bot-bottle/.gitea/workflows/test.yml

# Run the automated test gate when package or runtime inputs change on a PR
# or on push to main. Privileged self-hosted backends live in the manually
# dispatched pre-release-test workflow.

name: test

on:
  push:
    branches:
      - main
    paths:
      - 'bot_bottle/**'
      - 'tests/**/*.py'
      - 'cli.py'
      - 'install.sh'
      - 'setup.py'
      - 'MANIFEST.in'
      - 'flake.nix'
      - 'nix/firecracker-netpool.nix'
      - 'scripts/coverage.sh'
      - 'scripts/critical-modules.txt'
      - 'scripts/**/*.py'
      - 'scripts/firecracker-netpool.sh'
      - 'Dockerfile*'
      - 'image-build-args.json'
      - 'pyproject.toml'
      - 'requirements-dev.txt'
      - 'requirements.gateway.*'
      - '.coveragerc'
      - '.dockerignore'
      - '.gitea/workflows/test.yml'
      - '.gitea/workflows/refresh-image-locks.yml'
      - '.gitea/workflows/pre-release-test.yml'
  pull_request:
    paths:
      - 'bot_bottle/**'
      - 'tests/**/*.py'
      - 'cli.py'
      - 'install.sh'
      - 'setup.py'
      - 'MANIFEST.in'
      - 'flake.nix'
      - 'nix/firecracker-netpool.nix'
      - 'scripts/coverage.sh'
      - 'scripts/critical-modules.txt'
      - 'scripts/**/*.py'
      - 'scripts/firecracker-netpool.sh'
      - 'Dockerfile*'
      - 'image-build-args.json'
      - 'pyproject.toml'
      - 'requirements-dev.txt'
      - 'requirements.gateway.*'
      - '.coveragerc'
      - '.dockerignore'
      - '.gitea/workflows/test.yml'
      - '.gitea/workflows/refresh-image-locks.yml'
      - '.gitea/workflows/pre-release-test.yml'

jobs:
  unit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install dev requirements
        run: python3 -m pip install --break-system-packages -r requirements-dev.txt

      - name: Run unit tests with coverage
        env:
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.unit
        run: python3 -m coverage run -m unittest discover -t . -s tests/unit -v

      - name: Report unit coverage
        env:
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.unit
        run: python3 -m coverage report -m

      - name: Stage unit coverage for upload
        run: cp .coverage.unit coverage-unit.dat

      - name: Upload unit coverage artifact
        uses: actions/upload-artifact@v3
        with:
          name: coverage-unit
          path: coverage-unit.dat

  integration-docker:
    runs-on: ubuntu-latest
    concurrency:
      group: integration-docker-infra
      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install coverage
        run: python3 -m pip install --break-system-packages coverage

      - name: Preflight — Docker backend is ready
        run: |
          python3 --version
          python3 cli.py backend status --backend=docker

      - name: Preflight — clear any leftover poisoned gateway network
        run: |
          # The gateway network has a fixed name and persists across jobs on
          # this shared runner. A pre-fix or concurrent launch can leave it with
          # a malformed IPv6 subnet that trips docker's own ParseAddr in
          # `network inspect` (see PR #515); the code now self-heals it, but the
          # heal can't run if `network inspect` is what's broken on some daemon
          # versions. Drop the network here so this run recreates it IPv4-only.
          # Remove the attached gateway container first (else `network rm` fails
          # on active endpoints); both are recreated by ensure_running. Harmless
          # when absent.
          docker rm --force bot-bottle-orch-gateway 2>/dev/null || true
          docker network rm bot-bottle-gateway 2>/dev/null || true

      - name: Run integration tests (docker) with coverage
        env:
          BOT_BOTTLE_BACKEND: docker
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
        run: |
          set -euo pipefail
          # act_runner executes this job in a container while sharing the host
          # Docker socket. Attach control-plane siblings to the job's network,
          # and use named volumes for state the host daemon must mount.
          DOCKER_CLIENT_NETWORK=$(
            docker inspect "$(hostname)" |
              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
          )
          test -n "$DOCKER_CLIENT_NETWORK"
          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
          export NO_PROXY="*"
          export no_proxy="*"
          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
          python3 -m coverage run -m scripts.unittest_gate \
            -t . -s tests/integration -v \
            --minimum-executed 22 --fail-on-skip

      - name: Clean Docker integration volumes
        if: always()
        run: |
          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
          docker volume rm --force \
            "bot-bottle-ci-root-$RUN_KEY" \
            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true

      - name: Stage docker coverage for upload
        run: cp .coverage.docker coverage-docker.dat

      - name: Upload docker coverage artifact
        uses: actions/upload-artifact@v3
        with:
          name: coverage-docker
          path: coverage-docker.dat

  image-input-builds:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Verify shared bases cover supported architectures
        run: |
          set -euo pipefail
          python_ref=$(python3 -c \
            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
          node_ref=$(python3 -c \
            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
          docker_cli_ref=$(python3 -c \
            'import json; print(json.load(open("image-build-args.json"))["DOCKER_CLI_BASE_IMAGE"])')
          test -n "$python_ref"
          test -n "$node_ref"
          test -n "$docker_cli_ref"
          for ref in "$python_ref" "$node_ref" "$docker_cli_ref"; do
            docker buildx imagetools inspect --raw "$ref" |
              python3 -c '
          import json
          import sys
          manifest = json.load(sys.stdin)
          platforms = {
              (item["platform"]["os"], item["platform"]["architecture"])
              for item in manifest["manifests"]
              if item.get("platform", {}).get("os") != "unknown"
          }
          required = {("linux", "amd64"), ("linux", "arm64")}
          missing = required - platforms
          if missing:
              raise SystemExit(f"base manifest lacks supported platforms: {missing}")
          '
          done

      - name: Verify Codex archives for all supported architectures
        run: |
          set -euo pipefail
          codex_version=$(
            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
          )
          test -n "$codex_version"
          tmp=$(mktemp -d)
          trap 'rm -rf "$tmp"' EXIT
          for target in \
            aarch64-unknown-linux-musl \
            x86_64-unknown-linux-musl
          do
            asset="codex-package-${target}.tar.gz"
            expected=$(
              awk -v asset="$asset" '$2 == asset { print $1 }' \
                bot_bottle/contrib/codex/codex-package_SHA256SUMS
            )
            test -n "$expected"
            curl -fsSL \
              "https://github.com/openai/codex/releases/download/rust-v${codex_version}/${asset}" \
              -o "$tmp/$asset"
            echo "$expected  $tmp/$asset" | sha256sum -c -
            tar -tzf "$tmp/$asset" > "$tmp/$asset.contents"
            grep -Fx 'bin/codex' "$tmp/$asset.contents"
            grep -Fx 'bin/codex-code-mode-host' "$tmp/$asset.contents"
            grep -Fx 'codex-package.json' "$tmp/$asset.contents"
          done

      - name: Build and smoke-test all supported images
        run: |
          set -euo pipefail
          suffix="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-image-inputs}}"
          orchestrator="bot-bottle-orchestrator-inputs:${suffix}"
          gateway="bot-bottle-gateway-inputs:${suffix}"
          orchestrator_fc="bot-bottle-orchestrator-fc-inputs:${suffix}"
          claude="bot-bottle-claude-inputs:${suffix}"
          codex="bot-bottle-codex-inputs:${suffix}"
          pi="bot-bottle-pi-inputs:${suffix}"
          python_base=$(python3 -c \
            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
          node_base=$(python3 -c \
            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')

          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
            -t "$orchestrator" -f Dockerfile.orchestrator .
          orchestrator_id=$(docker image inspect --format '{{.Id}}' "$orchestrator")
          case "$orchestrator_id" in sha256:*) ;; *) exit 1 ;; esac
          orchestrator_base="bot-bottle-orchestrator-inputs:sha256-${orchestrator_id#sha256:}"
          docker image tag "$orchestrator_id" "$orchestrator_base"
          test "$(
            docker image inspect --format '{{.Id}}' "$orchestrator_base"
          )" = "$orchestrator_id"
          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
            -t "$gateway" -f Dockerfile.gateway .
          docker build \
            --build-arg "ORCHESTRATOR_BASE_IMAGE=$orchestrator_base" \
            -t "$orchestrator_fc" -f Dockerfile.orchestrator.fc .
          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
            -t "$claude" -f bot_bottle/contrib/claude/Dockerfile .
          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
            -t "$codex" -f bot_bottle/contrib/codex/Dockerfile .
          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
            -t "$pi" -f bot_bottle/contrib/pi/Dockerfile .

          docker run --rm --entrypoint python3 "$orchestrator" -c \
            'import bot_bottle.orchestrator'
          docker run --rm --entrypoint mitmdump "$gateway" --version
          docker run --rm "$claude" claude --version
          docker run --rm "$codex" codex --version
          docker run --rm "$pi" pi --version

  coverage:
    needs: [unit, integration-docker]
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install coverage
        run: python3 -m pip install --break-system-packages coverage

      - name: Download unit coverage artifact
        uses: actions/download-artifact@v3
        with:
          name: coverage-unit
          path: ${{ github.workspace }}

      - name: Download docker coverage artifact
        uses: actions/download-artifact@v3
        with:
          name: coverage-docker
          path: ${{ github.workspace }}

      - name: Reassemble coverage data files
        run: |
          mv coverage-unit.dat .coverage.unit
          mv coverage-docker.dat .coverage.docker

      - name: Combined coverage (unit + docker integration)
        run: PYTHON=python3 bash scripts/coverage.sh aggregate critical

      - name: Diff-coverage gate (changed lines >= 90%)
        run: |
          git fetch --no-tags origin main:refs/remotes/origin/main
          python3 scripts/diff_coverage.py --base origin/main --min 90