Harden external context projection transports #534
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: shell | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| syntax: | |
| name: bash -n on all shell scripts | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Syntax-check every .sh | |
| run: | | |
| set -e | |
| fail=0 | |
| while IFS= read -r -d '' f; do | |
| if ! bash -n "$f"; then | |
| echo "FAIL: $f" | |
| fail=1 | |
| fi | |
| done < <(find . -type f -name '*.sh' -not -path './.git/*' -print0) | |
| exit "$fail" | |
| bridge-render: | |
| name: chat-bridge template byte-equivalence | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/bridge-render.sh | |
| run: ./tests/bridge-render.sh | |
| opencode-wrapper-removal: | |
| name: opencode wrapper removal regression (#117) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/opencode-wrapper-removal.sh | |
| run: ./tests/opencode-wrapper-removal.sh | |
| opencode-subagents: | |
| name: Data Machine graph OpenCode subagents (#355) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/opencode-subagents.sh | |
| run: bash tests/opencode-subagents.sh | |
| managed-skill-targets: | |
| name: managed skill target deduplication (#306) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/managed-skill-targets.sh | |
| run: ./tests/managed-skill-targets.sh | |
| dm-agent-sync: | |
| name: Data Machine agent sync plugin | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Run tests/dm-agent-sync.mjs | |
| run: bun tests/dm-agent-sync.mjs | |
| - name: Run tests/kimaki-session-attribution.mjs | |
| run: bun tests/kimaki-session-attribution.mjs | |
| - name: Run tests/setup-profile-compiler.mjs | |
| run: node tests/setup-profile-compiler.mjs | |
| cli-transport: | |
| name: CLI dispatch transport runtime | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/cli-transport-install.sh | |
| run: ./tests/cli-transport-install.sh | |
| - name: Run tests/smoke-cli-transport.php | |
| run: php tests/smoke-cli-transport.php | |
| inbound-event-bridge: | |
| name: durable inbound event bridge | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/inbound-event-bridge.sh | |
| run: bash tests/inbound-event-bridge.sh | |
| - name: Run tests/smoke-inbound-event-bridge.php | |
| run: php tests/smoke-inbound-event-bridge.php | |
| - name: Run tests/inbound-event-connector.py | |
| run: python3 tests/inbound-event-connector.py | |
| cli-channel-registry: | |
| name: CLI channel registry permissions | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/cli-channel-perms.sh | |
| run: ./tests/cli-channel-perms.sh | |
| ai-gateway: | |
| name: WP AI Gateway opt-in regression (#173) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/ai-gateway.sh | |
| run: ./tests/ai-gateway.sh | |
| kimaki-agent-fallback: | |
| name: Kimaki native agent fallback regression | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/kimaki-agent-fallback.sh | |
| run: ./tests/kimaki-agent-fallback.sh | |
| cli-channel-binary-path: | |
| name: CLI channel binary-path web-reachability regression (#198) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/cli-channel-binary-path.sh | |
| run: ./tests/cli-channel-binary-path.sh | |
| wp-codebox-subtree: | |
| name: WP Codebox subtree updater | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/wp-codebox-subtree.sh | |
| run: ./tests/wp-codebox-subtree.sh | |
| service-identity-adoption: | |
| name: Service identity adoption regression (#204) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/service-identity-adoption.sh | |
| run: ./tests/service-identity-adoption.sh | |
| kimaki-dispatch-helper-health: | |
| name: Kimaki dispatch helper health (#304) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/kimaki-dispatch-helper-health.sh | |
| run: ./tests/kimaki-dispatch-helper-health.sh | |
| kimaki-no-default-channel: | |
| name: Kimaki default-channel opt-out (remorses/kimaki#175) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/kimaki-no-default-channel.sh | |
| run: ./tests/kimaki-no-default-channel.sh | |
| runtime-guard: | |
| name: runtime deactivation guard (#328) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/runtime-guard.sh | |
| run: ./tests/runtime-guard.sh | |
| source-mode: | |
| name: installed-source mode (#314, #324) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/source-mode.sh | |
| run: ./tests/source-mode.sh | |
| service-identity-defaults: | |
| name: owned mode defaults to non-root (#327) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/service-identity-defaults.sh | |
| run: ./tests/service-identity-defaults.sh | |
| service-migration: | |
| name: root -> non-root service identity migration (#93) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/service-migration.sh | |
| run: ./tests/service-migration.sh | |
| agents-md-guidance: | |
| name: AGENTS.md guidance registry | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/agents-md-guidance.sh | |
| run: ./tests/agents-md-guidance.sh | |
| - name: Run tests/opencode-local-plugin-path.sh | |
| run: ./tests/opencode-local-plugin-path.sh | |
| - name: Run tests/repair-opencode-json.sh | |
| run: ./tests/repair-opencode-json.sh | |
| - name: Run tests/claude-code-permissions.sh | |
| run: ./tests/claude-code-permissions.sh | |
| - name: Run tests/codex-permissions.sh | |
| run: ./tests/codex-permissions.sh | |
| homeboy-agents-md: | |
| name: Homeboy CLI command map (#208, #254) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/homeboy-agents-md.sh | |
| run: ./tests/homeboy-agents-md.sh | |
| claude-code-hook-scope: | |
| name: Claude Code hook agent scoping | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/claude-code-hook-scope.sh | |
| run: ./tests/claude-code-hook-scope.sh | |
| # Suites that had no CI job until #335. Run as a matrix so adding a test is a | |
| # one-line change and tests/ci-coverage.sh stays satisfied; invoked through | |
| # `bash` because several of these files do not carry the executable bit. | |
| suites: | |
| name: ${{ matrix.test }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| test: | |
| - agents-md-backup-retention | |
| - carried-claude-code-plugin | |
| - ci-coverage | |
| - codex-runtime | |
| - datamachine-worker | |
| - detect-php-version | |
| - detect-site-domain | |
| - external-wordpress-runtime | |
| - dm-workspace-discovery | |
| - homeboy-codebox-canary | |
| - homeboy-components | |
| - homeboy-dmc-provider | |
| - homeboy-project-id | |
| - kimaki-credential-seeding | |
| - kimaki-install-existing | |
| - kimaki-launchd-start | |
| - kimaki-managed-plugin-rig | |
| - kimaki-multi-instance | |
| - kimaki-system-message-patch | |
| - opencode-claude-auth-refresh-hardening | |
| - owned-source-discovery | |
| - source-reconcile | |
| - verify | |
| - path-helpers | |
| - post-upgrade-restore | |
| - runtime-signature | |
| - upgrade-opencode-auth-plugin-sync | |
| - worktree-context-projections | |
| - wp-config-permissions | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run tests/${{ matrix.test }}.sh | |
| run: bash tests/${{ matrix.test }}.sh |