Skip to content
CI

feat(release): canary agent releases with sticky arm assignment #164

Sign in to view logs

feat(release): canary agent releases with sticky arm assignment

feat(release): canary agent releases with sticky arm assignment #164

Workflow file for this run

.github/workflows/ci.yml at 0c6dbd7
# Citadel CI — Lint, Test, Build on every push and PR
name: CI
on:
push:
branches: [main, develop]
pull_request:
branches: [main, develop]
workflow_call:
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
env:
NODE_VERSION: "24"
PYTHON_VERSION: "3.14"
jobs:
# ── Backend static analysis: lint + type-check ──
backend-static:
name: Backend Static
runs-on: ubuntu-latest
defaults:
run:
working-directory: backend
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: package-lock.json
- name: Install workspaces (root lockfile)
run: npm ci
working-directory: ${{ github.workspace }}
- name: Lint
run: npm run lint
- name: Type check
run: npx tsc --noEmit
- name: Verify README doc claims (stacks, adapter count)
run: node scripts/verify-doc-claims.js
working-directory: ${{ github.workspace }}
# ── Backend unit tests + coverage ──
backend-test:
name: Backend Tests
runs-on: ubuntu-latest
defaults:
run:
working-directory: backend
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: package-lock.json
- name: Install workspaces (root lockfile)
run: npm ci
working-directory: ${{ github.workspace }}
- name: Unit tests
run: npm test -- --ci --coverage
# ── Backend build + synth (all stacks) ──
backend-build:
name: Backend Build + Synth
runs-on: ubuntu-latest
defaults:
run:
working-directory: backend
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: package-lock.json
- name: Install workspaces (root lockfile)
run: npm ci
working-directory: ${{ github.workspace }}
- name: Build Lambda bundles
run: npm run build:lambda
- name: Build CDK
run: npm run build
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: frontend/package-lock.json
- name: Install frontend deps (required for FrontendStack CDK asset)
run: npm ci --prefix frontend
working-directory: ${{ github.workspace }}
- name: Build frontend (required for FrontendStack CDK asset)
run: npm run build --prefix frontend
working-directory: ${{ github.workspace }}
- name: CDK synth (validate all templates)
run: npx cdk synth --all --quiet
env:
ENVIRONMENT: test
CDK_DEFAULT_ACCOUNT: "000000000000"
CDK_DEFAULT_REGION: us-east-1
- name: Verify SupervisorAgent bundle (governance + common packages present)
run: bash backend/scripts/verify-supervisor-bundle.sh
working-directory: ${{ github.workspace }}
# ── Governance: backend resolver tests + governance stack synth ──
# Frontend governance-engine tests run in the Frontend job; arbiter
# governance tests run in the Arbiter job. This job covers the backend
# governance resolvers and the citadel-governance-test stack template.
governance:
name: Governance
runs-on: ubuntu-latest
defaults:
run:
working-directory: backend
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: package-lock.json
- name: Install workspaces (root lockfile)
run: npm ci
working-directory: ${{ github.workspace }}
- name: Governance resolver tests
run: npm test -- --ci --testPathPatterns governance
- name: Build Lambda bundles
run: npm run build:lambda
- name: Build CDK
run: npm run build
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: frontend/package-lock.json
- name: Install frontend deps (required for FrontendStack CDK asset)
run: npm ci --prefix frontend
working-directory: ${{ github.workspace }}
- name: Build frontend (required for FrontendStack CDK asset)
run: npm run build --prefix frontend
working-directory: ${{ github.workspace }}
- name: CDK synth (governance stack)
run: npx cdk synth citadel-governance-test --quiet
env:
ENVIRONMENT: test
CDK_DEFAULT_ACCOUNT: "000000000000"
CDK_DEFAULT_REGION: us-east-1
# ── Frontend: lint, unit tests, build ──
frontend:
name: Frontend
runs-on: ubuntu-latest
defaults:
run:
working-directory: frontend
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: frontend/package-lock.json
- run: npm ci
- name: Unit tests
run: npm test -- --ci --coverage
- name: Build
run: npm run build
- name: Upload build artifact
if: github.ref == 'refs/heads/main'
uses: actions/upload-artifact@v4
with:
name: frontend-build
path: frontend/build/
retention-days: 7
# ── Arbiter (Python): lint, property-based tests ──
arbiter:
name: Arbiter
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/setup-python@v6
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install dependencies
run: |
pip install boto3 strands-agents strands-agents-tools
pip install -r arbiter/requirements.txt
pip install -r arbiter/requirements-dev.txt
- name: Run tests
run: pytest arbiter/ -v --tb=short
- name: Cognito secret handler tests (isolated process — same-named index.py across lambdas)
run: python3 -m pytest backend/src/lambda/cognito-secret-handler/__tests__/test_index.py -v --tb=short
- name: Seed admin user tests (isolated process — same-named index.py across lambdas)
run: python3 -m pytest backend/src/lambda/seed-admin-user/__tests__/test_seed_admin_user_properties.py -v --tb=short
# ── Service (Python): agent intake + pdf generator tests ──
service:
name: Service
runs-on: ubuntu-latest
env:
AWS_DEFAULT_REGION: us-east-1
steps:
- uses: actions/checkout@v5
- uses: actions/setup-python@v6
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install dependencies
run: |
pip install boto3 strands-agents strands-agents-tools
pip install -r service/agent_intake_single/requirements.txt
pip install -r service/agent_intake_single/requirements-dev.txt
- name: Run tests
run: pytest service/ -v --tb=short
# ── Security scanning ──
security:
name: Security Scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: ${{ env.NODE_VERSION }}
cache: npm
cache-dependency-path: |
package-lock.json
frontend/package-lock.json
- name: Install workspaces (root lockfile)
run: npm ci
- name: Audit dependencies (blocking, with justified allowlist)
run: npx audit-ci --config .audit-ci.json
- name: Install frontend deps (frontend lockfile)
run: npm ci
working-directory: frontend
- name: Audit frontend dependencies (blocking, with justified allowlist)
run: npx audit-ci --config .audit-ci.json
working-directory: frontend