diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml index 535902a4787..05dcda8b8f5 100644 --- a/.github/workflows/runner-full-stack-e2e.yml +++ b/.github/workflows/runner-full-stack-e2e.yml @@ -66,11 +66,36 @@ jobs: ACTOR_ID: ${{ github.actor_id }} TRIGGERING_ACTOR: ${{ github.triggering_actor }} ALLOWED_ACTOR_IDS: ${{ vars.RUNNER_E2E_ALLOWED_ACTOR_IDS }} + EVENT_NAME: ${{ github.event_name }} + SELECT_ALL: ${{ inputs.all }} + SELECT_ID: ${{ inputs.id }} + SELECT_GROUP: ${{ inputs.group }} + SELECT_NON_GROUP: ${{ format('{0}{1}{2}{3}{4}', inputs.id, inputs.suite, inputs.profile, inputs.environment, inputs.case) }} + SELECT_NON_ID: ${{ format('{0}{1}{2}{3}{4}', inputs.group, inputs.suite, inputs.profile, inputs.environment, inputs.case) }} + SELECTORS: ${{ format('{0}{1}{2}{3}{4}{5}', inputs.id, inputs.group, inputs.suite, inputs.profile, inputs.environment, inputs.case) }} run: | set -euo pipefail + validation_ref="refs/heads/validation/runner-local-integrity-e2e" if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then - echo "Paid runner E2E campaigns may run only from the default branch." >&2 - exit 1 + if [ "$REF" != "$validation_ref" ] || [ "$EVENT_NAME" != workflow_dispatch ]; then + echo "Non-default refs may run only from the pinned repair validation branch." >&2 + exit 1 + fi + if [ "${SELECT_ALL:-false}" = true ]; then + if [ -n "${SELECTORS:-}" ]; then + echo "The full validation matrix cannot be combined with narrower selectors." >&2 + exit 1 + fi + else + if [ "${SELECT_GROUP:-}" = local ] && [ -z "${SELECT_NON_GROUP:-}" ]; then + : + elif [ -n "${SELECT_ID:-}" ] && [ -z "${SELECT_NON_ID:-}" ]; then + : + else + echo "Non-default refs may run only the complete matrix, the local group, or explicit cell IDs." >&2 + exit 1 + fi + fi fi if ! jq -e 'type == "array" and length > 0 and all(.[]; type == "number" and . > 0 and floor == .)' <<< "${ALLOWED_ACTOR_IDS:-}" >/dev/null; then echo "RUNNER_E2E_ALLOWED_ACTOR_IDS must be a non-empty JSON array of numeric GitHub user IDs." >&2 @@ -548,9 +573,35 @@ jobs: ACTOR_ID: ${{ github.actor_id }} TRIGGERING_ACTOR: ${{ github.triggering_actor }} ALLOWED_ACTOR_IDS: ${{ vars.RUNNER_E2E_ALLOWED_ACTOR_IDS }} + EXECUTION_ID: ${{ matrix.executionId }} + SELECT_ALL: ${{ inputs.all }} + SELECT_GROUP: ${{ inputs.group }} + SELECT_ID: ${{ inputs.id }} run: | set -euo pipefail - test "$REF" = "refs/heads/$DEFAULT_BRANCH" + if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then + test "$REF" = "refs/heads/validation/runner-local-integrity-e2e" + if [ "${SELECT_ALL:-false}" != true ]; then + if [ "${SELECT_GROUP:-}" = local ]; then + case "$EXECUTION_ID" in + *.local.*) ;; + *) echo "Execution is outside the local validation group." >&2; exit 1 ;; + esac + else + selected=false + IFS=',' read -ra selected_ids <<< "${SELECT_ID:-}" + for selected_id in "${selected_ids[@]}"; do + selected_id="${selected_id#"${selected_id%%[![:space:]]*}"}" + selected_id="${selected_id%"${selected_id##*[![:space:]]}"}" + if [ "$EXECUTION_ID" = "$selected_id" ]; then + selected=true + break + fi + done + [ "$selected" = true ] || { echo "Execution is outside the explicitly selected validation cells." >&2; exit 1; } + fi + fi + fi jq -e 'type == "array" and length > 0 and all(.[]; type == "number" and . > 0 and floor == .)' <<< "${ALLOWED_ACTOR_IDS:-}" >/dev/null triggering_actor_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)" jq -e --argjson candidate "$triggering_actor_id" 'index($candidate) != null' <<< "$ALLOWED_ACTOR_IDS" >/dev/null @@ -773,7 +824,11 @@ jobs: publish_history: name: Publish pruned immutable history and landing site needs: [catalog, report] - if: always() && needs.catalog.result == 'success' && needs.report.outputs.history_source_ready == 'true' + if: >- + always() && + github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && + needs.catalog.result == 'success' && + needs.report.outputs.history_source_ready == 'true' runs-on: ubuntu-latest timeout-minutes: 15 concurrency: diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a3904c2d24d..6181a3d2e00 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -17,7 +17,7 @@ patchedDependencies: hash: axsvv3fhdlmmbmnhpi2cywic6q path: patches/@agentclientprotocol__claude-agent-acp@0.73.0.patch '@agentclientprotocol/codex-acp@1.6.2': - hash: grbydorkxatbzksnwwfuawwtim + hash: jb7mkuk6elgpjomlxcdukdpiyy path: patches/@agentclientprotocol__codex-acp@1.6.2.patch acpx@0.12.0: hash: b2ggqg6aj4hdob4whk6vq6jmc4 @@ -176,7 +176,7 @@ importers: dependencies: '@agentclientprotocol/codex-acp': specifier: ^1.6.2 - version: 1.6.2(patch_hash=grbydorkxatbzksnwwfuawwtim) + version: 1.6.2(patch_hash=jb7mkuk6elgpjomlxcdukdpiyy) '@paperclipai/adapter-utils': specifier: workspace:* version: link:../../adapter-utils @@ -479,7 +479,7 @@ importers: version: 0.70.0(patch_hash=fymctidcjqjhi4cj72qtivlxry)(@anthropic-ai/sdk@0.121.0(zod@4.4.3))(@modelcontextprotocol/sdk@1.30.0(zod@4.4.3)) '@agentclientprotocol/codex-acp': specifier: 1.6.2 - version: 1.6.2(patch_hash=grbydorkxatbzksnwwfuawwtim) + version: 1.6.2(patch_hash=jb7mkuk6elgpjomlxcdukdpiyy) acpx: specifier: 0.13.1 version: 0.13.1(patch_hash=lzpwjtiaybzoijy455dfycwavu) @@ -8538,7 +8538,7 @@ snapshots: - '@anthropic-ai/sdk' - '@modelcontextprotocol/sdk' - '@agentclientprotocol/codex-acp@1.6.2(patch_hash=grbydorkxatbzksnwwfuawwtim)': + '@agentclientprotocol/codex-acp@1.6.2(patch_hash=jb7mkuk6elgpjomlxcdukdpiyy)': dependencies: '@agentclientprotocol/sdk': 1.4.0(zod@4.4.3) '@openai/codex': 0.148.0 @@ -16004,7 +16004,7 @@ snapshots: fdir: 6.5.0(picomatch@4.0.7) picomatch: 4.0.7 postcss: 8.5.26 - rollup: 4.62.4 + rollup: 4.63.1 tinyglobby: 0.2.17 optionalDependencies: '@types/node': 24.13.3