mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-06 05:40:44 +00:00
chore(ci): add agent CodeQL PR quality guard
Promotes the existing agent-runtime quality shard to PR/manual selection and documents the expanded twelve-shard PR quality set.
This commit is contained in:
Vincent Koc
33
.github/workflows/codeql-critical-quality.yml
vendored
33
.github/workflows/codeql-critical-quality.yml
vendored
@@ -10,6 +10,7 @@ on:
|
||||
type: choice
|
||||
options:
|
||||
- all
|
||||
- agent-runtime-boundary
|
||||
- config-boundary
|
||||
- core-auth-secrets
|
||||
- channel-runtime-boundary
|
||||
@@ -63,6 +64,27 @@ on:
|
||||
- "src/agents/sandbox/**"
|
||||
- "src/agents/sandbox.ts"
|
||||
- "src/agents/sandbox-*.ts"
|
||||
- "src/acp/control-plane/**"
|
||||
- "src/agents/cli-runner/**"
|
||||
- "src/agents/command/**"
|
||||
- "src/agents/pi-embedded-runner/**"
|
||||
- "src/agents/tools/**"
|
||||
- "src/agents/*completion*.ts"
|
||||
- "src/agents/*transport*.ts"
|
||||
- "src/agents/model-*.ts"
|
||||
- "src/agents/openclaw-tools*.ts"
|
||||
- "src/agents/provider-*.ts"
|
||||
- "src/agents/session*.ts"
|
||||
- "src/agents/tool-call*.ts"
|
||||
- "src/auto-reply/reply/agent-runner*.ts"
|
||||
- "src/auto-reply/reply/commands*.ts"
|
||||
- "src/auto-reply/reply/directive-handling*.ts"
|
||||
- "src/auto-reply/reply/dispatch-*.ts"
|
||||
- "src/auto-reply/reply/get-reply-run*.ts"
|
||||
- "src/auto-reply/reply/provider-dispatcher*.ts"
|
||||
- "src/auto-reply/reply/queue*.ts"
|
||||
- "src/auto-reply/reply/reply-run-registry*.ts"
|
||||
- "src/auto-reply/reply/session*.ts"
|
||||
- "src/channels/**"
|
||||
- "src/auto-reply/reply/post-compaction-context.ts"
|
||||
- "src/auto-reply/reply/queue/**"
|
||||
@@ -125,6 +147,7 @@ jobs:
|
||||
runs-on: blacksmith-4vcpu-ubuntu-2404
|
||||
timeout-minutes: 5
|
||||
outputs:
|
||||
agent: ${{ steps.detect.outputs.agent }}
|
||||
channel: ${{ steps.detect.outputs.channel }}
|
||||
config: ${{ steps.detect.outputs.config }}
|
||||
core_auth_secrets: ${{ steps.detect.outputs.core_auth_secrets }}
|
||||
@@ -147,6 +170,7 @@ jobs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
agent=false
|
||||
channel=false
|
||||
config=false
|
||||
core_auth_secrets=false
|
||||
@@ -160,6 +184,7 @@ jobs:
|
||||
session_diagnostics=false
|
||||
|
||||
if [[ "${EVENT_NAME}" != "pull_request" ]]; then
|
||||
agent=true
|
||||
channel=true
|
||||
config=true
|
||||
core_auth_secrets=true
|
||||
@@ -175,6 +200,7 @@ jobs:
|
||||
while IFS= read -r file; do
|
||||
case "${file}" in
|
||||
.github/codeql/*|.github/workflows/codeql-critical-quality.yml)
|
||||
agent=true
|
||||
channel=true
|
||||
config=true
|
||||
core_auth_secrets=true
|
||||
@@ -187,6 +213,9 @@ jobs:
|
||||
provider=true
|
||||
session_diagnostics=true
|
||||
;;
|
||||
src/acp/control-plane/*|src/agents/cli-runner/*|src/agents/command/*|src/agents/pi-embedded-runner/*|src/agents/tools/*|src/agents/*completion*.ts|src/agents/*transport*.ts|src/agents/model-*.ts|src/agents/openclaw-tools*.ts|src/agents/provider-*.ts|src/agents/session*.ts|src/agents/tool-call*.ts|src/auto-reply/reply/agent-runner*.ts|src/auto-reply/reply/commands*.ts|src/auto-reply/reply/directive-handling*.ts|src/auto-reply/reply/dispatch-*.ts|src/auto-reply/reply/get-reply-run*.ts|src/auto-reply/reply/provider-dispatcher*.ts|src/auto-reply/reply/queue*.ts|src/auto-reply/reply/reply-run-registry*.ts|src/auto-reply/reply/session*.ts)
|
||||
agent=true
|
||||
;;
|
||||
src/auto-reply/reply/post-compaction-context.ts|src/auto-reply/reply/queue/*|src/auto-reply/reply/startup-context.ts|src/commands/doctor-session-*.ts|src/commands/session-store-targets.ts|src/commands/sessions*.ts|src/infra/diagnostic-*.ts|src/infra/diagnostics-timeline.ts|src/infra/session-delivery-queue*.ts|src/logging/diagnostic*.ts)
|
||||
session_diagnostics=true
|
||||
;;
|
||||
@@ -255,6 +284,7 @@ jobs:
|
||||
fi
|
||||
|
||||
{
|
||||
echo "agent=${agent}"
|
||||
echo "channel=${channel}"
|
||||
echo "config=${config}"
|
||||
echo "core_auth_secrets=${core_auth_secrets}"
|
||||
@@ -362,7 +392,8 @@ jobs:
|
||||
|
||||
agent-runtime-boundary:
|
||||
name: Critical Quality (agent-runtime-boundary)
|
||||
if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all') }}
|
||||
needs: quality-shards
|
||||
if: ${{ needs.quality-shards.outputs.agent == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'agent-runtime-boundary') }}
|
||||
runs-on: blacksmith-4vcpu-ubuntu-2404
|
||||
timeout-minutes: 25
|
||||
steps:
|
||||
|
||||
@@ -335,12 +335,12 @@ The pull request guard stays light: it only starts for changes under `.github/ac
|
||||
|
||||
### Critical Quality categories
|
||||
|
||||
`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `config-boundary`, `core-auth-secrets`, `channel-runtime-boundary`, `gateway-runtime-boundary`, `memory-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `session-diagnostics-boundary`, `plugin-boundary`, `plugin-sdk-package-contract`, and `plugin-sdk-reply-runtime` shards for config schema/migration/IO code, auth/secrets/sandbox/security code, core channel and bundled channel plugin runtime, gateway protocol/server-method, memory runtime/SDK glue, MCP/process/outbound delivery, provider runtime/model catalog, session diagnostics/delivery queues, plugin loader, Plugin SDK/package-contract, or Plugin SDK reply runtime changes. CodeQL config and quality workflow changes run all eleven PR quality shards.
|
||||
`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `agent-runtime-boundary`, `config-boundary`, `core-auth-secrets`, `channel-runtime-boundary`, `gateway-runtime-boundary`, `memory-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `session-diagnostics-boundary`, `plugin-boundary`, `plugin-sdk-package-contract`, and `plugin-sdk-reply-runtime` shards for agent command/model/tool execution and reply dispatch code, config schema/migration/IO code, auth/secrets/sandbox/security code, core channel and bundled channel plugin runtime, gateway protocol/server-method, memory runtime/SDK glue, MCP/process/outbound delivery, provider runtime/model catalog, session diagnostics/delivery queues, plugin loader, Plugin SDK/package-contract, or Plugin SDK reply runtime changes. CodeQL config and quality workflow changes run all twelve PR quality shards.
|
||||
|
||||
Manual dispatch accepts:
|
||||
|
||||
```
|
||||
profile=all|config-boundary|core-auth-secrets|channel-runtime-boundary|gateway-runtime-boundary|memory-runtime-boundary|mcp-process-runtime-boundary|plugin-boundary|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary
|
||||
profile=all|agent-runtime-boundary|config-boundary|core-auth-secrets|channel-runtime-boundary|gateway-runtime-boundary|memory-runtime-boundary|mcp-process-runtime-boundary|plugin-boundary|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary
|
||||
```
|
||||
|
||||
The narrow profiles are teaching/iteration hooks for running one quality shard in isolation.
|
||||
|
||||
@@ -71,6 +71,7 @@ describe("channel plugin module loader helpers", () => {
|
||||
|
||||
it("uses native require for eligible JavaScript modules before falling back to Jiti", async () => {
|
||||
const createJiti = vi.fn(() => vi.fn(() => ({ ok: false })));
|
||||
vi.resetModules();
|
||||
vi.doMock("jiti", () => ({
|
||||
createJiti,
|
||||
}));
|
||||
@@ -95,6 +96,7 @@ describe("channel plugin module loader helpers", () => {
|
||||
|
||||
it("creates the runtime-supported Jiti boundary for Windows dist loads", async () => {
|
||||
const createJiti = vi.fn(() => vi.fn(() => ({ ok: true })));
|
||||
vi.resetModules();
|
||||
vi.doMock("jiti", () => ({
|
||||
createJiti,
|
||||
}));
|
||||
|
||||
Reference in New Issue
Block a user