Repository navigation
fix(ci): read the unreleased Agent Server contract from source on release PRs - #5512
Merged
Merged
Conversation
…ease PRs The release PR pins the TypeScript client to the version it is about to publish, so that release's openapi.json and image only exist after merge. When the pin equals the branch's agent-server version and is unpublished, export the contract from source for the contract check and endpoint audit, and skip the release-image smoke test. Fixes #5511
Contributor
REST API breakage checks (OpenAPI) — ✅ PASSEDResult: ✅ PASSED |
VascoSch92
marked this pull request as ready for review
October 5, 2026 12:14
all-hands-bot
approved these changes
Oct 5, 2026
all-hands-bot
left a comment
all-hands-bot
left a comment
Collaborator
There was a problem hiding this comment.
This review was posted by an AI agent (OpenHands).
Reviewed head 6d8dac619e5d59e2da88e730e9e2149cce590485 (matches the requested SHA; no prior review exists on this head). Scope is correct for this repository — the change is confined to .github/ workflows/scripts and clients/typescript/scripts/, and it does not change any package version.
Verified on the current head:
- The new resolver is stdlib-only, and
tests/cross/test_resolve_typescript_client_agent_server.pypasses (5 passed). Onmainit reportspinned_is_source=false,use_source_contract=false, so non-release PRs keep the published-release path and make no network call. - The release-PR path reproduces on a scratch copy: with pin == source ==
1.53.0the resolver reportsuse_source_contract=true;uv sync --frozen --package openhands-agent-serverstill succeeds after theuv versionbump (the release PR rewritesuv.lock, so--frozenis safe); the source export yields an OpenAPI document whoseinfo.versionequals the pinned version. - 404 handling matches the real endpoints (
v1.51.0/v1.52.0→ 200,v1.53.0→ 404), and non-404 HTTP errors propagate and fail the job instead of silently falling back — the safe direction. endpoint-audit.mjsforwardsAGENT_SERVER_OPENAPI_PATHto the loader exactly as the generator already does, so both contract checks read the same explicit schema and the release PR's checked-in generated contract compares cleanly.- Current-head CI is green, including
agent-server-api,endpoint-audit,smoke-test,integration-test,cross-tests, and pre-commit.
No material correctness, security, compatibility, or acceptance-criterion defect. The smoke-test skip is gated on both a missing image and pinned_is_source, so a missing image for any other pin still fails and the skip cannot persist once the image is published.
✅ APPROVED
simonrosenberg
approved these changes
Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
HUMAN:
Follow-up to #5476: that PR moved the TS client's agent-server pin into the release PR, so npm no longer ships the client pinned to the previous version. Side effect: the release PR now pins a version that isn't published yet, so three TS checks (agent-server-api, endpoint-audit, smoke-test) fail trying to pull its image and openapi.json
The fix is to wait until that version is published, the contract checks read the schema built from source (as prepare-release already does) and the release-image smoke test is skipped.
AGENT:
Why
#5476 pins the TypeScript client to the version being released inside the
rel-X.Y.ZPR. Three TypeScript checks then try to read that release before it exists:v1.53.0/openapi.jsonreturns 404 andghcr.io/openhands/agent-server:1.53.0-pythonis not in GHCR. On #5509 (Release v1.53.0),agent-server-api,endpoint-auditandsmoke-testall fail withdocker: Error response from daemon: manifest unknown. The push tomainright after the release merge hits the same window beforeserver.ymlandrelease-binaries.ymlpublish.Summary
.github/scripts/resolve_typescript_client_agent_server.py(stdlib only) outputspinned_is_source(client pin ==openhands-agent-serverversion) anduse_source_contract(that, plus the release'sopenapi.jsonis a 404; other HTTP errors fail the job instead of silently falling back).agent-server-apiandendpoint-audit: whenuse_source_contractis true, export the contract withexport_agent_server_openapi.py(asprepare-release.ymldoes) and pass it viaAGENT_SERVER_OPENAPI_PATH.endpoint-audit.mjsnow forwards that variable to the loader, as the generator already does.smoke-test: skip pull/health/workspace steps only when the pinned image is missing from GHCR and the pin is the branch's own version;integration-testalready exercises the branch-built server. A missing image for any other pin still fails.Requiring the pin to equal the source version keeps every other PR on the released contract: after a release,
mainstays at that version until the next one, and the artifact check then routes back to the publishedopenapi.json.Issue Number
Fixes #5511
How to Test
Ran locally on a scratch worktree of
origin/rel-1.53.0(the #5509 head) with this diff applied:On current
mainthe resolver keeps the old path:Smoke-test image detection:
Also:
pytest tests/cross/test_resolve_typescript_client_agent_server.py(5 passed),pre-commit runon the changed files,prettier --check scripts/endpoint-audit.mjs,npm run test:endpoint-audit-tooling.Video/Screenshots
N/A (CI-only change; logs above).
Type
Notes
The
Release Security Scanand the MiniMaxrun-integration-testsfailures on #5509 are unrelated: achanged-after-approvalfinding on #5479 (the bot's own.pr/cleanup commit) and a Chromium snap install flake.🤖 Generated with Claude Code
🐳 Agent Server images for this PR — GHCR package, pull/run commands, and all pushed tags (click to expand)
• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server
Variants & Base Images
eclipse-temurin:17-jdkpython-node-runtimepython-node-runtimepython-node-runtimegolang:1.21-bookwormPull (multi-arch manifest)
# Each variant is a multi-arch manifest supporting both amd64 and arm64 docker pull ghcr.io/openhands/agent-server:6d8dac6-pythonRun
All tags pushed for this build
About Multi-Architecture Support
6d8dac6-python) is a multi-arch manifest supporting both amd64 and arm646d8dac6-python-amd64) are also available if needed