` containers.
Fixes#216
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: use XDG cache on Linux Docker Desktop so bind mounts work (#215)
`/tmp` is not in Docker Desktop's default shared-folder list on Linux,
so bind mounts from `/tmp` silently fail. Detect Linux Docker Desktop
via `~/.docker/desktop/docker.sock` and fall back to `$XDG_CACHE_HOME`
(or `~/.cache`). Also update the validate command to run agent-ci in
the background with Monitor for proper pause-on-failure support, and
note Docker Desktop as a supported Linux provider in the README.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: remove stop hook that ran agent-ci synchronously
The stop hook can't support pause-on-failure since it runs after the
conversation ends. Use `/validate` instead, which runs agent-ci in the
background with Monitor support for fixing and retrying failures.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fixes#209 — on Linux with Docker Desktop active, agent-ci failed at
runner container creation with "mounts denied" when the user isn't in
the docker group.
Splits socketPath (API client, needs R/W) and bindMountPath (container
mount source, only needs path recognition by Docker's VM) as
independent decisions. Whenever /var/run/docker.sock exists on the
host, use it as bindMountPath regardless of our process's R/W access.
Collapses #197 (macOS Desktop symlink) and #209 (Linux Desktop
non-docker-group) into one rule.
The working-directory half of the original #210 report is tracked
separately in #215.
Closes#209
Co-Authored-By: Bastiaan Steinmeier <bastiaan.steinmeier@broekhuis.nl>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Global Docker/workspace cleanup and runner-image prefetch now run once
per session instead of once per workflow. Also dedup concurrent
ensureImagePulled calls so parallel workflows share a single in-flight
docker pull. Together these eliminate the N× daemon storm that was
serializing `agent-ci run --all`.
Per-job ensureImagePulled calls remain as a safety net and take the
inspect() fast path since images are already warm.
Fixes#211
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Auto-generated CHANGELOGs from changesets don't match oxfmt's
markdown formatting, which breaks the release workflow when
changesets/action tries to commit version bumps through husky.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add smoke repro for missing cc in runner image
Minimal smoke workflow that calls `command -v cc` and compiles a
trivial C program. Reproduces a cargo/Rust workflow failure where
`linker 'cc' not found` breaks builds under agent-ci-dev because
ghcr.io/actions/actions-runner:latest does not ship build-essential.
CI-only change (no packages/ code modified) — no changeset.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: pluggable runner image via .github/agent-ci.Dockerfile (#208)
agent-ci now discovers a user-provided Dockerfile at
.github/agent-ci.Dockerfile (or .github/agent-ci/Dockerfile for builds
with a COPY context), hashes its contents, builds it locally via
`docker build`, and uses the resulting agent-ci-runner:<hash> tag as
the default runner image. Edits trigger automatic rebuilds; identical
contents reuse the cached image.
This closes the gap where the minimal ghcr.io/actions/actions-runner
image lacks build-essential, python3, and other toolchains that
GitHub's hosted ubuntu-latest VM ships preinstalled. Workflows green
on GitHub but failing locally with `linker 'cc' not found` can now
opt into a richer image by dropping a 5-line Dockerfile into .github/.
Resolution order (highest wins):
1. per-job `container:` (unchanged)
2. AGENT_CI_RUNNER_IMAGE env var
3. .github/agent-ci/Dockerfile (directory form, supports COPY)
4. .github/agent-ci.Dockerfile (simple form, empty context)
5. ghcr.io/actions/actions-runner:latest (default)
Also adds an error-hint heuristic: when a step fails with "command not
found" for cc/gcc/make/python3/pkg-config and the user is still on the
default image, the failure summary includes a paste-ready Dockerfile
pointing at the fix. Docs at packages/cli/runner-image.md.
Dogfoods the feature by shipping .github/agent-ci.Dockerfile for this
repo, which makes smoke-cc-compiler.yml (the issue #208 reproduction)
pass end-to-end.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: announce first-run runner image build
Print a one-time stderr notice before `docker build` fires so users
understand why the first run pauses for ~60s. The message lives in
stderr so log-update can't clobber it and stays in scrollback after.
Docs updated to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: clarify that container: runs verbatim, no Dockerfile layering
Spell out explicitly that a job-level container: directive bypasses
.github/agent-ci.Dockerfile entirely — agent-ci does not layer the
Dockerfile on top. This preserves the "same YAML runs locally and on
GitHub" parity promise.
Also document the two recommended ways to combine a custom base
image with agent-ci's extras.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: simplify testing instructions in CLAUDE.md
Use single `npx agent-ci run --all` command instead of separate unit/e2e steps.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: preserve symlink path for Docker socket bind mount on macOS (#197)
When /var/run/docker.sock is a symlink (Docker Desktop), the resolved
real path was used as the container bind-mount source, causing
"error while creating mount source path" in Docker's VM.
Adds `bindMountPath` to `DockerSocket` (the pre-symlink path) for bind
mounts, while `socketPath` (resolved) continues to be used for the
Docker API client. Adds a regression test for the specific failure case.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: suppress passing step output in quiet mode
In --quiet mode, only emit failures and pause messages. Completed
and running step lines (✓/▸) and "Starting runner" headers were
noise on a passing run -- the final printSummary covers everything.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test: add repro-197 integration test for Docker Desktop socket bind mount
Tests the full chain from filesystem state → socket resolution → container
bind string. Verifies that /var/run/docker.sock (the symlink) is used as
the bind-mount source, never the resolved ~/.docker/run/docker.sock that
causes Docker Desktop's VM to fail with "error while creating mount source path".
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* docs: simplify testing instructions in CLAUDE.md
Use single `npx agent-ci run --all` command instead of separate unit/e2e steps.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: pull runner image before createContainer to fix first-run failure
Fixes#203
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
When no --sha flag is given and the working tree is dirty, compute an
ephemeral commit SHA via git write-tree / commit-tree that represents
the actual code being executed. No refs are moved and history is
untouched.
Closes#198
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The last output lines and retry/abort hints were only displayed in
single-job mode. Multi-job workflows (e.g. build + test) would show
"Step failed attempt #1" with no error context or instructions.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
When multiple matrix jobs fail with the same error (e.g. missing secrets),
the FAILURES section now groups them and shows the error once instead of
repeating it for each job. Streaming error messages are also deduplicated.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: resolve workflow secrets from shell environment variables
Shell env vars now act as a fallback for .env.agent-ci when resolving
${{ secrets.FOO }} references. Also auto-populates secrets.GITHUB_TOKEN
from --github-token.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add loadMachineSecrets env fallback tests, update README
Add 7 tests covering process.env fallback behavior in loadMachineSecrets:
file precedence, env-only resolution, key scoping, and merge behavior.
Add a Secrets section to the README documenting resolution order.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Checkout v6 added post-fetch validation that the checked-out ref matches
github.sha. The git shim was returning a fake placeholder SHA (aaaa...)
in dirty workspace mode while github.sha used the real HEAD SHA, causing
the validation to fail. Use realHeadSha consistently everywhere and
remove the now-unnecessary computeFakeSha helper.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The previous approach symlinked workspace/node_modules → /tmp/node_modules,
which broke esbuild path resolution in pnpm monorepos. Tools like rwsdk's
directive scanner resolved paths through the symlink incorrectly, producing
paths like apps/web/tmp/node_modules/.pnpm/... instead of /tmp/node_modules/.pnpm/...
Mount the warm cache as a Docker bind mount directly at the workspace
node_modules path. This makes the filesystem layout identical to production
GitHub Actions. The original EBUSY concern is already mitigated by the git
shim (blocks git clean) and checkout patching (clean: false).
Adds a smoke test exercising esbuild resolution through pnpm workspace
symlinks to prevent regression.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: clean up runner directory on SIGINT/SIGTERM
The signal handler was missing `hostRunnerDir` from its cleanup list,
causing runner directories to leak when the process was interrupted
via Ctrl+C. Moved variable declarations above the handler so it can
reference `hostRunnerDir`, and added it to the cleanup loop.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: detect and kill orphaned containers via parent-PID liveness
Label every container with `agent-ci.pid=<PID>`. On startup, scan
running agent-ci-* containers and check if their parent PID is still
alive. Dead PID → orphan → kill it along with its sidecars and network.
Also wires up the existing but unused `pruneStaleWorkspaces()` to
remove run directories older than 24 hours.
Closes#186
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make GitHub auth opt-in for remote reusable workflow fetching
Remove implicit credential resolution (gh auth token / GITHUB_TOKEN fallback)
that could silently send user credentials. Auth is now opt-in via
--github-token CLI flag or AGENT_CI_GITHUB_TOKEN env var.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add changeset for opt-in GitHub auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add --github-token flag and AGENT_CI_GITHUB_TOKEN to docs
Update CLI reference tables, environment variables section, and
compatibility matrix to reflect opt-in GitHub auth for remote
reusable workflows.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make commit status posting opt-in via --github-token
Gate postCommitStatus() on the githubToken parameter. When no token
is provided, print a warning instead of silently using implicit
gh CLI credentials.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add --commit-status flag to opt in to posting GitHub commit statuses
Commit status posting now requires both --commit-status and
--github-token. Without --commit-status, no warning is printed
and no status is posted.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add tests for 403 error hint and public repo fetch without auth
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Mark @redwoodjs/ts-runner as private and add it to changeset ignore
list. The package was being published to npm but version 0.7.0 is
returning 404 errors, breaking installs.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The ts-runner package had a "test": "vitest run" script but no test
files. Vitest exits with code 1 when it finds nothing to run, which
has been failing the Release workflow since the package was added,
preventing changesets/action from creating release PRs.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: mount warm-modules at /tmp/node_modules for pnpm TypeScript compat
TypeScript resolves @types/* by walking up from realpath(). With pnpm's
.pnpm virtual store symlinked to /tmp/warm-modules, the upward walk never
finds a node_modules directory. Mounting at /tmp/node_modules instead means
TypeScript's walk from /tmp/node_modules/.pnpm/... naturally finds
/tmp/node_modules/@types/.
Closes#176
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: preserve git-tracked symlinks in workspace snapshot
copyWorkspace was using cp/fs.cpSync which dereference symlinks, causing
git mode 120000 entries to be dropped from the workspace commit. Now we
check lstat() before copying and recreate symlinks via symlinkSync.
Closes#178
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add pnpm symlink smoke test reproducing #176 and #178
Adds a committed fixture at .github/fixtures/pnpm-symlinks/ with a
git-tracked symlink (mode 120000) and a TSX file that requires
@types/react resolution through pnpm's .pnpm virtual store.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
TypeScript resolves @types/* by walking up from realpath(). With pnpm's
.pnpm virtual store symlinked to /tmp/warm-modules, the upward walk never
finds a node_modules directory. Mounting at /tmp/node_modules instead means
TypeScript's walk from /tmp/node_modules/.pnpm/... naturally finds
/tmp/node_modules/@types/.
Closes#176
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support composite action step outputs and push event context
Enable workflows that use composite actions with cross-step output
references (e.g. Khan/actions@get-changed-files + filter-files) by:
- Preserving steps.* expressions for runner-time evaluation instead
of expanding them to empty string at parse time
- Using correct BasicExpression token type (type 3, not 6) matching
the runner's wire format
- Adding ContextName to steps so the runner can resolve
steps.<id>.outputs.<name> expressions
- Adding push event before/after SHAs and GITHUB_API_URL so
changed-files actions can call the compare commits API
- Implementing compare commits and list-PRs-for-commit mock endpoints
in the DTU server using git diff on the original repo
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve symlinks in agent-ci-dev.sh so it works when invoked via symlink
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Wire `with:` inputs from caller workflows to called workflows via
`inputs.*` context, resolve `on.workflow_call.inputs` defaults, and
propagate `on.workflow_call.outputs` back so downstream jobs can
access `needs.<callerJobId>.outputs.*`. Also fixes intra-workflow
`needs.*` resolution for composite job IDs.
Adds smoke test, unit tests, /validate command, and CLAUDE.md agent rules.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Replace the nesting guard in expandReusableJobs with recursive expansion,
cycle detection, and a depth limit of 4 matching GitHub Actions' max.
Closes#167
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support local composite actions (`uses: ./.github/actions/...`)
Set RepositoryType to "self" for local action references so the runner
resolves them from the workspace instead of trying to download a tarball.
Add defensive guard in actiondownloadinfo to skip local/empty actions.
Closes#162
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: fix formatting in .docs/ files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support local reusable workflows (uses: ./.github/workflows/...)
Inline called workflow jobs into the caller's dependency graph so that
`jobs.<id>.uses` with local refs works end-to-end. Includes dependency
rewiring, smoke tests, runner seed resilience fix, boot-failure log
surfacing, and dev script improvements.
Closes#149
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: update website compatibility matrix for reusable workflows
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add section descriptions to website compatibility matrix
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add descriptions to compatibility matrix legend items
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add 'not planned' status icon to compatibility matrix
Distinguish architectural limitations (concurrency groups, GitHub
secrets) from features that could be implemented in the future.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support remote reusable workflows (uses: owner/repo/path@ref)
Pre-fetch remote workflow YAML from GitHub Contents API before expansion,
cache SHA refs forever and always re-fetch mutable tag/branch refs. Also
changes missing workflow files from warn+skip to hard failure.
Closes#165
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: split monolithic smoke-tests.yml into discrete workflow files
Each smoke test area now has its own workflow file for isolated failure
visibility: matrix, artifacts/services, cross-job outputs, job conditions,
reusable workflows (local + remote), and binary smoke.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: fix formatting in .docs/ files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: clarify agent-ci-dev.sh is for local development only
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* kindling: start task
* Add marketing strategy research and synthesis
- investigation-plan.md: scope and search strategy for both tracks
- research-developer-channels.md: how CI tools gain adoption (act case study, HN, Reddit, npm, messaging)
- research-agent-discoverability.md: how AI agents discover tools (llms.txt, CLAUDE.md, MCP, training data)
- marketing-strategy.md: synthesized multi-step plan for human devs and AI agents
* Fix three evidence quality issues flagged by Critic review
- Source the 844k llms.txt adoption figure to BuiltWith tracking dashboard
(trends.builtwith.com/robots/LLMS-Text, as of Oct 25 2025); add caveat
that other methodologies (NerdyData, SE Ranking) show far lower counts
- Reword LLMs-do-not-use-llms.txt claim from tested negative to absence
of public documentation — more accurate epistemic framing
- Replace unsourced act tutorial claims with verified direct URLs: Red Hat,
BrowserStack, Microsoft Azure, LogRocket, freeCodeCamp, plus 10 dev.to
article links confirming the organic tutorial coverage
* Tighten sourcing and hedging language per Critic precision review
- HN traffic numbers: hedge 10k-100k as 'commonly estimated' with no single controlled measurement; add in-text Nebula Graph citation for 300+ stars figure
- Act HN appearances: reduce 'at least four times' to 'multiple times' (only two item IDs substantiated)
- Tutorial blog claim: 'all recommend act' softened to 'Leading tutorial blogs...recommend'
- Overnight agent commits: remove unsourced '1,000+' figure; soften to 'large batches of agent-generated commits'
- Reddit comment claim: reframe 'drives qualified signups for months' as 'can drive sustained qualified traffic'; note it reflects SEO best-practice inference, not a case study
- HN/Product Hunt 100 vs 30 comparison: add in-text citation bracket linking to Medium source
* Fix four citation issues flagged by Critic review
- Fix 1: Add inline WebProNews link to February 9, 2026 GitHub Actions outage claim (both files)
- Fix 2: Add HN item ID inline for Dagger stats (item?id=30857012)
- Fix 3: Replace 'typical' with 'commonly observed as' / 'reported in case studies'
- Fix 4: Generalize act fork/dependent stats with link to current repo instead of bare numbers
* Update strategy with Apr 7-9 tweet learnings and revised positioning
The Apr 7 "Running GitHub Actions locally" tweet hit 78K impressions —
revealing that the universal developer pain point is the primary hook,
not the AI agent angle. This updates the strategy doc with performance
data, a revised positioning funnel (hook → explain → differentiate →
convert), updated HN draft, and new action items. Adds tweet tracking
for the Apr 7-9 thread.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add tweet queue with 8 drafts following screenshot-first formula
Each tweet follows the pattern that drove 78K impressions on Apr 7:
one-line hook, terminal screenshot, no AI-agent lead. Covers dirty
tree, speed comparison, retry, git hooks, service containers, matrix
strategy, quiet mode, and act comparison. Includes posting order and
cadence recommendations.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Remove the useless try/catch wrapper in handleWorkflow so errors are
only reported once by the top-level catch handler.
Closes#154
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: auto-detect Docker socket path when DOCKER_HOST is not set
Resolves#158. Adds resolveDockerSocket() which finds the Docker daemon
socket by checking DOCKER_HOST, resolving symlinks at /var/run/docker.sock,
parsing `docker context inspect`, and falling back to well-known macOS
provider paths (OrbStack, Docker Desktop, Colima, Lima). Throws with
actionable guidance when no socket is found.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: lazy-init Docker socket resolution and client
Defer resolveDockerSocket() and Dockerode construction until first use
so that module import (e.g. --help) doesn't throw or shell out to
docker context inspect on machines without Docker.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: suppress stderr leak and support non-origin remotes
- Extract `getFirstRemoteUrl()` that prefers 'origin' but falls back to
the first available remote, with stdio piped to suppress stderr
- Use `process.cwd()` instead of `PROJECT_ROOT` in `deriveGithubRepo()`
so it detects the user's repo, not the CLI install location
- Share the helper between config.ts and cli.ts
Closes#152
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: handle trailing slash in remote URLs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add tests for parseRepoSlug and getFirstRemoteUrl
Extract regex parsing into exported parseRepoSlug() so both
config.ts and cli.ts share the same logic, and it's testable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: simplify getFirstRemoteUrl to single git remote -v call
One process spawn instead of up to three.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: extract resolveRepoSlug into config.ts with tests
Move repo detection out of cli.ts private function into a shared,
exported resolveRepoSlug() in config.ts so it's testable and
eliminates the duplicated logic between config.ts and cli.ts.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: don't auto-detect repo at import time from process.cwd()
The config default is just a last-resort fallback. Real detection
happens via resolveRepoSlug(repoRoot) in cli.ts, anchored to the
workflow path — process.cwd() at import time was a guess that could
be wrong.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: throw when repo cannot be detected instead of using unknown/unknown
Silently defaulting to "unknown/unknown" would produce wrong API URLs,
container env vars, and directory names. Now resolveRepoSlug() throws
with a clear message pointing users to set GITHUB_REPO.
Also removes dead config.GITHUB_REPO fallbacks from runner code — the
repo slug is always resolved from the workflow path in cli.ts before
jobs are created.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: use git config instead of parsing git remote -v output
git config --get remote.<name>.url returns just the URL — no
tab-delimited line parsing needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: propagate workflow-derived repo slug back to config.GITHUB_REPO
Once resolveRepoSlug detects the repo from the workflow path, write
it back to config.GITHUB_REPO so downstream code (commit-status.ts,
runner fallbacks) sees the correct value without needing it passed
through explicitly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: env var GITHUB_REPO overrides auto-detection, not the reverse
GITHUB_REPO env var is the explicit override; auto-detection from
the workflow's git remote is the default.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: verify GITHUB_REPO env var overrides auto-detection
Tests the priority contract: env var wins over git remote detection,
auto-detection is the fallback, and missing both throws.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: make githubRepo required in CreateRunDirectoriesOpts
It's always provided by cli.ts after resolveRepoSlug. Remove the
inconsistent defensive fallbacks ("unknown-repo" vs "repo") that
were dead code.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use git remote get-url instead of git config --get
git config reads from the config hierarchy (local → global → system),
so on CI runners where actions/checkout configures git globally, it
finds the parent repo's remote.origin.url even inside a fresh git init
temp dir. git remote get-url is scoped to the repo's own remotes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use DOCKER_HOST socket path for container bind mount
The Docker socket bind mount was hardcoded to /var/run/docker.sock on the
host side, ignoring DOCKER_HOST overrides. Extract the resolved socket path
and pass it into buildContainerBinds so the host side matches the actual
daemon socket.
Closes#155
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: don't run dockerSocketPath through toHostPath
The socket path is already a host path (from DOCKER_HOST or the default),
so it should not be remapped by toHostPath which translates container
paths to host paths in nested Docker scenarios.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: enable horizontal scroll on code blocks in mobile in-app browsers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use overflow-clip on Terminal and Panel components for mobile scroll
The outer overflow-hidden on these components creates a scroll container
that intercepts touch gestures in mobile WebViews, preventing the inner
overflow-x-auto from being scrollable. overflow-clip provides the same
visual clipping for rounded corners without creating a scroll container.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: make AGENTS.md terminal block full-width instead of half-grid
The AI Agent Integration section was in a 2-column grid with Quick Start,
constraining the AGENTS.md code block to half the page width. Now Quick
Start uses a 3-column grid for its short terminal blocks, and the
AGENTS.md block spans the full content width below.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: stack Quick Start terminals full-width instead of 3-column grid
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: stack Architecture Comparison as cards on mobile
Replace the horizontal table with stacked cards on mobile (md:hidden),
with the Agent CI row highlighted at the bottom of each card. Desktop
keeps the table layout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Peter Pistorius