Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Replaces the existing Concourse PR test pipeline with a GitHub Actions workflow that runs RSpec template specs first, then (on success) provisions an ephemeral bosh-lite director in a privileged container to deploy UAA and run the Go/Ginkgo acceptance suite.
Changes:
- Add a PR-triggered GitHub Actions workflow (
developonly) with separate RSpec and acceptance-test jobs. - Add a non-interactive CI entrypoint script to deploy UAA into bosh-lite and run the acceptance suite.
- Port the local bosh-lite-driven acceptance flow into CI (dev release tarball + in-container deploy + Ginkgo run).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.github/workflows/pull-request.yml |
Adds the PR workflow and job graph (RSpec → acceptance) and provisions bosh-lite via a privileged container. |
scripts/ci/run-acceptance-tests.sh |
New CI-focused script that uploads stemcell/release, deploys UAA, and runs Ginkgo acceptance tests. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
duanemay
had a problem deploying
to
acceptance-tests
July 14, 2026 00:49 — with 
GitHub Actions
Failure
GitHub Actions
Failure
duanemay
added a commit
that referenced
this pull request
Jul 14, 2026
bbl's renderer factory treats a non-empty $PSModulePath as "we're on PowerShell" (renderers/factory.go createDefault()). GitHub-hosted Linux runners ship PowerShell Core for `shell: pwsh` support and set that var even on Ubuntu, so `bbl print-env` inside task.sh/cleanup.sh emitted `$env:BOSH_CLIENT="admin"` instead of `export BOSH_CLIENT=...`, and their `eval "$(bbl print-env)"` died with "env: unbound variable". Confirmed via bosh-bootloader's own source (renderers/factory.go) after reproducing the exact failure on PR #1275. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The image-provided `start-bosh` command already sets -e and can fail partway through bringing up the bosh-lite director, but this wrapper had none, so it always printed a false success message and slept forever regardless of whether start-bosh actually succeeded -- masking real failures in the local dev flow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Ports the Concourse uaa-release-tests job
(uaa-ci/concourse/pull-requests/pipeline.yml) to a native GitHub
Actions workflow gated on pull requests against develop:
- rspec-template-tests: the existing RSpec ERB template specs on Ruby
3.2.3. No secrets; runs on every PR including forks.
- acceptance-tests (needs: rspec-template-tests, skipped if RSpec
fails): targets the same long-lived, shared, bbl-managed GCP BOSH
director the Concourse job used, via the same shared task scripts
already in uaa-ci (shared/tasks/uaa-release-acceptance-tests/
{task.sh,cleanup.sh}, invoked unchanged).
Design notes:
- concurrency.group is a fixed (non-ref-scoped) string so a future
push-pipeline port targeting the same director can serialize
against this job too, mirroring Concourse's
serial_groups: [uaa-acceptance-gcp].
- BUILD_ID is derived from run_id-run_attempt so a re-run never
collides with a prior attempt's orphaned deployment names.
- GitHub Environments with required reviewers aren't available on
this repo/org's plan, so UAA_CI_DEPLOY_KEY is a plain repository
secret; acceptance-tests is skipped entirely for fork PRs instead,
so their code never runs anywhere near the secret.
- PSModulePath is blanked for the job: bbl print-env treats a
non-empty $PSModulePath as "we're on PowerShell"
(bosh-bootloader's renderers/factory.go), and GitHub-hosted Linux
runners set that var for pwsh support, which broke
eval "$(bbl print-env)" inside task.sh/cleanup.sh.
Verified end-to-end on a live run: acceptance-tests passed in 39m19s
against the real shared director, with cleanup.sh confirmed removing
the errand deployment, the UAA deployment, and the dev release
afterward.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Comment on lines
+29
to
+38
| # UAA_CI_DEPLOY_KEY is a plain repository secret (this repo/org's plan | ||
| # doesn't support GitHub Environments with required reviewers), so it is | ||
| # available to every `pull_request`-triggered run the instant the job | ||
| # starts -- including fork PRs. Skip fork PRs entirely so their code never | ||
| # runs in a job that can see this secret; same-repo branch PRs still get | ||
| # the full acceptance run automatically. | ||
| acceptance-tests: | ||
| needs: rspec-template-tests | ||
| if: github.event.pull_request.head.repo.full_name == github.repository | ||
| runs-on: ubuntu-24.04 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the Concourse
uaa-release-testsjob (uaa-ci/concourse/pull-requests/pipeline.yml) with a native GitHub Actions workflow,.github/workflows/pull-request.yml, triggered on PRs againstdevelop.rspec-template-tests— runs the existing RSpec ERB template specs (bundle exec rspec spec) on Ruby 3.2.3. No secrets; runs on every PR including forks.acceptance-tests(needs: rspec-template-tests, skipped if RSpec fails) — targets the same long-lived, shared, bbl-managed GCP BOSH director the Concourse job used, via the same shared task scripts already inuaa-ci(shared/tasks/uaa-release-acceptance-tests/{task.sh,cleanup.sh}, invoked unchanged).An earlier version of this PR tried to avoid the shared-infra dependency by standing up an ephemeral bosh-lite director on the runner itself. That depended on
bosh/main-bosh-docker, a Docker Hub image abandoned since 2022-12-08 (one stale tag, a Dec-2022 dev-snapshot BOSH CLI, a bring-up script that dies instantly on a current runner). There's no maintained alternative anywhere in this org's tooling, so this PR now targets the shared director instead — the one acceptance-test path with an actual production track record. Incidental fix kept from that attempt:scripts/start-bosh.shnow hasset -e, since the image-providedstart-boshcommand can fail without it, and the wrapper was silently masking that (affects local dev too, independent of this pivot).Design notes:
acceptance-testsis gated behind a required-reviewer GitHub Environment (acceptance-tests) so the director-reaching secret is unavailable until a maintainer approves — this repo takes outside PRs.concurrency.group: uaa-acceptance-gcp-directoris a fixed (non-ref-scoped) group so a future push-pipeline port targeting the same director can serialize against this job too, mirroring Concourse'sserial_groups: [uaa-acceptance-gcp].BUILD_IDis derived fromrun_id-run_attemptso a re-run never collides with a prior attempt's orphaned deployment names.Manual prerequisites (not yet done — needed before
acceptance-testscan pass)acceptance-testson this repo, with required reviewers enabled.cloudfoundry/uaa-ci.UAA_CI_DEPLOY_KEYon theacceptance-testsenvironment (not a repo secret).Until these exist,
acceptance-testswill predictably fail at the "Checkout uaa-ci" step (404 Not Found— the defaultGITHUB_TOKENcan't see the privateuaa-cirepo) — that's expected, not a bug.Test plan
bundle exec rspec specpasses locally (321 examples, 0 failures).rspec-template-testspassing on this PR across multiple pushes.needs,environment,concurrency,envall structurally correct).acceptance-testsend-to-end run against the shared director.