From 2fa2e467f622bb685e58e6340268d1ee4a69d2cc Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Sun, 12 Jul 2026 16:08:16 -0500 Subject: [PATCH 1/3] =?UTF-8?q?ci:=20add=20canary-rollout-tests.yml=20?= =?UTF-8?q?=E2=80=94=20run=20the=20engine's=20bats=20suite=20(closes=20CI?= =?UTF-8?q?=20gap=20from=20#613/#624=20relocation)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The canary-rollout engine + tests/canary_rollout.bats were relocated into .github by #613/#624 but no CI runner came with them, so the 149+ test suite has been unenforced ever since — every #668 increment (#672/#676/#678/#684) merged without its tests actually running in CI. This workflow runs shellcheck + the full bats suite on any PR touching the engine, its pure core, the suite, or this workflow. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01J4z5uYVjwdyQjh2wFZxkut --- .github/workflows/canary-rollout-tests.yml | 73 ++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 .github/workflows/canary-rollout-tests.yml diff --git a/.github/workflows/canary-rollout-tests.yml b/.github/workflows/canary-rollout-tests.yml new file mode 100644 index 00000000..43f4e1ca --- /dev/null +++ b/.github/workflows/canary-rollout-tests.yml @@ -0,0 +1,73 @@ +# Quality gates for the canary-rollout release engine and its pure gate core. +# +# The engine + its bats suite were relocated into this repo by #613/#624 but no +# CI runner came with them, so tests/canary_rollout.bats went unenforced. This +# workflow closes that gap. +# +# Triggered on any PR (or push to main) that touches: +# - scripts/canary-rollout.sh (orchestrator) +# - scripts/lib/canary-rollout.sh (pure gate core) +# - tests/canary_rollout.bats (the suite) +# - .github/workflows/canary-rollout-tests.yml (this file) +# +# Gates (all must pass before merge): +# 1. shellcheck — static analysis for the orchestrator + pure core +# 2. bats — the full canary_rollout unit/behaviour suite +# +# Standard: the pure core (scripts/lib/canary-rollout.sh) is side-effect-free so +# the suite can pin gate behaviour without network — the house pattern this +# engine itself exemplifies. + +name: Canary-rollout Tests + +on: + pull_request: + paths: + - 'scripts/canary-rollout.sh' + - 'scripts/lib/canary-rollout.sh' + - 'tests/canary_rollout.bats' + - '.github/workflows/canary-rollout-tests.yml' + push: + branches: + - main + paths: + - 'scripts/canary-rollout.sh' + - 'scripts/lib/canary-rollout.sh' + - 'tests/canary_rollout.bats' + - '.github/workflows/canary-rollout-tests.yml' + +permissions: + contents: read + +concurrency: + group: canary-rollout-tests-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + name: Lint and bats + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 1 + + - name: Install bats, shellcheck, and jq + run: | + set -euo pipefail + sudo apt-get update -qq + sudo apt-get install -y --no-install-recommends bats shellcheck jq + + - name: shellcheck + run: | + set -euo pipefail + shellcheck -x scripts/canary-rollout.sh scripts/lib/canary-rollout.sh + + - name: Run bats suite + # The suite stubs gh/git via PATH; a dummy token satisfies the + # orchestrator's token precondition without any real API access. + env: + GH_TOKEN: dummy-token-for-stubbed-tests + run: bats --print-output-on-failure tests/canary_rollout.bats From bb3b1cafdffab066b721b7e638afa30904e92b71 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 12 Jul 2026 21:10:43 +0000 Subject: [PATCH 2/3] chore: dev-lead update (review-changes) [skip ci-relay] --- .github/workflows/canary-rollout-tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/canary-rollout-tests.yml b/.github/workflows/canary-rollout-tests.yml index 43f4e1ca..9136d8f3 100644 --- a/.github/workflows/canary-rollout-tests.yml +++ b/.github/workflows/canary-rollout-tests.yml @@ -63,7 +63,7 @@ jobs: - name: shellcheck run: | set -euo pipefail - shellcheck -x scripts/canary-rollout.sh scripts/lib/canary-rollout.sh + shellcheck --severity=warning -x scripts/canary-rollout.sh scripts/lib/canary-rollout.sh - name: Run bats suite # The suite stubs gh/git via PATH; a dummy token satisfies the From 34383519be8fb02915c07f82c897a4f62fc186e3 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 12 Jul 2026 21:12:03 +0000 Subject: [PATCH 3/3] chore: dev-lead update (review-changes) [skip ci-relay] --- .github/workflows/canary-rollout-tests.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/canary-rollout-tests.yml b/.github/workflows/canary-rollout-tests.yml index 9136d8f3..6f3a0b23 100644 --- a/.github/workflows/canary-rollout-tests.yml +++ b/.github/workflows/canary-rollout-tests.yml @@ -53,6 +53,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 1 + persist-credentials: false - name: Install bats, shellcheck, and jq run: |