From 02597caa8bff86503e4d2241d9835d64c438f95f Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Thu, 30 Apr 2026 00:01:12 -0700 Subject: [PATCH] chore(ci): add agent CodeQL PR quality guard Promotes the existing agent-runtime quality shard to PR/manual selection and documents the expanded twelve-shard PR quality set. --- .github/workflows/codeql-critical-quality.yml | 33 ++++++++++++++++++- docs/ci.md | 4 +-- src/channels/plugins/module-loader.test.ts | 2 ++ 3 files changed, 36 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql-critical-quality.yml b/.github/workflows/codeql-critical-quality.yml index 25e141938a1..97989e4cdac 100644 --- a/.github/workflows/codeql-critical-quality.yml +++ b/.github/workflows/codeql-critical-quality.yml @@ -10,6 +10,7 @@ on: type: choice options: - all + - agent-runtime-boundary - config-boundary - core-auth-secrets - channel-runtime-boundary @@ -63,6 +64,27 @@ on: - "src/agents/sandbox/**" - "src/agents/sandbox.ts" - "src/agents/sandbox-*.ts" + - "src/acp/control-plane/**" + - "src/agents/cli-runner/**" + - "src/agents/command/**" + - "src/agents/pi-embedded-runner/**" + - "src/agents/tools/**" + - "src/agents/*completion*.ts" + - "src/agents/*transport*.ts" + - "src/agents/model-*.ts" + - "src/agents/openclaw-tools*.ts" + - "src/agents/provider-*.ts" + - "src/agents/session*.ts" + - "src/agents/tool-call*.ts" + - "src/auto-reply/reply/agent-runner*.ts" + - "src/auto-reply/reply/commands*.ts" + - "src/auto-reply/reply/directive-handling*.ts" + - "src/auto-reply/reply/dispatch-*.ts" + - "src/auto-reply/reply/get-reply-run*.ts" + - "src/auto-reply/reply/provider-dispatcher*.ts" + - "src/auto-reply/reply/queue*.ts" + - "src/auto-reply/reply/reply-run-registry*.ts" + - "src/auto-reply/reply/session*.ts" - "src/channels/**" - "src/auto-reply/reply/post-compaction-context.ts" - "src/auto-reply/reply/queue/**" @@ -125,6 +147,7 @@ jobs: runs-on: blacksmith-4vcpu-ubuntu-2404 timeout-minutes: 5 outputs: + agent: ${{ steps.detect.outputs.agent }} channel: ${{ steps.detect.outputs.channel }} config: ${{ steps.detect.outputs.config }} core_auth_secrets: ${{ steps.detect.outputs.core_auth_secrets }} @@ -147,6 +170,7 @@ jobs: run: | set -euo pipefail + agent=false channel=false config=false core_auth_secrets=false @@ -160,6 +184,7 @@ jobs: session_diagnostics=false if [[ "${EVENT_NAME}" != "pull_request" ]]; then + agent=true channel=true config=true core_auth_secrets=true @@ -175,6 +200,7 @@ jobs: while IFS= read -r file; do case "${file}" in .github/codeql/*|.github/workflows/codeql-critical-quality.yml) + agent=true channel=true config=true core_auth_secrets=true @@ -187,6 +213,9 @@ jobs: provider=true session_diagnostics=true ;; + src/acp/control-plane/*|src/agents/cli-runner/*|src/agents/command/*|src/agents/pi-embedded-runner/*|src/agents/tools/*|src/agents/*completion*.ts|src/agents/*transport*.ts|src/agents/model-*.ts|src/agents/openclaw-tools*.ts|src/agents/provider-*.ts|src/agents/session*.ts|src/agents/tool-call*.ts|src/auto-reply/reply/agent-runner*.ts|src/auto-reply/reply/commands*.ts|src/auto-reply/reply/directive-handling*.ts|src/auto-reply/reply/dispatch-*.ts|src/auto-reply/reply/get-reply-run*.ts|src/auto-reply/reply/provider-dispatcher*.ts|src/auto-reply/reply/queue*.ts|src/auto-reply/reply/reply-run-registry*.ts|src/auto-reply/reply/session*.ts) + agent=true + ;; src/auto-reply/reply/post-compaction-context.ts|src/auto-reply/reply/queue/*|src/auto-reply/reply/startup-context.ts|src/commands/doctor-session-*.ts|src/commands/session-store-targets.ts|src/commands/sessions*.ts|src/infra/diagnostic-*.ts|src/infra/diagnostics-timeline.ts|src/infra/session-delivery-queue*.ts|src/logging/diagnostic*.ts) session_diagnostics=true ;; @@ -255,6 +284,7 @@ jobs: fi { + echo "agent=${agent}" echo "channel=${channel}" echo "config=${config}" echo "core_auth_secrets=${core_auth_secrets}" @@ -362,7 +392,8 @@ jobs: agent-runtime-boundary: name: Critical Quality (agent-runtime-boundary) - if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.profile == 'all') }} + needs: quality-shards + if: ${{ needs.quality-shards.outputs.agent == 'true' && (github.event_name != 'pull_request' || !github.event.pull_request.draft) && (github.event_name == 'pull_request' || github.event_name != 'workflow_dispatch' || inputs.profile == 'all' || inputs.profile == 'agent-runtime-boundary') }} runs-on: blacksmith-4vcpu-ubuntu-2404 timeout-minutes: 25 steps: diff --git a/docs/ci.md b/docs/ci.md index 255c7a82228..00924382d94 100644 --- a/docs/ci.md +++ b/docs/ci.md @@ -335,12 +335,12 @@ The pull request guard stays light: it only starts for changes under `.github/ac ### Critical Quality categories -`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `config-boundary`, `core-auth-secrets`, `channel-runtime-boundary`, `gateway-runtime-boundary`, `memory-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `session-diagnostics-boundary`, `plugin-boundary`, `plugin-sdk-package-contract`, and `plugin-sdk-reply-runtime` shards for config schema/migration/IO code, auth/secrets/sandbox/security code, core channel and bundled channel plugin runtime, gateway protocol/server-method, memory runtime/SDK glue, MCP/process/outbound delivery, provider runtime/model catalog, session diagnostics/delivery queues, plugin loader, Plugin SDK/package-contract, or Plugin SDK reply runtime changes. CodeQL config and quality workflow changes run all eleven PR quality shards. +`CodeQL Critical Quality` is the matching non-security shard. It runs only error-severity, non-security JavaScript/TypeScript quality queries over narrow high-value surfaces on the smaller Blacksmith Linux runner. Its pull request guard is intentionally smaller than the scheduled profile: non-draft PRs only run the matching `agent-runtime-boundary`, `config-boundary`, `core-auth-secrets`, `channel-runtime-boundary`, `gateway-runtime-boundary`, `memory-runtime-boundary`, `mcp-process-runtime-boundary`, `provider-runtime-boundary`, `session-diagnostics-boundary`, `plugin-boundary`, `plugin-sdk-package-contract`, and `plugin-sdk-reply-runtime` shards for agent command/model/tool execution and reply dispatch code, config schema/migration/IO code, auth/secrets/sandbox/security code, core channel and bundled channel plugin runtime, gateway protocol/server-method, memory runtime/SDK glue, MCP/process/outbound delivery, provider runtime/model catalog, session diagnostics/delivery queues, plugin loader, Plugin SDK/package-contract, or Plugin SDK reply runtime changes. CodeQL config and quality workflow changes run all twelve PR quality shards. Manual dispatch accepts: ``` -profile=all|config-boundary|core-auth-secrets|channel-runtime-boundary|gateway-runtime-boundary|memory-runtime-boundary|mcp-process-runtime-boundary|plugin-boundary|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary +profile=all|agent-runtime-boundary|config-boundary|core-auth-secrets|channel-runtime-boundary|gateway-runtime-boundary|memory-runtime-boundary|mcp-process-runtime-boundary|plugin-boundary|plugin-sdk-package-contract|plugin-sdk-reply-runtime|provider-runtime-boundary|session-diagnostics-boundary ``` The narrow profiles are teaching/iteration hooks for running one quality shard in isolation. diff --git a/src/channels/plugins/module-loader.test.ts b/src/channels/plugins/module-loader.test.ts index 66cfcff43d9..94d8d934394 100644 --- a/src/channels/plugins/module-loader.test.ts +++ b/src/channels/plugins/module-loader.test.ts @@ -71,6 +71,7 @@ describe("channel plugin module loader helpers", () => { it("uses native require for eligible JavaScript modules before falling back to Jiti", async () => { const createJiti = vi.fn(() => vi.fn(() => ({ ok: false }))); + vi.resetModules(); vi.doMock("jiti", () => ({ createJiti, })); @@ -95,6 +96,7 @@ describe("channel plugin module loader helpers", () => { it("creates the runtime-supported Jiti boundary for Windows dist loads", async () => { const createJiti = vi.fn(() => vi.fn(() => ({ ok: true }))); + vi.resetModules(); vi.doMock("jiti", () => ({ createJiti, }));