chore(agents): improve ca-test-infra-improver — remove clone isolation, use API-based analysis

Approved proposal: #2367 Pattern: Permission conflict / initialization crash Evidence: Worker Mode instructs git clone, cd, mkdir, rm -rf but bash permissions only allow read-only commands. Every Worker Mode instance crashes on startup within 10 seconds. Fix: Remove Clone Isolation Protocol from Worker Mode. Replace with Forgejo API-based file reading (forgejo_get_file_content). The agent is analysis-only and never modifies code, so a local clone is unnecessary. ISSUES CLOSED: #2367
2026-04-05 02:29:23 +00:00
1 changed files with 40 additions and 27 deletions
@@ -5,8 +5,8 @@ description: >
  architecture, flaky tests, pipeline optimization, missing test levels, etc.),
  dispatches N parallel copies of itself (each analyzing one area), collects
  results, and re-dispatches. In worker mode (max_workers = 1 or specific
-  focus_area assigned), clones the repo, performs deep analysis of one aspect
-  of the testing infrastructure using CI logs and PR check data, and files
+  focus_area assigned), performs deep analysis of one aspect of the testing
+  infrastructure using the Forgejo API, CI logs, and PR check data, and files
  actionable Forgejo issues proposing improvements. Never disables or weakens
  existing checks — only proposes additions and optimizations.
 mode: subagent
@@ -22,7 +22,7 @@ permission:
    "curl *": allow
    "sleep *": allow
    "jq *": allow
-    # Read-only file commands:
+    # Read-only file commands (for /app fallback reads):
    "cat *": allow
    "ls *": allow
    "find *": allow
@@ -66,8 +66,9 @@ You operate in one of two modes:
  with a 10-second polling loop and immediately refill completed slots.

 - **Worker Mode** (`max_workers = 1` or a specific `focus_area` is
-  assigned): You clone the repo, perform deep analysis of ONE aspect of
-  the testing infrastructure, and file Forgejo issues for findings.
+  assigned): You perform deep analysis of ONE aspect of the testing
+  infrastructure **using the Forgejo API to read files** (NOT a local git
+  clone), and file Forgejo issues for findings.

 ---

@@ -244,21 +245,30 @@ LOOP:

 ## Worker Mode

-### Clone Isolation Protocol
+### File Access Strategy (API-Based — No Local Clone)

-**CRITICAL: You MUST work in your own isolated clone. NEVER operate in /app.**
+**CRITICAL: Worker Mode does NOT use a local git clone.** Your bash
+permissions do not include `git clone`, `cd`, `mkdir`, or `rm -rf`. Instead,
+use the **Forgejo API** to read files remotely:

-```bash
-INSTANCE_ID="test-infra-$$-$(date +%s)"
-CLONE_DIR="/tmp/ca-${INSTANCE_ID}"
+- **Read individual files**: Use `forgejo_get_file_content(owner, repo, ref, filePath)`
+  to read any file from the repository at the `master` branch (or any ref).
+- **List directory contents**: Use the Forgejo API contents endpoint via curl:
+  `curl -s -H "Authorization: token <PAT>" "https://<host>/api/v1/repos/<owner>/<repo>/contents/<path>?ref=master"`
+- **Read CI workflow configs**: `forgejo_get_file_content(owner, repo, "master", ".forgejo/workflows/ci.yml")`
+- **Read noxfile.py**: `forgejo_get_file_content(owner, repo, "master", "noxfile.py")`
+- **Read test files**: `forgejo_get_file_content(owner, repo, "master", "features/<file>")`
+- **Query PR data**: Use `forgejo_list_repo_pull_requests` and related API calls
+- **Query CI run data**: Use the Forgejo Actions API via curl

-git clone https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
-cd "$CLONE_DIR"
-git config user.name "<GIT_USER_NAME>"
-git config user.email "<GIT_USER_EMAIL>"
-```
+As a **fallback**, you may also read files from `/app` using the allowed
+read-only bash commands (`cat`, `ls`, `find`, `grep`, `head`, `tail`, `wc`).
+The `/app` directory contains the repository checkout and can be used for
+analysis when the Forgejo API is slower or unavailable.

-**CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error.
+**You do NOT need a local clone because you are an analysis-only agent.**
+You never modify code — you only read files, analyze patterns, and file
+issues.

 ### Analysis Process

@@ -272,17 +282,20 @@ For the assigned `focus_area`, perform the corresponding analysis:
 - File issues for each concrete optimization opportunity

 #### 2. Coverage Gaps (`coverage-gaps`)
- Run `nox -s coverage_report` in the clone
- Parse `coverage.xml` to find uncovered code paths
+- Read coverage data from CI artifacts or the repository
+- Parse coverage reports to find uncovered code paths
 - Cross-reference with the specification to identify which uncovered paths
  SHOULD have tests (not all uncovered code needs tests — focus on
  behavior-critical paths)
+- **Note**: You cannot run `nox -s coverage_report` locally (no clone).
+  Instead, read the latest coverage data from CI artifacts or from
+  committed coverage reports in the repository.
 - File issues for each significant coverage gap (with specific scenarios)

 #### 3. Test Architecture (`test-architecture`)
- Review all Behave feature files in `features/`
- Review Robot tests in `robot/`
- Review ASV benchmarks in `benchmarks/`
+- Read Behave feature files from `features/` via Forgejo API
+- Read Robot tests from `robot/` via Forgejo API
+- Read ASV benchmarks from `benchmarks/` via Forgejo API
 - Check against CONTRIBUTING.md BDD guidelines:
  - Are steps grouped with related ones?
  - Are feature-specific steps named after their feature?
@@ -298,14 +311,14 @@ For the assigned `focus_area`, perform the corresponding analysis:
 - File issues for each flaky test with proposed fix

 #### 5. CI Pipeline Design (`ci-pipeline-design`)
- Read `noxfile.py` (or equivalent task runner config)
- Read CI workflow configurations (`.forgejo/workflows/`, etc.)
+- Read `noxfile.py` via Forgejo API
+- Read CI workflow configurations (`.forgejo/workflows/`) via Forgejo API
 - Propose: dependency caching, matrix test strategies, parallel nox sessions,
  conditional test execution (only run affected test suites)
 - File issues for each pipeline optimization

 #### 6. Test Data Quality (`test-data-quality`)
- Review test fixtures, factories, and test data setup
+- Read test fixtures, factories, and test data setup via Forgejo API
 - Check for: hardcoded values, unrealistic data, missing edge cases,
  poor fixture isolation, test data leaking between scenarios
 - File issues for test data improvements
@@ -318,6 +331,7 @@ For the assigned `focus_area`, perform the corresponding analysis:
 - File issues for each module missing a test level

 #### 8. Dependency Security (`dependency-security`)
+- Read `pyproject.toml` and lock files via Forgejo API
 - Check test dependency versions for known vulnerabilities
 - Check for outdated test framework versions
 - Propose updates that don't break existing tests
@@ -358,11 +372,10 @@ No exceptions — every comment, every issue body, every PR description.

 ## Important Rules

- **NEVER work in /app.** Always use your isolated clone (Worker Mode) or
-  Forgejo API only (Pool Supervisor Mode).
+- **NEVER work in /app for writes.** Use the Forgejo API to read files
+  remotely. You may read from /app as a fallback using allowed bash commands.
 - **NEVER modify code.** You analyze and file issues. You don't fix things.
 - **NEVER disable or weaken checks.** This is the cardinal rule.
- **Delete your clone on exit.** Always `rm -rf "$CLONE_DIR"`, even on error.
 - **Be specific.** Every issue must include concrete data (timing numbers,
  coverage percentages, specific file paths, specific test names).
 - **Propose production-grade solutions.** Don't suggest hacks or shortcuts.