mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-15 00:19:14 +00:00
83cb6767b3
* fix(sandbox): add FOWNER for AIO 1.11 startup * test(sandbox): cover FOWNER startup capability * docs(sandbox): document FOWNER capability * test(sandbox): pin FOWNER regression smoke * ci(sandbox): allow pinning FOWNER smoke image * style(sandbox): format FOWNER smoke test --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
81 lines
3.1 KiB
YAML
81 lines
3.1 KiB
YAML
name: Sandbox Image Smoke
|
|
|
|
# Real-image validation of the Docker sandbox hardening. The job preserves
|
|
# baseline coverage for the repository-configured/default AIO image and also
|
|
# exercises the 1.11.0 startup path that requires FOWNER for chmod on
|
|
# /run/user/1000. The offline unit suite (-m "not live") never runs these.
|
|
#
|
|
# Reproducibility: SANDBOX_SMOKE_IMAGE can pin the baseline image. Both that
|
|
# image (or the :latest fallback) and the explicit 1.11.0 regression image are
|
|
# pulled first and converted to immutable repo@sha256 references; the exact
|
|
# digests are printed to the job summary before either live test runs.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
paths:
|
|
- 'backend/packages/harness/deerflow/community/aio_sandbox/**'
|
|
- 'backend/tests/test_aio_sandbox_local_backend.py'
|
|
- '.github/workflows/sandbox-image-smoke.yml'
|
|
|
|
concurrency:
|
|
group: sandbox-image-smoke-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
sandbox-image-smoke:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 25
|
|
env:
|
|
SANDBOX_SMOKE_IMAGE_REF: ${{ vars.SANDBOX_SMOKE_IMAGE || 'enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest' }}
|
|
FOWNER_SMOKE_IMAGE_REF: ${{ vars.SANDBOX_FOWNER_SMOKE_IMAGE || 'enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:1.11.0' }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Resolve immutable image references for this run
|
|
# Pull on the runner's platform, then pass only immutable repo@sha256
|
|
# references to pytest. This keeps both the baseline and the 1.11.0
|
|
# regression run reproducible even if either source tag moves later.
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
resolve_image() {
|
|
local source_ref="$1"
|
|
local output_var="$2"
|
|
local label="$3"
|
|
local repo_digest
|
|
|
|
docker pull "$source_ref" >/dev/null
|
|
repo_digest="$(docker image inspect "$source_ref" --format '{{index .RepoDigests 0}}')"
|
|
echo "$output_var=$repo_digest" >> "$GITHUB_ENV"
|
|
printf '%s: `%s`\n' "$label" "$repo_digest" | tee -a "$GITHUB_STEP_SUMMARY"
|
|
}
|
|
|
|
resolve_image "$SANDBOX_SMOKE_IMAGE_REF" DEER_FLOW_SANDBOX_SMOKE_IMAGE "Configured/default smoke image"
|
|
resolve_image "$FOWNER_SMOKE_IMAGE_REF" DEER_FLOW_SANDBOX_FOWNER_SMOKE_IMAGE "FOWNER regression image (1.11.0)"
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v7
|
|
with:
|
|
# Must match backend/Dockerfile's UV_IMAGE tag; pinned by backend/tests/test_ci_uv_version_pin.py
|
|
version: "0.11.1"
|
|
|
|
- name: Install backend dependencies
|
|
working-directory: backend
|
|
run: uv sync --group dev
|
|
|
|
- name: Run the live real-image smoke tests
|
|
working-directory: backend
|
|
run: uv run pytest -m live tests/test_aio_sandbox_local_backend.py -v
|