agentenv/.github/workflows/ci.yml at main · css521/agentenv · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: '1.26'
      - name: gofmt
        run: test -z "$(gofmt -l .)" || (gofmt -l . && exit 1)
      - name: vet
        run: go vet ./...
      - name: staticcheck
        run: |
          go install honnef.co/go/tools/cmd/staticcheck@latest
          staticcheck ./...
      - name: unit tests
        run: go test -race ./...

  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        goarch: [amd64, arm64]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: '1.26'
      - name: build (default, pure Go static)
        run: GOOS=linux GOARCH=${{ matrix.goarch }} CGO_ENABLED=0 go build -o /dev/null ./...

  integration-rootless:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: '1.26'
      - name: allow unprivileged user namespaces (Ubuntu 24.04 AppArmor)
        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
      - name: rootless end-to-end (userns + copy backend)
        run: |
          go build -o /tmp/agentenv .
          export PATH=/tmp:$PATH AGENTENV_ROOT=/tmp/agentfs
          mkdir -p /tmp/agentfs
          arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
          agentenv init --tarball "https://cdimage.ubuntu.com/ubuntu-base/releases/24.04/release/ubuntu-base-24.04.4-base-${arch}.tar.gz"
          agentenv exec -- bash -lc 'echo hi > /root/a.txt'
          agentenv commit -m a
          agentenv exec -- bash -lc 'echo bye > /root/b.txt'
          agentenv commit -m b
          A=$(agentenv log | grep '"a"' | grep -oE '[0-9a-f]{12}' | head -1)
          agentenv checkout "$A"
          if agentenv exec -- bash -lc 'test -f /root/b.txt'; then
            echo "FAIL: b.txt should be gone after rollback"; exit 1
          fi
          echo "ROLLBACK OK"

  integration-portability:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v7
        with:
          go-version: '1.26'
      - name: sync + export/import round trips
        run: bash scripts/verify-portability.sh

  integration-boundaryattest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/checkout@v7
        with:
          repository: cullenmeyers/BoundaryAttest
          ref: 89c6c4706b368651c2549d7e43de08c24f3079e5
          path: boundaryattest
      - uses: actions/setup-go@v7
        with:
          go-version: '1.26'
      - uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - name: install BoundaryAttest Python interop dependency
        run: python -m pip install -r boundaryattest/examples/python-interop-v0.1/requirements.txt
      - name: signed export/import handoff
        run: |
          go build -ldflags "-X main.version=boundaryattest-ci" -o /tmp/agentenv .
          bash examples/boundaryattest-export/demo.sh \
            "$GITHUB_WORKSPACE/boundaryattest/examples/python-interop-v0.1" \
            /tmp/agentenv