fix(docker): Anonymous image pulls now work. --enable=docker no longer grants keychain access. #348
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: E2E TUI Tests (macOS) | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "bin/**" | |
| - "profiles/**" | |
| - "tests/e2e/**" | |
| - "tests/run.sh" | |
| - "tests/setup_suite.bash" | |
| - "tests/test_helper.bash" | |
| - "dist/**" | |
| - ".github/workflows/e2e-agent-tui-macos.yml" | |
| pull_request: | |
| paths: | |
| - "bin/**" | |
| - "profiles/**" | |
| - "tests/e2e/**" | |
| - "tests/run.sh" | |
| - "tests/setup_suite.bash" | |
| - "tests/test_helper.bash" | |
| - "dist/**" | |
| - ".github/workflows/e2e-agent-tui-macos.yml" | |
| schedule: | |
| # Rerun this workflow weekly (on the main branch) | |
| # to detect breakage when unpinned tool versions change. | |
| # | |
| # Target: Tuesdays at 1-2 AM Eastern (06:00 UTC == 02:00 EDT == 01:00 EST) | |
| - cron: "0 6 * * 2" | |
| workflow_dispatch: | |
| # Disallow all GITHUB_TOKEN permissions by default | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| e2e-tui-macos: | |
| name: E2E TUI Tests (macOS) | |
| runs-on: macos-latest | |
| steps: | |
| - name: Checkout branch | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| persist-credentials: false | |
| # Refuse to run dist/safehouse.sh if it is inconsistent with a | |
| # fresh regeneration, so a PR can't smuggle in arbitrary code, | |
| # past a maintainer's lightweight review of whether it is safe | |
| # to run CI workflows on a PR. | |
| - name: Verify dist/safehouse.sh matches source | |
| run: ./scripts/generate-dist.sh --check | |
| - name: Cache npm download cache | |
| uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5 | |
| with: | |
| path: ~/.npm | |
| key: e2e-npm-${{ runner.os }}-${{ hashFiles('.github/workflows/e2e-agent-tui-macos.yml') }} | |
| restore-keys: | | |
| e2e-npm-${{ runner.os }}- | |
| - name: Prepare artifacts directory | |
| run: mkdir -p artifacts/e2e | |
| - name: Install TUI agent dependencies | |
| env: | |
| HOMEBREW_NO_AUTO_UPDATE: "1" | |
| # NOTE: ignore[adhoc-packages]: --min-release-age=N mitigates the ad-hoc | |
| # unlocked npm installs below | |
| run: | # zizmor: ignore[adhoc-packages] | |
| # fd/ripgrep are for pi: it downloads its own copies at first launch when they | |
| # are missing from PATH, which delays the TUI past the roundtrip timeout | |
| # 1. Install Safehouse's own dependencies. (TODO: Consider pinning.) | |
| # 2. Install latest unpinned versions of tools explicitly supported | |
| # as running inside a Safehouse sandbox | |
| # NOTE: Does NOT use any kind of --min-release-age=N option | |
| # to reduce exposure to freshly-published supply chain | |
| # compromises because these formulae are all from homebrew-core | |
| # and thus are reviewed manually by a Homebrew maintainer | |
| # (not just the formula author) before publish. | |
| brew install \ | |
| bats-core parallel \ | |
| aider block-goose-cli node tmux fd ripgrep | |
| # NOTE: Uses --min-release-age=N to reduce exposure to | |
| # freshly-published supply chain compromises. | |
| # NOTE: @sourcegraph/amp's version is pinned, unlike other packages here. | |
| # Bump the pin occasionally so it doesn't go too stale. | |
| # | |
| # All of amp's published versions are marked as prerelease but | |
| # --min-release-age=N only considers non-prerelease versions, | |
| # failing to find any valid version. An exact version pin | |
| # ignores prerelease-ness and succeeds. | |
| npm install --global --no-fund --no-audit --min-release-age=4 \ | |
| @anthropic-ai/claude-code \ | |
| @earendil-works/pi-coding-agent \ | |
| @github/copilot \ | |
| @google/gemini-cli \ | |
| @kilocode/cli \ | |
| @openai/codex \ | |
| @sourcegraph/amp@0.0.1786054439-gd42f19 \ | |
| cline \ | |
| opencode-ai | |
| echo | |
| # @kilocode/cli 7.4.x hangs its TUI on GitHub's macOS runners. | |
| # Skip that version. | |
| KILO_MIN_VERSION=7.5.5 | |
| kilo_version="$(kilo --version 2>/dev/null | tr -d '[:space:]')" | |
| if [ "$(printf '%s\n%s\n' "${KILO_MIN_VERSION}" "${kilo_version}" \ | |
| | sort --version-sort | head -1)" != "${KILO_MIN_VERSION}" ]; then | |
| npm install --global --no-fund --no-audit "@kilocode/cli@${KILO_MIN_VERSION}" | |
| fi | |
| echo "Installed versions:" | |
| # NOTE: Ignore non-zero exit code for extraneous or unmet peer deps | |
| npm ls --global --depth=0 || true | |
| - name: Run agent TUI tests | |
| # NOTE: ignore[secrets-outside-env]: This workflow can only run with | |
| # maintainer approval. Maintainer review of code pending merge | |
| # is considered sufficient protection against PR code | |
| # that tries to exfiltrate secrets. See discussion in: | |
| # https://github.com/eugene1g/agent-safehouse/issues/137 | |
| env: | |
| OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env] | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env] | |
| GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }} # zizmor: ignore[secrets-outside-env] | |
| SAFEHOUSE_AGENT_TUI_STARTUP_WAIT_SECS: "20" | |
| run: | | |
| set -o pipefail | |
| ./tests/run.sh e2e 2>&1 | tee artifacts/e2e/tests.log | |
| - name: Upload agent TUI logs | |
| if: always() | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: agent-tui-logs | |
| path: artifacts/e2e | |
| if-no-files-found: ignore |