Extract the benchmark-regression job from the default PR CI workflow
into a dedicated scheduled workflow (.forgejo/workflows/benchmark-scheduled.yml).
The benchmark job was blocking PR feedback for 99-132 minutes even when
lint/typecheck/tests passed in under 20 minutes. The new workflow runs:
- Nightly regression tests (2 AM UTC) comparing HEAD against master
- Weekly full benchmark suite (3 AM UTC Sundays) for trend analysis
- Manual dispatch trigger for ad-hoc benchmark validation
AWS S3 integration stores benchmark results for historical trend analysis.
Documentation updated in docs/development/ci-cd.md.
CONTRIBUTORS.md updated with benchmark workflow separation contribution.
ISSUES CLOSED: #9040
# Conflicts:
# CONTRIBUTORS.md
# Conflicts:
# CONTRIBUTORS.md
Root cause: actions/checkout@v4 was not configured with explicit write
credentials (token + persist-credentials), and no git user identity
(user.name/user.email) was set. Both are required for any git push
operation in Forgejo Actions.
Changes:
- release.yml create-release job: add token: secrets.FORGEJO_TOKEN and
fetch-depth: 0 to checkout; add 'Configure git identity for push
operations' step using HTTPS credential store; add 'Smoke-test push
access' step that validates write permission via Forgejo API before
any push attempt
- ci.yml: add push-validation job that validates push credentials on
every CI run using FORGEJO_TOKEN, including credential helper
verification and API-based write permission check; add push-validation
to status-check needs and result reporting
- docs/development/ci-cd.md: add FORGEJO_TOKEN, FORGEJO_URL, and
CONTAINER_REGISTRY* secrets to the secrets table; add 'Repository
Push Authentication' section documenting root cause, fix pattern,
smoke-test step, setup instructions, and security notes; add
push-validation to CI job dependency graph and quality gates table
Design decisions:
- HTTPS token authentication (not SSH deploy keys) -- simpler to manage
- ~/.git-credentials with chmod 600 for ephemeral, secure storage
- Smoke-test validates write permission via API before push attempts
- push-validation job is independent (no needs) -- runs in parallel
- No hardcoded credentials -- all secrets via Forgejo Secrets
ISSUES CLOSED: #1541
Updated CI pipeline to inject ANTHROPIC_API_KEY and OPENAI_API_KEY
secrets as environment variables during Robot Framework integration
test execution. Added CI setup documentation.
ISSUES CLOSED: #701
- Rewrite .forgejo/workflows/ci.yml to route all jobs through nox sessions
- Fix coverage_report nox session: serial behave mode replaces broken parallel
mode (22% -> 97% accuracy), raise fail-under from 85% to 97%
- Pass posargs through format nox session for CI --check support
- Add 11 CI workflow validation scenarios (Behave) + Robot smoke test + ASV bench
- Add 108 new Behave scenarios covering 6 largest coverage gaps to reach 97%:
yaml_template_engine, actor/config, actor/registry, message_router,
context_analysis, context_service
- Update docs/development/ci-cd.md with nox-based CI docs and 97% threshold
- Restore implementation_plan.md verbose style, check off completed CI tasks
Verified: 1673 scenarios pass, 97% coverage, lint clean, typecheck clean
HAL9000
freemo
brent.edwards
