Skip to content

[avenger] Fix stale work-queue integration fixtures #67585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 1 commit into from
Oct 11, 2026
+14 −3
Merged

[avenger] Fix stale work-queue integration fixtures #67585

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion actions/setup/js/work_queue_control_adapter_checks.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -757,7 +757,7 @@ async function verifyCompiledDispatchIdentity(input) {
assert.equal(dispatch.sender.principal, "11");
assert.equal(dispatch.sender.run_attempt, 2);
assert.equal(parameters.ref, REF);
assert.equal(parameters.workflow_id, WORKFLOW);
assert.equal(parameters.workflow_id, path.posix.basename(WORKFLOW));

@github-actions github-actions Bot Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/diagnosing-bugs] Correct root-cause fix — verified work_queue_native.cjs:135 and work_queue_provisioning.cjs:86 already use posix.basename(destination.workflow) for dispatch calls, so this mock assertion was simply stale, not a workaround. Nice catch aligning the fixture with actual adapter behavior.

💡 Optional hardening

Consider adding one more case where WORKFLOW contains a nested path (e.g. shared/worker.lock.yml) to explicitly assert the basename-stripping behavior is intentional rather than incidental (since WORKFLOW is currently a flat .github/workflows/worker.lock.yml, basename happens to equal the filename and wouldn't fail even without posix.basename on the production side in simple cases).

@copilot please address this.

assert.notEqual(parameters.ref, fixture.dispatcherContext.sha);
return { status: 200, data: { workflow_run_id: "42", run_url: "https://api.github.com/repos/owner/repo/actions/runs/42", html_url: "https://github.com/owner/repo/actions/runs/42" } };
},
Expand Down
9 changes: 7 additions & 2 deletions pkg/workflow/work_queue_compilation_integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,8 @@ func TestWorkQueueDispatchCredentialActualCompilation(t *testing.T) {
} else {
require.Equal(t, -1, mint)
}
require.NotContains(t, string(content), "GH_AW_WORK_QUEUE_POLICY:")
require.Contains(t, string(content), "GH_AW_WORK_QUEUE_POLICY:")

@github-actions github-actions Bot Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[/diagnosing-bugs] Good fix — this flips the assertion to match current production behavior where GH_AW_WORK_QUEUE_POLICY is now emitted whenever aw.json configures work_queue (confirmed via work_queue_repo_config.go:100 setting Authorization = "aw"). One nit: add a short comment above this assertion explaining why the expectation flipped (repo-level aw.json now always triggers AW-authorized policy emission), mirroring the explanatory comments you added at lines 198 and the dispatch-identity test. That keeps the next person who touches this fixture from re-flipping it by mistake.

@copilot please address this.

require.Contains(t, string(content), `\"authorization\":\"aw\"`)
})
}
}
Expand Down Expand Up @@ -195,7 +196,9 @@ Compile each work-queue workflow phase.
func TestWorkQueueNamedProfileCompilation(t *testing.T) {
dir := testutil.TempDir(t, "work-queue-named-profile-")
path := filepath.Join(dir, "worker.md")
// Keep coverage of legacy explicit profiles without repository-level scheduling.
require.NoError(t, os.WriteFile(path, []byte(`---
strict: false
on: workflow_dispatch
engine: claude
tools:
Expand All @@ -221,6 +224,7 @@ safe-outputs:
Use the explicitly approved profile without an implicit fallback worker.
`), 0o600))
compiler := NewCompiler(WithVersion("integration"))
compiler.gitRoot = dir
compiler.SetApprove(true)
require.NoError(t, compiler.CompileWorkflow(path))
content, err := os.ReadFile(filepath.Join(dir, "worker.lock.yml"))
Expand Down Expand Up @@ -569,7 +573,8 @@ Read the queue and dispatch an available Work identity.
require.Contains(t, string(compiled), `work_queue_workflows`)
require.Contains(t, string(compiled), `work_queue`)
require.NotContains(t, string(compiled), "WORK_QUEUE_HMAC_SECRET")
require.NotContains(t, string(compiled), "GH_AW_WORK_QUEUE_POLICY:")
require.Contains(t, string(compiled), "GH_AW_WORK_QUEUE_POLICY:")
require.Contains(t, string(compiled), `\"authorization\":\"aw\"`)
inputs, err := extractWorkflowDispatchInputs(filepath.Join(workflowsDir, "dispatcher.lock.yml"))
require.NoError(t, err)
require.NotContains(t, inputs, WorkQueueClaimInputName)
Expand Down
3 changes: 3 additions & 0 deletions pkg/workflow/work_queue_dispatch_identity_integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,9 @@ func TestWorkQueueCompiledPolicyAndLaunchIdentity(t *testing.T) {
dir := filepath.Join(testutil.TempDir(t, "compiled-queue-identity-"), ".github", "workflows")
require.NoError(t, os.MkdirAll(dir, 0o700))
require.NoError(t, os.WriteFile(filepath.Join(dir, "worker.md"), []byte("---\non: workflow_dispatch\ntools:\n work-queue:\n worker: true\n---\nProcess the original immutable assignment.\n"), 0o600))
// Explicit principal policies remain supported only in legacy non-strict mode.
source := fmt.Sprintf(`---
strict: false
on: workflow_dispatch
engine: claude
tools:
Expand Down Expand Up @@ -65,6 +67,7 @@ Dispatch only approved workers using the protected launch credential.
filename := filepath.Join(dir, "dispatcher.md")
require.NoError(t, os.WriteFile(filename, []byte(source), 0o600))
compiler := NewCompiler(WithVersion("integration"))
compiler.gitRoot = filepath.Dir(filepath.Dir(dir))
compiler.SetApprove(true)
require.NoError(t, compiler.CompileWorkflow(filename))
content, err := os.ReadFile(filepath.Join(dir, "dispatcher.lock.yml"))
Expand Down
3 changes: 3 additions & 0 deletions pkg/workflow/work_queue_persistent_memory_integration_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,9 @@ func TestWorkQueueFactoryDocumentationExcerptsCompile(t *testing.T) {
require.NoError(t, err)
directory := filepath.Join(testutil.TempDir(t, "work-queue-factory-docs-"), ".github", "workflows")
require.NoError(t, os.MkdirAll(directory, 0o700))
shared, err := filepath.Abs("../../.github/workflows/shared")
require.NoError(t, err)
require.NoError(t, os.Symlink(shared, filepath.Join(directory, "shared")))
for _, worker := range []string{"eslint-miner", "eslint-refiner", "eslint-monster"} {
for _, extension := range []string{".md", ".lock.yml"} {
target, err := filepath.Abs("../../.github/workflows/" + worker + extension)
Expand Down
Loading