Skip to content

Verify affected PR checks once and separate CI policy from execution #324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SaladDay wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Verify affected PR checks once and separate CI policy from execution #324

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9fcbc46
Separate CI policy from execution and validate PR changes once
SaladDay Sep 30, 2026
3d08c77
Merge remote-tracking branch 'origin/main' into codex/ci-pr-only-policy
SaladDay Sep 30, 2026
3a99bff
Merge remote-tracking branch 'origin/main' into codex/ci-pr-only-policy
SaladDay Sep 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
192 changes: 25 additions & 167 deletions .github/workflows/check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,14 @@ on:
description: Source commit to check
required: false
type: string
scope:
description: impact for PRs, full for explicit release verification
type: string
default: impact
native-artifacts:
description: Retain native installers for a release build
type: boolean
default: false
push:
branches: [main]
pull_request:

permissions:
Expand All @@ -30,6 +32,7 @@ jobs:
plan: ${{ steps.select.outputs.plan }}
jobs: ${{ steps.select.outputs.jobs }}
image: ${{ steps.select.outputs.image }}
attempt: ${{ steps.select.outputs.attempt }}
steps:
- uses: actions/checkout@v7
with:
Expand All @@ -39,6 +42,7 @@ jobs:
id: select
env:
REQUESTED_REF: ${{ inputs.ref }}
CHECK_SCOPE: ${{ inputs.scope || 'impact' }}
run: python3 scripts/ci_plan.py plan

hygiene:
Expand All @@ -56,191 +60,44 @@ jobs:
backend:
needs: plan
if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'backend')
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 40
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: oac_core_ci_tests
POSTGRES_USER: agents_api
POSTGRES_PASSWORD: core_test_only
ports:
- 5432/tcp
options: >-
--health-cmd "pg_isready -U agents_api -d oac_core_ci_tests"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref || github.sha }}
- name: Select Go caches
id: source
run: |
echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
echo "GOCACHE=$HOME/.oac/cache/go-build" >> "$GITHUB_ENV"
echo "GOMODCACHE=$HOME/.oac/cache/go-mod" >> "$GITHUB_ENV"
- uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: false
- uses: actions/cache@v6
with:
path: |
~/.oac/cache/go-build
~/.oac/cache/go-mod
key: core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-${{ steps.source.outputs.revision }}
restore-keys: |
core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-
core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
- uses: actions/setup-node@v6
with:
node-version: '22'
- name: Install native Go prerequisites
run: |
sudo apt-get update
sudo apt-get install -y build-essential pkg-config libssl-dev
- name: Verify dedicated test database
env:
OAC_TEST_DATABASE_URL: postgres://agents_api:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
run: |
echo "OAC_TEST_DATABASE_URL=$OAC_TEST_DATABASE_URL" >> "$GITHUB_ENV"
make check-database
- name: Verify generated SQL queries
run: make check-sqlc
- name: Test Runtime and shared Go contracts
run: make check-go
- name: Test microsandbox provider and Linux helper
run: make check-microsandbox-provider
- name: Build and test standalone Core and persistence
run: make check-core
- name: Build execution daemon
run: make build-daemon
uses: ./.github/workflows/ci-backend.yml
with:
ref: ${{ inputs.ref || github.sha }}

distribution:
needs: plan
if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'distribution')
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 20
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref || github.sha }}
- name: Select Go caches
id: source
run: |
echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
echo "GOCACHE=$HOME/.oac/cache/go-build" >> "$GITHUB_ENV"
echo "GOMODCACHE=$HOME/.oac/cache/go-mod" >> "$GITHUB_ENV"
- uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: false
- uses: actions/cache@v6
with:
path: |
~/.oac/cache/go-build
~/.oac/cache/go-mod
key: core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-distribution-${{ steps.source.outputs.revision }}
restore-keys: |
core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-distribution-
core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-tooling-
core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
- uses: actions/setup-node@v6
with:
node-version: '22'
- name: Verify Harness catalog and installer schema
run: make check-harness-catalog
- name: Test distribution, installer and console packaging
run: make check-distribution
uses: ./.github/workflows/ci-distribution.yml
with:
ref: ${{ inputs.ref || github.sha }}

harness:
needs: plan
if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'harness')
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 20
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref || github.sha }}
- uses: ./.github/actions/node
- name: Test and package Harness adapters
run: make check-claude-sdk check-mcode-harness
uses: ./.github/workflows/ci-harness.yml
with:
ref: ${{ inputs.ref || github.sha }}

example:
needs: plan
if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'example')
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 15
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref || github.sha }}
- uses: ./.github/actions/node
- name: Install dependencies and example acceptance browser
run: |
make node-deps
pnpm exec playwright install --with-deps chrome
- name: Test and build optional example with browser acceptance
run: make check-example
- name: Upload browser failure evidence
if: failure()
uses: actions/upload-artifact@v6
with:
name: example-acceptance-${{ github.run_attempt }}
path: |
example/*/playwright-report/
example/*/test-results/
retention-days: 7
compression-level: 0
if-no-files-found: ignore
uses: ./.github/workflows/ci-example.yml
with:
ref: ${{ inputs.ref || github.sha }}

web:
needs: plan
if: needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'web')
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 15
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref || github.sha }}
- uses: ./.github/actions/node
- name: Typecheck, test and build Web and clients
run: make check-web-unit
uses: ./.github/workflows/ci-web.yml
with:
ref: ${{ inputs.ref || github.sha }}

web-acceptance:
needs: [plan, web]
if: needs.web.result == 'success' && needs.plan.result == 'success' && contains(fromJSON(needs.plan.outputs.jobs || '[]'), 'web-acceptance')
strategy:
fail-fast: false
matrix:
shard: [1, 2]
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 15
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref || github.sha }}
- uses: ./.github/actions/node
- name: Install dependencies and Web acceptance browser
run: |
make node-deps
pnpm exec playwright install --with-deps chrome
- name: Verify Web workflows against isolated fixtures
run: make check-web-acceptance OAC_WEB_TEST_SHARD=${{ matrix.shard }}/2
- name: Upload browser failure evidence
if: failure()
uses: actions/upload-artifact@v6
with:
name: web-acceptance-${{ matrix.shard }}-${{ github.run_attempt }}
path: |
playwright-report/
test-results/
retention-days: 7
compression-level: 0
if-no-files-found: ignore
uses: ./.github/workflows/ci-web-acceptance.yml
with:
ref: ${{ inputs.ref || github.sha }}

api:
needs: plan
Expand Down Expand Up @@ -278,5 +135,6 @@ jobs:
- name: Require every selected check to succeed
env:
PLAN: ${{ needs.plan.outputs.plan }}
PLAN_ATTEMPT: ${{ needs.plan.outputs.attempt }}
RESULTS: ${{ toJSON(needs) }}
run: python3 scripts/ci_plan.py gate
77 changes: 77 additions & 0 deletions .github/workflows/ci-backend.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
name: ci-backend

on:
workflow_call:
inputs:
ref:
description: Immutable source commit to check
type: string
required: true

permissions:
contents: read

jobs:
backend:
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 40
services:
postgres:
image: postgres:16-alpine
env:
POSTGRES_DB: oac_core_ci_tests
POSTGRES_USER: agents_api
POSTGRES_PASSWORD: core_test_only
ports:
- 5432/tcp
options: >-
--health-cmd "pg_isready -U agents_api -d oac_core_ci_tests"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref }}
- name: Select Go caches
id: source
run: |
echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
echo "GOCACHE=$HOME/.oac/cache/go-build" >> "$GITHUB_ENV"
echo "GOMODCACHE=$HOME/.oac/cache/go-mod" >> "$GITHUB_ENV"
- uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: false
- uses: actions/cache@v6
with:
path: |
~/.oac/cache/go-build
~/.oac/cache/go-mod
key: core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-${{ steps.source.outputs.revision }}
restore-keys: |
core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-backend-
core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
- uses: actions/setup-node@v6
with:
node-version: '22'
- name: Install native Go prerequisites
run: |
sudo apt-get update
sudo apt-get install -y build-essential pkg-config libssl-dev
- name: Verify dedicated test database
env:
OAC_TEST_DATABASE_URL: postgres://agents_api:core_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_core_ci_tests?sslmode=disable
run: |
echo "OAC_TEST_DATABASE_URL=$OAC_TEST_DATABASE_URL" >> "$GITHUB_ENV"
make check-database
- name: Verify generated SQL queries
run: make check-sqlc
- name: Test Runtime and shared Go contracts
run: make check-go
- name: Test microsandbox provider and Linux helper
run: make check-microsandbox-provider
- name: Build and test standalone Core and persistence
run: make check-core
- name: Build execution daemon
run: make build-daemon
48 changes: 48 additions & 0 deletions .github/workflows/ci-distribution.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
name: ci-distribution

on:
workflow_call:
inputs:
ref:
description: Immutable source commit to check
type: string
required: true

permissions:
contents: read

jobs:
distribution:
runs-on: ${{ vars.OAC_USE_GITHUB_RUNNERS == 'true' && 'ubuntu-22.04' || 'blacksmith-2vcpu-ubuntu-2204' }}
timeout-minutes: 20
steps:
- uses: actions/checkout@v7
with:
ref: ${{ inputs.ref }}
- name: Select Go caches
id: source
run: |
echo "revision=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
echo "GOCACHE=$HOME/.oac/cache/go-build" >> "$GITHUB_ENV"
echo "GOMODCACHE=$HOME/.oac/cache/go-mod" >> "$GITHUB_ENV"
- uses: actions/setup-go@v7
with:
go-version-file: go.mod
cache: false
- uses: actions/cache@v6
with:
path: |
~/.oac/cache/go-build
~/.oac/cache/go-mod
key: core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-distribution-${{ steps.source.outputs.revision }}
restore-keys: |
core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-distribution-
core-go-v2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-tooling-
core-go-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/go.mod', '**/go.sum') }}-
- uses: actions/setup-node@v6
with:
node-version: '22'
- name: Verify Harness catalog and installer schema
run: make check-harness-catalog
- name: Test distribution, installer and console packaging
run: make check-distribution
Loading
Loading