feat(craft): movable craft-edge (tracks main) + ad-hoc craft-dev tag #127
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Validates the compose merge + exercises DockerEventsLookup against a real | |
| # docker socket. A full compose-flavored analogue of `test_approval_gate.py` is | |
| # a follow-up; The gate logic is backend-agnostic and already covered by the K8s | |
| # lane + in-process unit tests. | |
| name: Craft Docker-Compose Sandbox Tests | |
| concurrency: | |
| group: Craft-Compose-Tests-${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| on: | |
| merge_group: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "backend/onyx/sandbox_proxy/**" | |
| - "backend/onyx/server/features/build/configs.py" | |
| - "backend/onyx/server/features/build/sandbox/docker/**" | |
| - "backend/onyx/server/features/build/sandbox/image/Dockerfile" | |
| - "backend/onyx/server/features/build/sandbox/image/firewall-init.sh" | |
| - "backend/onyx/server/features/build/sandbox/labels.py" | |
| - "backend/onyx/server/features/build/sandbox/util/opencode_config.py" | |
| - "backend/tests/unit/sandbox_proxy/**" | |
| - "backend/tests/unit/onyx/server/features/build/sandbox/test_docker_manager_config.py" | |
| - "backend/tests/unit/onyx/server/features/build/sandbox/test_opencode_config.py" | |
| - "backend/tests/external_dependency_unit/sandbox_proxy/**" | |
| - "deployment/docker_compose/docker-compose.yml" | |
| - "deployment/docker_compose/docker-compose.craft.yml" | |
| - "deployment/docker_compose/env.template" | |
| - "deployment/docker_compose/install.sh" | |
| - ".github/workflows/pr-craft-compose-tests.yml" | |
| - ".github/actions/setup-python-and-install-dependencies/**" | |
| permissions: | |
| contents: read | |
| env: | |
| SANDBOX_BACKEND: "docker" | |
| POSTGRES_PASSWORD: "password" | |
| POSTGRES_USER: "postgres" | |
| jobs: | |
| craft-compose-tests: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| PYTHONPATH: ./backend | |
| DISABLE_TELEMETRY: "true" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Python and Install Dependencies | |
| uses: ./.github/actions/setup-python-and-install-dependencies | |
| with: | |
| requirements: | | |
| backend/requirements/default.txt | |
| backend/requirements/dev.txt | |
| backend/requirements/ee.txt | |
| # The compose merge is what install.sh --include-craft renders for | |
| # self-hosters. If this fails, the operator's first `compose up` silently | |
| # breaks. | |
| - name: Validate compose merge | |
| working-directory: deployment/docker_compose | |
| run: | | |
| docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.craft.yml \ | |
| --env-file env.template \ | |
| config >/dev/null | |
| # Unprefixed `name:` is load-bearing: DockerSandboxManager mounts | |
| # these resources directly, not via the compose project prefix. | |
| rendered=$(docker compose \ | |
| -f docker-compose.yml \ | |
| -f docker-compose.craft.yml \ | |
| --env-file env.template config) | |
| echo "$rendered" | grep -q "sandbox-proxy:" | |
| echo "$rendered" | grep -A1 "sandbox_proxy_ca:" | grep -q "name: sandbox_proxy_ca" | |
| echo "$rendered" | grep -A1 "onyx_craft_sandbox:" | grep -q "name: onyx_craft_sandbox" | |
| # Pins the contract install.sh --include-craft's `inspect`-guarded block | |
| # relies on: after `create`, `inspect` exits 0 for both network and | |
| # volume. The earlier shape grepped docker's error string on re-create; | |
| # that wording varies across docker versions and isn't what install.sh | |
| # uses (install.sh checks `inspect` first, then creates if missing). | |
| - name: Pre-create compose-external resources | |
| run: | | |
| docker network create onyx_craft_sandbox | |
| docker volume create sandbox_proxy_ca | |
| docker network inspect onyx_craft_sandbox >/dev/null | |
| docker volume inspect sandbox_proxy_ca >/dev/null | |
| # The DockerEventsLookup external-dep tests spin up real busybox | |
| # containers via the host docker socket -- no Postgres, no compose stack | |
| # needed. | |
| - name: Pull busybox for DockerEventsLookup tests | |
| run: docker pull busybox:1.36 | |
| - name: Run new sandbox_proxy unit tests (no deps) | |
| run: | | |
| py.test \ | |
| -xvs \ | |
| --durations=8 \ | |
| backend/tests/unit/sandbox_proxy/ \ | |
| backend/tests/unit/onyx/server/features/build/sandbox/test_docker_manager_config.py \ | |
| backend/tests/unit/onyx/server/features/build/sandbox/test_opencode_config.py | |
| - name: Run DockerEventsLookup external-dep tests | |
| shell: script -q -e -c "bash --noprofile --norc -eo pipefail {0}" | |
| run: | | |
| py.test \ | |
| -xv \ | |
| --durations=8 \ | |
| --log-cli-level=INFO \ | |
| --log-cli-format='%(asctime)s %(levelname)s %(name)s:%(funcName)s:%(lineno)d %(message)s' \ | |
| backend/tests/external_dependency_unit/sandbox_proxy/test_identity_docker_lookup.py | |
| - name: Docker state on failure | |
| if: failure() | |
| run: | | |
| echo "=== docker ps -a ==="; docker ps -a || true | |
| echo "=== docker images ==="; docker images || true | |
| echo "=== docker volume ls ==="; docker volume ls || true | |
| echo "=== docker network ls ==="; docker network ls || true |