fix(server): stop logging an offline runner as an internal error #18022
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: E2E UI Required | |
| # Required-status gate: a PR that changes web/** must ship a tests/e2e_ui/** | |
| # test covering the change or carry a maintainer-effective `skip-e2e-ui-test` | |
| # label. The policy verdict FAILS the job; mark `E2E UI Required` as a required | |
| # check in branch protection for that to block merge. Whether a change "needs a | |
| # test" is decided by an LLM judge (check.sh case 2), not file-presence, so | |
| # refactors/renames/dep-bumps/styling/test-only edits don't trip the gate and a | |
| # throwaway test doesn't satisfy it. | |
| # | |
| # Trigger is `pull_request_target`, so the workflow + gate script run from main | |
| # with the base token even for fork PRs: the PR-head copy never runs (a PR can't | |
| # weaken the gate), and `labeled`/`unlabeled` let the skip label re-evaluate it. | |
| # | |
| # SECURITY -- the LLM judge reads the PR's (attacker-controlled) diff as TEXT and | |
| # sends it to the gateway with the rate-limited, revocable test token (same risk | |
| # profile as fork e2e). The job never checks out or runs PR-head code: it checks | |
| # out ONLY .github/scripts from main (pinned, no persisted credentials) and reads | |
| # state via the API. The judge prompt is hardened against injection and fails | |
| # closed; a wrong "pass" can't merge anything since the required `Maintainer | |
| # Approval` check + a human reviewer still gate merge. | |
| # | |
| # NO `paths:` filter on purpose: a path-filtered required check never reports on | |
| # non-matching PRs, stranding the status pending forever. This always runs and | |
| # the gate script self-determines whether web/** was touched. | |
| # | |
| # leak-scan-allow: pull_request_target | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| # PR re-syncs / relabels share a group by PR number so old runs cancel. | |
| group: e2e-ui-required-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| require-e2e-ui: | |
| name: E2E UI Required | |
| # Skip drafts; the `ready_for_review` trigger re-fires on un-drafting. | |
| if: ${{ !github.event.pull_request.draft }} | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| actions: write # dispatch a Merge Ready re-evaluation when this flips green | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Check out gate scripts from main | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: main # trusted base; never the PR head | |
| sparse-checkout: .github/scripts | |
| persist-credentials: false | |
| - name: Load maintainers | |
| id: maintainers | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| run: bash .github/scripts/merge-ready/load-maintainers.sh | |
| - name: Require e2e_ui coverage or effective waiver | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| MAINTAINERS: ${{ steps.maintainers.outputs.list }} | |
| # OpenAI-compatible gateway (same secrets the e2e suites use). | |
| OPENAI_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }} | |
| OPENAI_API_KEY: ${{ secrets.LLM_API_KEY }} | |
| E2E_UI_JUDGE_MODEL: ${{ vars.OMNIGENT_CI_E2E_JUDGE_MODEL }} | |
| run: | | |
| : "${E2E_UI_JUDGE_MODEL:?Set OMNIGENT_CI_E2E_JUDGE_MODEL repository variable}" | |
| bash .github/scripts/e2e-ui-required/check.sh | |
| # Merge Ready (the single required gating check) does NOT re-evaluate when | |
| # this check flips green: E2E UI Required isn't in Merge Ready's | |
| # workflow_run trigger list, and its check_run only wakes Merge Ready for | |
| # DCO. So when a `skip-e2e-ui-test` waiver (or a newly pushed test) turns | |
| # this check green, the PR would otherwise sit BLOCKED with every check | |
| # already green. Nudge Merge Ready to re-post its status. Only on success -- | |
| # a red gate must stay blocking, and Merge Ready ignores a workflow_dispatch | |
| # re-eval that isn't fully green anyway. | |
| - name: Re-evaluate Merge Ready | |
| if: success() | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| gh workflow run merge-ready.yml -R "$REPO" -f pr="$PR" \ | |
| || echo "::warning::could not dispatch Merge Ready re-evaluation for #$PR" |