Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Align AGY conformance tests with work-queue worker
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
  • Loading branch information
Copilot and pelikhan authored Oct 9, 2026
commit 27163d1c39c0d0121c748d81d5e959ec8db904c7
32 changes: 26 additions & 6 deletions pkg/workflow/agy_engine_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,7 @@ type agyConformanceWorkflow struct {
Jobs map[string]agyConformanceJob `yaml:"jobs"`
}

func TestAgyProductionConformanceIsBoundedAndReadOnly(t *testing.T) {
func TestAgyProductionConformanceIsBoundedAndScoped(t *testing.T) {
var caller agyConformanceWorkflow
parent, err := os.ReadFile("../../.github/workflows/credentials-check.yml")
require.NoError(t, err)
Expand Down Expand Up @@ -315,13 +315,24 @@ func TestAgyProductionConformanceIsBoundedAndReadOnly(t *testing.T) {
}
for name, config := range callee.Jobs {
allowedPermissions := binding.Permissions
if entry.id == "engine-conformance-agy" {
switch name {
case "activation":
allowedPermissions = map[string]string{"actions": "read", "contents": "write"}
case "safe_outputs":
allowedPermissions = map[string]string{"actions": "write", "contents": "write"}
}
if name == "activation" || name == "safe_outputs" {
assert.Equal(t, allowedPermissions, config.Permissions, "%s must have only its required queue permissions", name)
continue
}
}
if entry.id == "smoke-agy" && (name == "pre_activation" || name == "activation") {
allowedPermissions = map[string]string{
"actions": "read", "contents": "read", "issues": "read", "pull-requests": "read",
}
}
for permission, level := range config.Permissions {
assert.Equal(t, "read", level, "%s must not grant %s write permission", name, permission)
assert.Equal(t, allowedPermissions[permission], level, "%s must allow only scoped %s permission", name, permission)
}
}
Expand All @@ -332,7 +343,7 @@ func TestAgyProductionConformanceIsBoundedAndReadOnly(t *testing.T) {
assert.Contains(t, string(lock), `GH_AW_SAFE_OUTPUTS_STAGED: "true"`)
assert.Contains(t, string(lock), `"threat_detection":{"mode":"disabled"}`)
assert.NotContains(t, callee.Jobs, "detection")
assertAgyConformanceProbes(t, callee)
assertAgyConformanceProbes(t, callee, entry.id == "engine-conformance-agy")
})
}
}
Expand All @@ -341,7 +352,12 @@ func TestAgyConformanceEntryPointsShareConfiguration(t *testing.T) {
var canonical map[string]any
readConformanceFrontmatter(t, "../../.github/workflows/engine-conformance-agy.md", &canonical)
assert.Equal(t, map[string]any{"workflow_dispatch": nil}, canonical["on"])
assert.Equal(t, []any{"shared/agy-conformance.md"}, canonical["imports"])
assert.Equal(t, []any{"shared/agy-conformance.md", "shared/engine-conformance-worker.md"}, canonical["imports"])
assert.Equal(t, map[string]any{
"work-queue": map[string]any{"worker": true, "require-assignment": true},
}, canonical["tools"])
canonical["imports"] = []any{"shared/agy-conformance.md"}
delete(canonical, "tools")
assert.EqualValues(t, 5, canonical["max-ai-credits"])
delete(canonical, "name")
delete(canonical, "description")
Expand Down Expand Up @@ -403,7 +419,7 @@ func TestAgySmokeLabelCommandIsCentrallyRouted(t *testing.T) {
assert.NotContains(t, string(lock), "remove_trigger_label")
}

func assertAgyConformanceProbes(t *testing.T, compiled agyConformanceWorkflow) {
func assertAgyConformanceProbes(t *testing.T, compiled agyConformanceWorkflow, cliProxyEnabled bool) {
t.Helper()
steps, environment, commands := agyConformanceStepContent(compiled)
execution := steps["Execute experimental Agy CLI"]
Expand Down Expand Up @@ -433,7 +449,11 @@ func assertAgyConformanceProbes(t *testing.T, compiled agyConformanceWorkflow) {
for _, expected := range []string{`"agy-native"`, `"native-challenge"`, "--exclude-env GEMINI_API_KEY"} {
assert.Contains(t, commands, expected, "compiled commands must retain %s", expected)
}
assert.NotContains(t, commands, "export GH_AW_MCP_CLI_SERVERS=")
if cliProxyEnabled {
assert.Contains(t, commands, "export GH_AW_MCP_CLI_SERVERS=")
} else {
assert.NotContains(t, commands, "export GH_AW_MCP_CLI_SERVERS=")
}
}

func agyConformanceStepContent(compiled agyConformanceWorkflow) (map[string]map[string]any, string, string) {
Expand Down
Loading