mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-24 16:54:43 +00:00
957ea640de
* fix(ci): publish inline E2E evidence Upload bounded screenshot evidence from E2E, then publish validated images from a trusted workflow_run job to commit-pinned branches in the evidence repo. Wait briefly for the live CI review comment marker before publishing, so GitHub's read-after-write delay cannot leave an orphaned evidence branch. * fix(ci): isolate privileged credentials from PR jobs Keep App private keys and Docker Hub credentials out of PR-controlled workflows. Use protected environments for trusted publishing and a public repository variable for the App client ID. * fix(ci): attach E2E evidence with restricted bot session Replace the App-backed evidence repository publisher with gh-image uploads from a dedicated bot session in the gh-image environment. * fix(ci): publish validated E2E evidence from forks Let the trusted default-branch publisher handle bounded, validated evidence artifacts from fork PR CI without checking out or executing fork code.
69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
name: Publish E2E evidence
|
|
|
|
# This runs only from the default branch after CI completes. It intentionally
|
|
# checks out main, never the PR ref, and treats the downloaded artifact as
|
|
# untrusted input before uploading validated GitHub attachments.
|
|
on:
|
|
workflow_run:
|
|
workflows: [CI]
|
|
types: [completed]
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: publish-e2e-evidence-${{ github.event.workflow_run.id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
publish:
|
|
name: Publish inline E2E evidence
|
|
if: github.event.workflow_run.event == 'pull_request'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
environment: gh-image
|
|
steps:
|
|
- name: Check out trusted publisher
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ github.event.repository.default_branch }}
|
|
persist-credentials: false
|
|
|
|
# v1.2.0 resolves to 44f4b93ecbbe22de6c45fa2f62f519aee564ca8c.
|
|
- name: Install gh-image
|
|
run: gh extension install drogers0/gh-image --pin v1.2.0
|
|
|
|
- name: Download and attach evidence
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
GH_SESSION_TOKEN: ${{ secrets.GH_IMAGE_SESSION_TOKEN }}
|
|
SOURCE_REPO: ${{ github.repository }}
|
|
SOURCE_RUN_ID: ${{ github.event.workflow_run.id }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
PR_NUMBER=$(gh api "repos/$SOURCE_REPO/actions/runs/$SOURCE_RUN_ID" --jq '.pull_requests[0].number // empty')
|
|
if [ -z "$PR_NUMBER" ]; then
|
|
echo "No pull request is associated with CI run $SOURCE_RUN_ID."
|
|
exit 0
|
|
fi
|
|
|
|
ARTIFACT_NAME=$(gh api "repos/$SOURCE_REPO/actions/runs/$SOURCE_RUN_ID/artifacts" \
|
|
--jq '.artifacts[] | select(.expired == false and (.name | startswith("e2e-evidence-"))) | .name' \
|
|
| python3 -c 'import sys; print(next(iter(sys.stdin), "").strip())')
|
|
if [ -z "$ARTIFACT_NAME" ]; then
|
|
echo "No E2E evidence artifact was produced for CI run $SOURCE_RUN_ID."
|
|
exit 0
|
|
fi
|
|
|
|
EVIDENCE_DIR="$RUNNER_TEMP/e2e-evidence"
|
|
mkdir -p "$EVIDENCE_DIR"
|
|
gh run download "$SOURCE_RUN_ID" --repo "$SOURCE_REPO" --name "$ARTIFACT_NAME" --dir "$EVIDENCE_DIR"
|
|
|
|
python3 scripts/ci/publish_e2e_evidence.py \
|
|
--evidence-dir "$EVIDENCE_DIR" \
|
|
--source-repo "$SOURCE_REPO" \
|
|
--pr-number "$PR_NUMBER"
|