Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-21 08:22:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(hermes): cover shared native fixture inputs

Browse Source 
Trigger credential-free Linux native fixtures for shared Runner sources, Rust and build manifests, dependency patches, and workspace inputs. Verify actual glob matching for attachment, backend, transport and dependency changes. Paid workflow authority is unchanged.

Validation: 15 workflow security tests and actionlint passed. Also record 26 passing real-database authority tests, the expected old-lock negative proof, and 143 passing ACPX lifecycle regressions.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-08 12:28:11 -05:00
1 parent d8453bf775
commit 6f87ea523b
3 files changed
+46 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/runner-e2e/workflow-security.test.ts
+22
View File
@@ -15,6 +15,28 @@ const everydayOracleImage =
"python@sha256:9d2e5553305c7c7b0097999bb17187c69b921ccd6bc9d40e4bb5ebe652c00285";
describe("public repository paid workflow security", () => {
it("runs native Hermes fixtures for shared sources, patches, and build inputs", async () => {
const workflow = await readFile(path.join(repositoryRoot, ".github/workflows/runner-hermes-native.yml"), "utf8");
const filter = workflow.slice(workflow.indexOf(" paths:"), workflow.indexOf(" workflow_dispatch:"));
const patterns = [...filter.matchAll(/^ - (.+)$/gmu)].map(match => match[1]!);
const triggers = (file: string) => patterns.some(pattern => path.matchesGlob(file, pattern));
for (const file of [
"patches/acpx@0.13.1.patch",
"packages/paperclip-runner/src/contracts/user-attachments.ts",
"packages/paperclip-runner/src/backends/codex-native-backend.ts",
"packages/paperclip-runner/src/control-plane/durable-prp-control-plane.ts",
"packages/paperclip-runner/runner/crates/runner-core/src/durable/runner.rs",
"packages/paperclip-runner/runner/Cargo.lock",
"packages/paperclip-runner/package.json",
"packages/paperclip-runner/scripts/build-verified-provider-entrypoints.mjs",
"packages/paperclip-eval-kernel/src/index.ts",
"packages/adapter-utils/src/paperclip-runner-permissions.ts",
"packages/shared/src/ai-connections.ts",
"package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", "tsconfig.json",
"tests/runner-e2e/provision-hermes-linux.sh",
]) expect(triggers(file), `Missing native fixture trigger: ${file}`).toBe(true);
expect(triggers("README.md")).toBe(false);
});
it("keeps native Hermes PR fixtures outside paid authority and strips their child environment", async () => {
const workflow = await readFile(path.join(repositoryRoot, ".github/workflows/runner-hermes-native.yml"), "utf8");
expect(workflow).toContain("pull_request:");