From ce722ed0eaa4812c2fea7704e4417ecc3c82cef5 Mon Sep 17 00:00:00 2001 From: Jeffrey Phillips Freeman Date: Thu, 12 Mar 2026 01:35:50 +0000 Subject: [PATCH] ops(ci): configure LLM API keys in Forgejo CI for integration test execution Updated CI pipeline to inject ANTHROPIC_API_KEY and OPENAI_API_KEY secrets as environment variables during Robot Framework integration test execution. Added CI setup documentation. ISSUES CLOSED: #701 --- .forgejo/workflows/ci.yml | 6 ++++++ docs/development/ci-cd.md | 26 ++++++++++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index d5ccd03a..0ebd00c4 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -149,6 +149,12 @@ jobs: nox -s integration_tests env: NOX_DEFAULT_VENV_BACKEND: uv + # LLM API keys required for Robot Framework integration tests. + # These secrets must be configured in Forgejo UI: + # Repository Settings > Actions > Secrets + # See docs/development/ci-cd.md for details. + ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} e2e_tests: runs-on: docker diff --git a/docs/development/ci-cd.md b/docs/development/ci-cd.md index 0176092b..6f6bf748 100644 --- a/docs/development/ci-cd.md +++ b/docs/development/ci-cd.md @@ -244,6 +244,32 @@ sessions use `uv` as the venv backend (`venv_backend="uv"`) and reuse existing virtualenvs (`reuse_venv=True`) for speed. On CI, each job starts fresh but `uv` provides fast installs via its built-in caching. +### CI Secrets + +Some CI jobs require secrets configured in the Forgejo UI. Secrets are managed +under **Repository Settings > Actions > Secrets** and are automatically masked +in job logs. + +| Secret Name | Required By | Purpose | +|-------------|-------------|---------| +| `ANTHROPIC_API_KEY` | `integration_tests` | Anthropic API key for Robot Framework integration tests | +| `OPENAI_API_KEY` | `integration_tests` | OpenAI API key for Robot Framework integration tests | +| `AWS_ACCESS_KEY_ID` | `benchmark-regression`, `benchmark-publish` | AWS credentials for ASV benchmark S3 storage | +| `AWS_SECRET_ACCESS_KEY` | `benchmark-regression`, `benchmark-publish` | AWS credentials for ASV benchmark S3 storage | +| `AWS_DEFAULT_REGION` | `benchmark-regression`, `benchmark-publish` | AWS region for ASV benchmark S3 storage | +| `ASV_S3_BUCKET` | `benchmark-regression`, `benchmark-publish` | S3 bucket name for ASV benchmark storage | + +**Unit tests vs. integration tests:** + +- **Unit tests** (Behave BDD, `nox -s unit_tests`) do **not** require any API + keys. They test internal logic without calling external services. +- **Integration tests** (Robot Framework, `nox -s integration_tests`) **do** + require real LLM API keys (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`). These + tests exercise end-to-end workflows that interact with live LLM providers. + +If the LLM secrets are not configured, integration tests will fail with +authentication errors at runtime. + ### Pre-commit Hooks Pre-commit hooks run automatically on `git commit` and catch most issues before