Checkout v6 added post-fetch validation that the checked-out ref matches
github.sha. The git shim was returning a fake placeholder SHA (aaaa...)
in dirty workspace mode while github.sha used the real HEAD SHA, causing
the validation to fail. Use realHeadSha consistently everywhere and
remove the now-unnecessary computeFakeSha helper.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support composite action step outputs and push event context
Enable workflows that use composite actions with cross-step output
references (e.g. Khan/actions@get-changed-files + filter-files) by:
- Preserving steps.* expressions for runner-time evaluation instead
of expanding them to empty string at parse time
- Using correct BasicExpression token type (type 3, not 6) matching
the runner's wire format
- Adding ContextName to steps so the runner can resolve
steps.<id>.outputs.<name> expressions
- Adding push event before/after SHAs and GITHUB_API_URL so
changed-files actions can call the compare commits API
- Implementing compare commits and list-PRs-for-commit mock endpoints
in the DTU server using git diff on the original repo
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve symlinks in agent-ci-dev.sh so it works when invoked via symlink
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: support local composite actions (`uses: ./.github/actions/...`)
Set RepositoryType to "self" for local action references so the runner
resolves them from the workspace instead of trying to download a tarball.
Add defensive guard in actiondownloadinfo to skip local/empty actions.
Closes#162
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: fix formatting in .docs/ files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: propagate job-level env into DTU Variables and add AGENT_CI_LOCAL to container env
Closes#104. Job-level `env` from the CLI payload was not propagated into
the DTU's Variables store or ContextData, so `AGENT_CI_LOCAL` was unavailable
to the runner's expression engine. Also adds `AGENT_CI_LOCAL=true` to the
Docker container env for shell access.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: re-trigger agent-ci checks
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
When running --all, jobs seeded without runnerName landed in the shared
generic pool where runners from other concurrent workflows could steal
them, causing single-job workflows to hang indefinitely.
- Pin job.runnerName = containerName before the /_dtu/seed call
- Move container and ephemeralDtu cleanup into finally block
- Add process.setMaxListeners(0) for parallel job EventEmitter warnings
- Add reproduction test for generic pool job stealing
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: action tarball disk cache, step output capture, and demo recording
- Cache action tarballs on first download and serve from disk on re-runs,
eliminating ~30s GitHub CDN delays
- Capture step output via tee to signals dir for reliable pause-on-failure
tail display
- Fix CLI to treat empty results as failure and skip summary print
- Add marketing demo recording setup with VHS tape and test project
- Add `agent-ci` script alias in root package.json
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test: add tests for action tarball cache, group filtering, and empty-results fix (#119)
Cover the untested changes from the tarball cache PR: action tarball proxy
cache hit/miss, download info URL rewriting with sub-path stripping, step
output group filtering, tee output capture, and CLI empty-results exit logic.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: prevent concurrent tarball cache-miss race condition
Use an in-flight download map so concurrent requests for the same
tarball coalesce into a single GitHub fetch instead of racing on
the same tmp file, which could cause corruption or rename errors.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: use relative path in demo.tape for portability
Replace hard-coded absolute path with a relative path so the demo
recording works on any contributor's machine.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct sanitized-refs test to assert 404 for slash-containing refs
The test was passing vacuously (status >= 200 matches 404). Now it
properly asserts that Polka does not bind :ref across slashes, so
slash-containing refs return 404 and do not serve cached content.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Three fixes discovered while running agent-ci against a ~40K file
pnpm/turbo monorepo:
1. Sub-path actions (e.g. `actions/cache/save@v5`) produce invalid
tarball URLs. The DTU was using `action.nameWithOwner` directly
which includes the sub-path, producing
`api.github.com/repos/actions/cache/save/tarball/v5` (404).
Fix: strip to `owner/repo` before constructing the URL.
2. `copyWorkspace` uses `execSync("git ls-files ...")` with the
default 1MB maxBuffer. Repos with 30K+ tracked files overflow
this, causing ENOBUFS and an empty workspace in the container.
Fix: increase maxBuffer to 100MB.
3. Post-success cleanup `fs.rmSync(containerWorkDir)` can throw
ENOTEMPTY when the container hasn't fully released file handles.
Fix: wrap in try/catch for best-effort cleanup.
On Linux, host.docker.internal doesn't work by default (only available
since Docker 20.10+ and requires explicit configuration). This change:
- Detects macOS vs Linux and returns appropriate host IP
- Uses 172.17.0.1 (docker bridge gateway) on Linux host
- Uses host.docker.internal on macOS
- Adds containerUrl to ephemeral DTU for container-to-host communication
- Adds ExtraHosts mapping for containers to resolve host.docker.internal
Fixes connectivity issues when running agent-ci on Linux hosts.
Improve npm and AI agent discoverability by filling in package.json
keywords/description, creating a SKILL.md for node_modules scanning,
and adding a ready-to-paste CLAUDE.md snippet to the README.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
execa was in devDependencies but imported in production code,
causing ERR_MODULE_NOT_FOUND when running via npx. Replaced with
Node's built-in child_process.exec and removed execa entirely.
When a runner-specific job was seeded, it was stored in both state.jobs
(generic pool) and state.runnerJobs (runner-targeted). A runner polling
before its own job was seeded could fall back to state.jobs and steal
another runner's job, leaving the original runner spinning indefinitely.
Fix: runner-targeted jobs now go only into state.runnerJobs. The generic
pool is reserved for jobs without runner affinity.
Adds three tests covering the race condition, concurrent stress with
8 runners, and the job-theft scenario.
Closes#47
The runner's FinalizeJob deletes _temp/_runner_file_commands/ inside the
container before exit, making files unreachable from the host.
Solution: inject a synthetic 'Capture outputs' step (runs with if:always())
that reads all set_output_* files and echoes them as ::agent-ci-output::key=value.
The DTU parses these prefixed lines and persists them to outputs.json in the
runner's log directory. On job completion, local-job.ts reads outputs.json and
attaches the outputs to the JobResult.
Pipeline verified end-to-end — all 8 smoke tests pass:
- Cross-job outputs (setup-outputs → consume-outputs) ✅
- Job-level if:always() ✅
- Matrix shards with fail-fast:false ✅
- Artifacts, services, env vars ✅
All 279 unit tests pass.
- Fix extractStepOutputs path: _temp/_runner_file_commands/ (not root)
- DTU outputs endpoint now captures and persists outputs.json
- local-job.ts reads outputs.json from log dir instead of work dir
- Add smoke test jobs for cross-job outputs and if:always()
All 279 tests pass.
github-actions[bot]