From 3bd24629b956c12d92bbe4091c5de2aec817b621 Mon Sep 17 00:00:00 2001 From: Jeffrey Phillips Freeman Date: Sat, 4 Apr 2026 19:19:57 +0000 Subject: [PATCH] =?UTF-8?q?chore(agents):=20improve=20ca-test-infra-improv?= =?UTF-8?q?er=20=E2=80=94=20remove=20clone=20isolation,=20use=20API-based?= =?UTF-8?q?=20analysis?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Approved proposal: #2367 Pattern: Permission conflict / initialization crash Evidence: Worker Mode instructs git clone, cd, mkdir, rm -rf but bash permissions only allow read-only commands. Every Worker Mode instance crashes on startup within 10 seconds. Fix: Remove Clone Isolation Protocol from Worker Mode. Replace with Forgejo API-based file reading (forgejo_get_file_content). The agent is analysis-only and never modifies code, so a local clone is unnecessary. ISSUES CLOSED: #2367 --- .opencode/agents/ca-test-infra-improver.md | 67 +++++++++++++--------- 1 file changed, 40 insertions(+), 27 deletions(-) diff --git a/.opencode/agents/ca-test-infra-improver.md b/.opencode/agents/ca-test-infra-improver.md index e4dc21936..1f9f2699c 100644 --- a/.opencode/agents/ca-test-infra-improver.md +++ b/.opencode/agents/ca-test-infra-improver.md @@ -5,8 +5,8 @@ description: > architecture, flaky tests, pipeline optimization, missing test levels, etc.), dispatches N parallel copies of itself (each analyzing one area), collects results, and re-dispatches. In worker mode (max_workers = 1 or specific - focus_area assigned), clones the repo, performs deep analysis of one aspect - of the testing infrastructure using CI logs and PR check data, and files + focus_area assigned), performs deep analysis of one aspect of the testing + infrastructure using the Forgejo API, CI logs, and PR check data, and files actionable Forgejo issues proposing improvements. Never disables or weakens existing checks — only proposes additions and optimizations. mode: subagent @@ -22,7 +22,7 @@ permission: "curl *": allow "sleep *": allow "jq *": allow - # Read-only file commands: + # Read-only file commands (for /app fallback reads): "cat *": allow "ls *": allow "find *": allow @@ -66,8 +66,9 @@ You operate in one of two modes: with a 10-second polling loop and immediately refill completed slots. - **Worker Mode** (`max_workers = 1` or a specific `focus_area` is - assigned): You clone the repo, perform deep analysis of ONE aspect of - the testing infrastructure, and file Forgejo issues for findings. + assigned): You perform deep analysis of ONE aspect of the testing + infrastructure **using the Forgejo API to read files** (NOT a local git + clone), and file Forgejo issues for findings. --- @@ -244,21 +245,30 @@ LOOP: ## Worker Mode -### Clone Isolation Protocol +### File Access Strategy (API-Based — No Local Clone) -**CRITICAL: You MUST work in your own isolated clone. NEVER operate in /app.** +**CRITICAL: Worker Mode does NOT use a local git clone.** Your bash +permissions do not include `git clone`, `cd`, `mkdir`, or `rm -rf`. Instead, +use the **Forgejo API** to read files remotely: -```bash -INSTANCE_ID="test-infra-$$-$(date +%s)" -CLONE_DIR="/tmp/ca-${INSTANCE_ID}" +- **Read individual files**: Use `forgejo_get_file_content(owner, repo, ref, filePath)` + to read any file from the repository at the `master` branch (or any ref). +- **List directory contents**: Use the Forgejo API contents endpoint via curl: + `curl -s -H "Authorization: token " "https:///api/v1/repos///contents/?ref=master"` +- **Read CI workflow configs**: `forgejo_get_file_content(owner, repo, "master", ".forgejo/workflows/ci.yml")` +- **Read noxfile.py**: `forgejo_get_file_content(owner, repo, "master", "noxfile.py")` +- **Read test files**: `forgejo_get_file_content(owner, repo, "master", "features/")` +- **Query PR data**: Use `forgejo_list_repo_pull_requests` and related API calls +- **Query CI run data**: Use the Forgejo Actions API via curl -git clone https://@//.git "$CLONE_DIR" -cd "$CLONE_DIR" -git config user.name "" -git config user.email "" -``` +As a **fallback**, you may also read files from `/app` using the allowed +read-only bash commands (`cat`, `ls`, `find`, `grep`, `head`, `tail`, `wc`). +The `/app` directory contains the repository checkout and can be used for +analysis when the Forgejo API is slower or unavailable. -**CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error. +**You do NOT need a local clone because you are an analysis-only agent.** +You never modify code — you only read files, analyze patterns, and file +issues. ### Analysis Process @@ -272,17 +282,20 @@ For the assigned `focus_area`, perform the corresponding analysis: - File issues for each concrete optimization opportunity #### 2. Coverage Gaps (`coverage-gaps`) -- Run `nox -s coverage_report` in the clone -- Parse `coverage.xml` to find uncovered code paths +- Read coverage data from CI artifacts or the repository +- Parse coverage reports to find uncovered code paths - Cross-reference with the specification to identify which uncovered paths SHOULD have tests (not all uncovered code needs tests — focus on behavior-critical paths) +- **Note**: You cannot run `nox -s coverage_report` locally (no clone). + Instead, read the latest coverage data from CI artifacts or from + committed coverage reports in the repository. - File issues for each significant coverage gap (with specific scenarios) #### 3. Test Architecture (`test-architecture`) -- Review all Behave feature files in `features/` -- Review Robot tests in `robot/` -- Review ASV benchmarks in `benchmarks/` +- Read Behave feature files from `features/` via Forgejo API +- Read Robot tests from `robot/` via Forgejo API +- Read ASV benchmarks from `benchmarks/` via Forgejo API - Check against CONTRIBUTING.md BDD guidelines: - Are steps grouped with related ones? - Are feature-specific steps named after their feature? @@ -298,14 +311,14 @@ For the assigned `focus_area`, perform the corresponding analysis: - File issues for each flaky test with proposed fix #### 5. CI Pipeline Design (`ci-pipeline-design`) -- Read `noxfile.py` (or equivalent task runner config) -- Read CI workflow configurations (`.forgejo/workflows/`, etc.) +- Read `noxfile.py` via Forgejo API +- Read CI workflow configurations (`.forgejo/workflows/`) via Forgejo API - Propose: dependency caching, matrix test strategies, parallel nox sessions, conditional test execution (only run affected test suites) - File issues for each pipeline optimization #### 6. Test Data Quality (`test-data-quality`) -- Review test fixtures, factories, and test data setup +- Read test fixtures, factories, and test data setup via Forgejo API - Check for: hardcoded values, unrealistic data, missing edge cases, poor fixture isolation, test data leaking between scenarios - File issues for test data improvements @@ -318,6 +331,7 @@ For the assigned `focus_area`, perform the corresponding analysis: - File issues for each module missing a test level #### 8. Dependency Security (`dependency-security`) +- Read `pyproject.toml` and lock files via Forgejo API - Check test dependency versions for known vulnerabilities - Check for outdated test framework versions - Propose updates that don't break existing tests @@ -358,11 +372,10 @@ No exceptions — every comment, every issue body, every PR description. ## Important Rules -- **NEVER work in /app.** Always use your isolated clone (Worker Mode) or - Forgejo API only (Pool Supervisor Mode). +- **NEVER work in /app for writes.** Use the Forgejo API to read files + remotely. You may read from /app as a fallback using allowed bash commands. - **NEVER modify code.** You analyze and file issues. You don't fix things. - **NEVER disable or weaken checks.** This is the cardinal rule. -- **Delete your clone on exit.** Always `rm -rf "$CLONE_DIR"`, even on error. - **Be specific.** Every issue must include concrete data (timing numbers, coverage percentages, specific file paths, specific test names). - **Propose production-grade solutions.** Don't suggest hacks or shortcuts. -- 2.52.0