weichenandCursor
a27f2cc7fb
Host-agent-data/test mismatched shuimu-pi-agent-dev workspace mounts. Co-authored-by: Cursor <cursoragent@cursor.com>
89 lines
3.4 KiB
YAML
89 lines
3.4 KiB
YAML
# Nightly real PI regression (Wave 2B / PU5B).
|
|
# PR CI (ci.yml) intentionally does NOT run real PI.
|
|
name: Nightly Real PI
|
|
|
|
on:
|
|
schedule:
|
|
# Daily 16:00 UTC ≈ 00:00 CST
|
|
- cron: "0 16 * * *"
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: nightly-real-pi
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Local Gitea act_runner label `nightly:host` — reaches host :18865 / :5434.
|
|
# Do not use ubuntu-latest docker isolation for this job on this machine.
|
|
nightly-real-pi:
|
|
runs-on: nightly
|
|
timeout-minutes: 120
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
# Optional overrides via repo vars; script defaults apply when empty.
|
|
PI_AGENT_RUNNER_URL: ${{ vars.PI_AGENT_RUNNER_URL }}
|
|
PI_AGENT_MODEL: ${{ vars.PI_AGENT_MODEL }}
|
|
PI_AGENT_PROTOCOL: typed-result-v1
|
|
# Prefer dedicated secret; empty → infra_fail via run-nightly-real-pi.sh (never PASS).
|
|
RUNNER_AUTH_TOKEN: ${{ secrets.RUNNER_AUTH_TOKEN }}
|
|
PI_AGENT_RUNNER_AUTH_TOKEN: ${{ secrets.RUNNER_AUTH_TOKEN }}
|
|
TEST_DATABASE_URL: ${{ secrets.NIGHTLY_TEST_DATABASE_URL }}
|
|
# Align with PI on :18865 (shuimu-pi-agent-dev mounts data/dev/workspaces).
|
|
DATA_DIR: /host-agent-data/dev
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.27.1"
|
|
cache-dependency-path: go.sum
|
|
|
|
- name: Run nightly real-PI suite (classified receipt)
|
|
id: nightly
|
|
run: |
|
|
chmod +x scripts/run-nightly-real-pi.sh scripts/promotion-receipt-write.sh scripts/promotion-receipt-check.sh
|
|
set +e
|
|
./scripts/run-nightly-real-pi.sh
|
|
rc=$?
|
|
set -e
|
|
echo "rc=${rc}" >> "$GITHUB_OUTPUT"
|
|
# Always upload receipts/evidence; never treat missing secret as PASS.
|
|
exit "${rc}"
|
|
|
|
# Gitea act_runner rejects upload-artifact@v4 (GHESNotSupportedError).
|
|
# Keep a portable tarball in the job log workspace for local runner hosts.
|
|
- name: Archive promotion receipt artifacts
|
|
if: always()
|
|
run: |
|
|
set -euo pipefail
|
|
out="promotion-receipt-${GITHUB_SHA}.tar.gz"
|
|
mkdir -p .doc/test-reports/assets/promotion-receipts
|
|
if compgen -G ".doc/test-reports/assets/promotion-receipts/${GITHUB_SHA}.json" >/dev/null \
|
|
|| compgen -G ".doc/test-reports/assets/promotion-receipts/evidence-*" >/dev/null; then
|
|
tar -czf "${out}" \
|
|
.doc/test-reports/assets/promotion-receipts/"${GITHUB_SHA}".json \
|
|
.doc/test-reports/assets/promotion-receipts/evidence-* \
|
|
2>/dev/null || tar -czf "${out}" .doc/test-reports/assets/promotion-receipts
|
|
ls -la "${out}"
|
|
else
|
|
echo "warn: no promotion receipt files to archive"
|
|
fi
|
|
|
|
- name: Summarize receipt verdict
|
|
if: always()
|
|
run: |
|
|
f=".doc/test-reports/assets/promotion-receipts/${GITHUB_SHA}.json"
|
|
if [[ -f "$f" ]]; then
|
|
echo "Receipt:"
|
|
cat "$f"
|
|
verdict="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["verdict"])' "$f")"
|
|
echo "verdict=${verdict}"
|
|
if [[ "${verdict}" != "pass" ]]; then
|
|
echo "::error::nightly real-PI verdict=${verdict} (infrastructure failures must not be reported as PASS)"
|
|
fi
|
|
else
|
|
echo "::error::no promotion receipt written"
|
|
exit 1
|
|
fi
|