mirror of
https://github.com/claude-did-this/claude-hub.git
synced 2026-02-14 19:30:02 +01:00
Fix: Merge entrypoint scripts and fix auto-tagging tool permissions (#146)
* fix: merge entrypoint scripts and fix auto-tagging tool permissions - Merged duplicate claudecode-entrypoint.sh and claudecode-tagging-entrypoint.sh scripts - Added dynamic tool selection based on OPERATION_TYPE environment variable - Fixed auto-tagging permissions to include required Bash(gh:*) commands - Removed 95% code duplication between entrypoint scripts - Simplified claudeService.ts to use unified entrypoint - Auto-tagging now uses: Read,GitHub,Bash(gh issue edit:*),Bash(gh issue view:*),Bash(gh label list:*) - General operations continue to use full tool set 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: update Dockerfile to use unified entrypoint script - Remove references to deleted claudecode-tagging-entrypoint.sh - Update build process to use single unified entrypoint script * fix: remove unnecessary async from promisify mock to fix lint error * feat: add Husky pre-commit hooks with Prettier as primary formatter - Added Husky for Git pre-commit hooks - Configured eslint-config-prettier to avoid ESLint/Prettier conflicts - Prettier handles all formatting, ESLint handles code quality only - Pre-commit hooks: Prettier format, ESLint check, TypeScript check - Updated documentation with pre-commit hook setup - All code quality issues resolved * feat: consolidate workflows and fix permission issues with clean Docker runners - Replace 3 complex workflows with 2 lean ones (pull-request.yml, main.yml) - Add Docker runner configuration for clean, isolated builds - Remove file permission hacks - use ephemeral containers instead - Split workload: GitHub-hosted for tests/security, self-hosted for Docker builds - Add comprehensive pre-commit configuration for security - Update documentation to be more pragmatic - Fix credential file permissions and security audit 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: allow Husky prepare script to fail in production builds 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: update CI badge to reference new main.yml workflow 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Cheffromspace
28
.github/CLAUDE.md
vendored
28
.github/CLAUDE.md
vendored
@@ -212,27 +212,17 @@ deploy:
|
||||
6. **No duplicate workflows**: Use reusable workflows for common tasks
|
||||
7. **No missing permissions**: Always specify required permissions
|
||||
|
||||
## Workflow Types
|
||||
## Workflow Types (Simplified)
|
||||
|
||||
### 1. CI Workflow (`ci.yml`)
|
||||
- Runs on every PR and push
|
||||
- Tests, linting, security scans
|
||||
- No deployments or publishing
|
||||
### 1. Pull Request (`pull-request.yml`)
|
||||
- Fast feedback loop
|
||||
- Lint, unit tests, basic security
|
||||
- Docker build only if relevant files changed
|
||||
|
||||
### 2. Deploy Workflow (`deploy.yml`)
|
||||
- Runs on main branch and tags only
|
||||
- Builds and deploys applications
|
||||
- Includes staging and production environments
|
||||
|
||||
### 3. Security Workflow (`security.yml`)
|
||||
- Runs on schedule and PRs
|
||||
- Comprehensive security scanning
|
||||
- Blocks merging on critical issues
|
||||
|
||||
### 4. Release Workflow (`release.yml`)
|
||||
- Runs on version tags only
|
||||
- Creates GitHub releases
|
||||
- Publishes to package registries
|
||||
### 2. Main Pipeline (`main.yml`)
|
||||
- Complete testing and deployment
|
||||
- Coverage reporting, security scans
|
||||
- Docker builds and publishing
|
||||
|
||||
## Checklist for New Workflows
|
||||
|
||||
|
||||
304
.github/workflows/ci.yml
vendored
304
.github/workflows/ci.yml
vendored
@@ -1,304 +0,0 @@
|
||||
name: CI Pipeline
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
|
||||
env:
|
||||
NODE_VERSION: '20'
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository }}
|
||||
|
||||
jobs:
|
||||
# Lint job - fast and independent
|
||||
lint:
|
||||
name: Lint & Format Check
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run linter
|
||||
run: npm run lint:check || echo "No lint script found, skipping"
|
||||
|
||||
- name: Check formatting
|
||||
run: npm run format:check || echo "No format script found, skipping"
|
||||
|
||||
# Unit tests - fastest test suite
|
||||
test-unit:
|
||||
name: Unit Tests
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run unit tests
|
||||
run: npm run test:unit
|
||||
env:
|
||||
NODE_ENV: test
|
||||
BOT_USERNAME: '@TestBot'
|
||||
GITHUB_WEBHOOK_SECRET: 'test-secret'
|
||||
GITHUB_TOKEN: 'test-token'
|
||||
|
||||
# Integration tests - moderate complexity
|
||||
test-integration:
|
||||
name: Integration Tests
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run integration tests
|
||||
run: npm run test:integration || echo "No integration tests found, skipping"
|
||||
env:
|
||||
NODE_ENV: test
|
||||
BOT_USERNAME: '@TestBot'
|
||||
GITHUB_WEBHOOK_SECRET: 'test-secret'
|
||||
GITHUB_TOKEN: 'test-token'
|
||||
|
||||
|
||||
# Coverage generation - depends on unit tests
|
||||
coverage:
|
||||
name: Test Coverage
|
||||
runs-on: ubuntu-latest
|
||||
needs: [test-unit]
|
||||
|
||||
steps:
|
||||
- name: Clean workspace
|
||||
run: |
|
||||
# Fix any existing coverage file permissions before checkout
|
||||
sudo find . -name "coverage" -type d -exec chmod -R 755 {} \; 2>/dev/null || true
|
||||
sudo rm -rf coverage 2>/dev/null || true
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
clean: true
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Generate test coverage
|
||||
run: npm run test:ci
|
||||
env:
|
||||
NODE_ENV: test
|
||||
BOT_USERNAME: '@TestBot'
|
||||
GITHUB_WEBHOOK_SECRET: 'test-secret'
|
||||
GITHUB_TOKEN: 'test-token'
|
||||
|
||||
- name: Fix coverage file permissions
|
||||
run: |
|
||||
# Fix permissions on coverage files that may be created with restricted access
|
||||
find coverage -type f -exec chmod 644 {} \; 2>/dev/null || true
|
||||
find coverage -type d -exec chmod 755 {} \; 2>/dev/null || true
|
||||
|
||||
- name: Upload coverage reports to Codecov
|
||||
uses: codecov/codecov-action@v5
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
slug: intelligence-assist/claude-hub
|
||||
|
||||
# Security scans - run on GitHub for faster execution
|
||||
security:
|
||||
name: Security Scan
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run npm audit
|
||||
run: npm audit --audit-level=moderate
|
||||
|
||||
- name: Run security scan with Snyk
|
||||
uses: snyk/actions/node@master
|
||||
continue-on-error: true
|
||||
env:
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
with:
|
||||
args: --severity-threshold=high
|
||||
|
||||
# Check if Docker-related files changed
|
||||
changes:
|
||||
name: Detect Changes
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
docker: ${{ steps.changes.outputs.docker }}
|
||||
src: ${{ steps.changes.outputs.src }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: dorny/paths-filter@v3
|
||||
id: changes
|
||||
with:
|
||||
filters: |
|
||||
docker:
|
||||
- 'Dockerfile*'
|
||||
- 'scripts/**'
|
||||
- '.dockerignore'
|
||||
- 'claude-config*'
|
||||
src:
|
||||
- 'src/**'
|
||||
- 'package*.json'
|
||||
|
||||
# Docker builds - only when relevant files change
|
||||
docker:
|
||||
name: Docker Build & Test
|
||||
runs-on: ubuntu-latest
|
||||
# Only run on main branch or version tags, not on PRs
|
||||
if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) && github.event_name != 'pull_request' && (needs.changes.outputs.docker == 'true' || needs.changes.outputs.src == 'true')
|
||||
# Only need unit tests to pass for Docker builds
|
||||
needs: [test-unit, lint, changes]
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Start build profiling
|
||||
run: |
|
||||
echo "BUILD_START_TIME=$(date +%s)" >> $GITHUB_ENV
|
||||
echo "🏗️ Docker build started at $(date)"
|
||||
|
||||
- name: Set up Docker layer caching
|
||||
run: |
|
||||
# Create cache mount directories
|
||||
mkdir -p /tmp/.buildx-cache-main /tmp/.buildx-cache-claude
|
||||
|
||||
- name: Build main Docker image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
push: false
|
||||
load: true
|
||||
tags: claude-github-webhook:test
|
||||
cache-from: |
|
||||
type=gha,scope=main
|
||||
type=local,src=/tmp/.buildx-cache-main
|
||||
cache-to: |
|
||||
type=gha,mode=max,scope=main
|
||||
type=local,dest=/tmp/.buildx-cache-main-new,mode=max
|
||||
platforms: linux/amd64
|
||||
build-args: |
|
||||
BUILDKIT_INLINE_CACHE=1
|
||||
|
||||
- name: Build Claude Code Docker image (parallel)
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile.claudecode
|
||||
push: false
|
||||
load: true
|
||||
tags: claude-code-runner:test
|
||||
cache-from: |
|
||||
type=gha,scope=claudecode
|
||||
type=local,src=/tmp/.buildx-cache-claude
|
||||
cache-to: |
|
||||
type=gha,mode=max,scope=claudecode
|
||||
type=local,dest=/tmp/.buildx-cache-claude-new,mode=max
|
||||
platforms: linux/amd64
|
||||
build-args: |
|
||||
BUILDKIT_INLINE_CACHE=1
|
||||
|
||||
- name: Rotate build caches
|
||||
run: |
|
||||
# Rotate caches to avoid size limits
|
||||
rm -rf /tmp/.buildx-cache-main /tmp/.buildx-cache-claude
|
||||
mv /tmp/.buildx-cache-main-new /tmp/.buildx-cache-main 2>/dev/null || true
|
||||
mv /tmp/.buildx-cache-claude-new /tmp/.buildx-cache-claude 2>/dev/null || true
|
||||
|
||||
- name: Profile build performance
|
||||
run: |
|
||||
BUILD_END_TIME=$(date +%s)
|
||||
BUILD_DURATION=$((BUILD_END_TIME - BUILD_START_TIME))
|
||||
echo "🏁 Docker build completed at $(date)"
|
||||
echo "⏱️ Total build time: ${BUILD_DURATION} seconds"
|
||||
|
||||
# Check image sizes
|
||||
echo "📦 Image sizes:"
|
||||
docker images | grep -E "(claude-github-webhook|claude-code-runner):test" || true
|
||||
|
||||
# Show cache usage
|
||||
echo "💾 Cache statistics:"
|
||||
du -sh /tmp/.buildx-cache-* 2>/dev/null || echo "No local caches found"
|
||||
|
||||
# Performance summary
|
||||
if [ $BUILD_DURATION -lt 120 ]; then
|
||||
echo "✅ Fast build (< 2 minutes)"
|
||||
elif [ $BUILD_DURATION -lt 300 ]; then
|
||||
echo "⚠️ Moderate build (2-5 minutes)"
|
||||
else
|
||||
echo "🐌 Slow build (> 5 minutes) - consider optimization"
|
||||
fi
|
||||
|
||||
- name: Test Docker containers
|
||||
run: |
|
||||
# Test main container starts correctly
|
||||
docker run --name test-webhook -d -p 3003:3002 \
|
||||
-e NODE_ENV=test \
|
||||
-e BOT_USERNAME=@TestBot \
|
||||
-e GITHUB_WEBHOOK_SECRET=test-secret \
|
||||
-e GITHUB_TOKEN=test-token \
|
||||
claude-github-webhook:test
|
||||
|
||||
# Wait for container to start
|
||||
sleep 10
|
||||
|
||||
# Test health endpoint
|
||||
curl -f http://localhost:3003/health || exit 1
|
||||
|
||||
# Cleanup
|
||||
docker stop test-webhook
|
||||
docker rm test-webhook
|
||||
65
.github/workflows/main.yml
vendored
Normal file
65
.github/workflows/main.yml
vendored
Normal file
@@ -0,0 +1,65 @@
|
||||
name: Main Pipeline
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
release:
|
||||
types: [published]
|
||||
|
||||
env:
|
||||
NODE_VERSION: '20'
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository }}
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: npm
|
||||
- run: npm ci
|
||||
- run: npm run lint:check
|
||||
- run: npm run test:ci
|
||||
env:
|
||||
NODE_ENV: test
|
||||
- uses: codecov/codecov-action@v5
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
|
||||
security:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- run: ./scripts/security/credential-audit.sh
|
||||
- uses: trufflesecurity/trufflehog@main
|
||||
with:
|
||||
path: ./
|
||||
base: main
|
||||
head: HEAD
|
||||
|
||||
build:
|
||||
runs-on: [self-hosted, docker]
|
||||
needs: [test, security]
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: |
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
|
||||
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
360
.github/workflows/pr.yml
vendored
360
.github/workflows/pr.yml
vendored
@@ -1,360 +0,0 @@
|
||||
name: Pull Request CI
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
|
||||
env:
|
||||
NODE_VERSION: '20'
|
||||
|
||||
jobs:
|
||||
# Lint job - fast and independent
|
||||
lint:
|
||||
name: Lint & Format Check
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run linter
|
||||
run: npm run lint:check || echo "No lint script found, skipping"
|
||||
|
||||
- name: Check formatting
|
||||
run: npm run format:check || echo "No format script found, skipping"
|
||||
|
||||
# Unit tests - fastest test suite
|
||||
test-unit:
|
||||
name: Unit Tests
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
node-version: [20.x]
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ matrix.node-version }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run unit tests
|
||||
run: npm run test:unit
|
||||
env:
|
||||
NODE_ENV: test
|
||||
BOT_USERNAME: '@TestBot'
|
||||
GITHUB_WEBHOOK_SECRET: 'test-secret'
|
||||
GITHUB_TOKEN: 'test-token'
|
||||
|
||||
# Coverage generation for PR feedback
|
||||
coverage:
|
||||
name: Test Coverage
|
||||
runs-on: ubuntu-latest
|
||||
needs: [test-unit]
|
||||
|
||||
steps:
|
||||
- name: Clean workspace
|
||||
run: |
|
||||
# Fix any existing coverage file permissions before checkout
|
||||
sudo find . -name "coverage" -type d -exec chmod -R 755 {} \; 2>/dev/null || true
|
||||
sudo rm -rf coverage 2>/dev/null || true
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
clean: true
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Generate test coverage
|
||||
run: npm run test:ci
|
||||
env:
|
||||
NODE_ENV: test
|
||||
BOT_USERNAME: '@TestBot'
|
||||
GITHUB_WEBHOOK_SECRET: 'test-secret'
|
||||
GITHUB_TOKEN: 'test-token'
|
||||
|
||||
- name: Fix coverage file permissions
|
||||
run: |
|
||||
# Fix permissions on coverage files that may be created with restricted access
|
||||
find coverage -type f -exec chmod 644 {} \; 2>/dev/null || true
|
||||
find coverage -type d -exec chmod 755 {} \; 2>/dev/null || true
|
||||
|
||||
- name: Upload coverage reports to Codecov
|
||||
uses: codecov/codecov-action@v5
|
||||
with:
|
||||
token: ${{ secrets.CODECOV_TOKEN }}
|
||||
slug: intelligence-assist/claude-hub
|
||||
|
||||
# Integration tests - moderate complexity
|
||||
test-integration:
|
||||
name: Integration Tests
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run integration tests
|
||||
run: npm run test:integration || echo "No integration tests found, skipping"
|
||||
env:
|
||||
NODE_ENV: test
|
||||
BOT_USERNAME: '@TestBot'
|
||||
GITHUB_WEBHOOK_SECRET: 'test-secret'
|
||||
GITHUB_TOKEN: 'test-token'
|
||||
|
||||
# Security scans for PRs
|
||||
security:
|
||||
name: Security Scan
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0 # Full history for secret scanning
|
||||
|
||||
- name: Setup Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: 'npm'
|
||||
cache-dependency-path: 'package-lock.json'
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci --prefer-offline --no-audit
|
||||
|
||||
- name: Run npm audit
|
||||
run: |
|
||||
npm audit --audit-level=moderate || {
|
||||
echo "::warning::npm audit found vulnerabilities"
|
||||
exit 0 # Don't fail the build, but warn
|
||||
}
|
||||
|
||||
- name: Check for known vulnerabilities
|
||||
run: npm run security:audit || echo "::warning::Security audit script failed"
|
||||
|
||||
- name: Run credential audit script
|
||||
run: |
|
||||
if [ -f "./scripts/security/credential-audit.sh" ]; then
|
||||
./scripts/security/credential-audit.sh || {
|
||||
echo "::error::Credential audit failed"
|
||||
exit 1
|
||||
}
|
||||
else
|
||||
echo "::warning::Credential audit script not found"
|
||||
fi
|
||||
|
||||
- name: TruffleHog Secret Scan
|
||||
uses: trufflesecurity/trufflehog@main
|
||||
with:
|
||||
path: ./
|
||||
base: ${{ github.event.pull_request.base.sha }}
|
||||
head: ${{ github.event.pull_request.head.sha }}
|
||||
extra_args: --debug --only-verified
|
||||
|
||||
- name: Check for high-risk files
|
||||
run: |
|
||||
# Check for files that commonly contain secrets
|
||||
risk_files=$(find . -type f \( \
|
||||
-name "*.pem" -o \
|
||||
-name "*.key" -o \
|
||||
-name "*.p12" -o \
|
||||
-name "*.pfx" -o \
|
||||
-name "*secret*" -o \
|
||||
-name "*password*" -o \
|
||||
-name "*credential*" \
|
||||
\) -not -path "*/node_modules/*" -not -path "*/.git/*" | head -20)
|
||||
|
||||
if [ -n "$risk_files" ]; then
|
||||
echo "⚠️ Found potentially sensitive files:"
|
||||
echo "$risk_files"
|
||||
echo "::warning::High-risk files detected. Please ensure they don't contain secrets."
|
||||
fi
|
||||
|
||||
# CodeQL analysis for PRs
|
||||
codeql:
|
||||
name: CodeQL Analysis
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
actions: read
|
||||
contents: read
|
||||
security-events: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v3
|
||||
with:
|
||||
languages: javascript
|
||||
config-file: ./.github/codeql-config.yml
|
||||
|
||||
- name: Autobuild
|
||||
uses: github/codeql-action/autobuild@v3
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@v3
|
||||
with:
|
||||
category: "/language:javascript"
|
||||
|
||||
# Check if Docker-related files changed
|
||||
changes:
|
||||
name: Detect Changes
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
docker: ${{ steps.changes.outputs.docker }}
|
||||
src: ${{ steps.changes.outputs.src }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: dorny/paths-filter@v3
|
||||
id: changes
|
||||
with:
|
||||
filters: |
|
||||
docker:
|
||||
- 'Dockerfile*'
|
||||
- 'scripts/**'
|
||||
- '.dockerignore'
|
||||
- 'claude-config*'
|
||||
src:
|
||||
- 'src/**'
|
||||
- 'package*.json'
|
||||
|
||||
# Docker build test for PRs (build only, don't push)
|
||||
docker-build:
|
||||
name: Docker Build Test
|
||||
runs-on: ubuntu-latest
|
||||
if: needs.changes.outputs.docker == 'true' || needs.changes.outputs.src == 'true'
|
||||
needs: [test-unit, lint, changes, security, codeql]
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Build main Docker image (test only)
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
push: false
|
||||
load: true
|
||||
tags: claude-github-webhook:pr-test
|
||||
cache-from: type=gha,scope=pr-main
|
||||
cache-to: type=gha,mode=max,scope=pr-main
|
||||
platforms: linux/amd64
|
||||
|
||||
- name: Build Claude Code Docker image (test only)
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile.claudecode
|
||||
push: false
|
||||
load: true
|
||||
tags: claude-code-runner:pr-test
|
||||
cache-from: type=gha,scope=pr-claudecode
|
||||
cache-to: type=gha,mode=max,scope=pr-claudecode
|
||||
platforms: linux/amd64
|
||||
|
||||
- name: Test Docker containers
|
||||
run: |
|
||||
# Test main container starts correctly
|
||||
docker run --name test-webhook -d -p 3003:3002 \
|
||||
-e NODE_ENV=test \
|
||||
-e BOT_USERNAME=@TestBot \
|
||||
-e GITHUB_WEBHOOK_SECRET=test-secret \
|
||||
-e GITHUB_TOKEN=test-token \
|
||||
claude-github-webhook:pr-test
|
||||
|
||||
# Wait for container to start
|
||||
sleep 10
|
||||
|
||||
# Test health endpoint
|
||||
curl -f http://localhost:3003/health || exit 1
|
||||
|
||||
# Cleanup
|
||||
docker stop test-webhook
|
||||
docker rm test-webhook
|
||||
|
||||
- name: Docker security scan
|
||||
if: needs.changes.outputs.docker == 'true'
|
||||
run: |
|
||||
# Run Hadolint on Dockerfile
|
||||
docker run --rm -i hadolint/hadolint < Dockerfile || echo "::warning::Dockerfile linting issues found"
|
||||
|
||||
# Run Trivy scan on built image
|
||||
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
|
||||
-v $HOME/Library/Caches:/root/.cache/ \
|
||||
aquasec/trivy:latest image --exit-code 0 --severity HIGH,CRITICAL \
|
||||
claude-github-webhook:pr-test || echo "::warning::Security vulnerabilities found"
|
||||
|
||||
# Summary job that all others depend on
|
||||
pr-summary:
|
||||
name: PR Summary
|
||||
runs-on: ubuntu-latest
|
||||
needs: [lint, test-unit, coverage, test-integration, security, codeql, docker-build]
|
||||
if: always()
|
||||
|
||||
steps:
|
||||
- name: Check job statuses
|
||||
run: |
|
||||
echo "## Pull Request CI Summary"
|
||||
echo "- Lint & Format: ${{ needs.lint.result }}"
|
||||
echo "- Unit Tests: ${{ needs.test-unit.result }}"
|
||||
echo "- Test Coverage: ${{ needs.coverage.result }}"
|
||||
echo "- Integration Tests: ${{ needs.test-integration.result }}"
|
||||
echo "- Security Scan: ${{ needs.security.result }}"
|
||||
echo "- CodeQL Analysis: ${{ needs.codeql.result }}"
|
||||
echo "- Docker Build: ${{ needs.docker-build.result }}"
|
||||
|
||||
# Check for any failures
|
||||
if [[ "${{ needs.lint.result }}" == "failure" ]] || \
|
||||
[[ "${{ needs.test-unit.result }}" == "failure" ]] || \
|
||||
[[ "${{ needs.coverage.result }}" == "failure" ]] || \
|
||||
[[ "${{ needs.test-integration.result }}" == "failure" ]] || \
|
||||
[[ "${{ needs.security.result }}" == "failure" ]] || \
|
||||
[[ "${{ needs.codeql.result }}" == "failure" ]] || \
|
||||
[[ "${{ needs.docker-build.result }}" == "failure" ]]; then
|
||||
echo "::error::One or more CI jobs failed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✅ All CI checks passed!"
|
||||
40
.github/workflows/pull-request.yml
vendored
Normal file
40
.github/workflows/pull-request.yml
vendored
Normal file
@@ -0,0 +1,40 @@
|
||||
name: Pull Request
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
env:
|
||||
NODE_VERSION: '20'
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: ${{ env.NODE_VERSION }}
|
||||
cache: npm
|
||||
- run: npm ci
|
||||
- run: npm run lint:check
|
||||
- run: npm run test:unit
|
||||
env:
|
||||
NODE_ENV: test
|
||||
|
||||
security:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- run: ./scripts/security/credential-audit.sh
|
||||
|
||||
docker:
|
||||
runs-on: [self-hosted, docker]
|
||||
if: contains(github.event.pull_request.changed_files, 'Dockerfile') || contains(github.event.pull_request.changed_files, 'src/')
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
push: false
|
||||
tags: test:latest
|
||||
13
.husky/pre-commit
Executable file
13
.husky/pre-commit
Executable file
@@ -0,0 +1,13 @@
|
||||
# Run formatting with auto-fix
|
||||
echo "🎨 Running Prettier..."
|
||||
npm run format
|
||||
|
||||
# Run linting for code quality (not formatting)
|
||||
echo "🔍 Running ESLint..."
|
||||
npm run lint:check
|
||||
|
||||
# Run TypeScript type checking
|
||||
echo "📝 Running TypeScript check..."
|
||||
npm run typecheck
|
||||
|
||||
echo "✅ All pre-commit checks passed!"
|
||||
@@ -1,39 +1,37 @@
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v4.5.0
|
||||
rev: v4.6.0
|
||||
hooks:
|
||||
- id: trailing-whitespace
|
||||
- id: end-of-file-fixer
|
||||
- id: check-yaml
|
||||
- id: check-merge-conflict
|
||||
- id: check-added-large-files
|
||||
- id: check-json
|
||||
- id: check-merge-conflict
|
||||
- id: check-executables-have-shebangs
|
||||
- id: check-shebang-scripts-are-executable
|
||||
- id: check-yaml
|
||||
- id: detect-private-key
|
||||
|
||||
- repo: https://github.com/Yelp/detect-secrets
|
||||
rev: v1.4.0
|
||||
rev: v1.5.0
|
||||
hooks:
|
||||
- id: detect-secrets
|
||||
args: ['--baseline', '.secrets.baseline']
|
||||
exclude: node_modules/
|
||||
- repo: https://github.com/gitleaks/gitleaks
|
||||
rev: v8.18.1
|
||||
exclude: package-lock.json
|
||||
|
||||
- repo: https://github.com/zricethezav/gitleaks
|
||||
rev: v8.21.2
|
||||
hooks:
|
||||
- id: gitleaks
|
||||
- repo: https://github.com/thoughtworks/talisman
|
||||
rev: v1.32.0
|
||||
hooks:
|
||||
- id: talisman-commit
|
||||
entry: cmd --githook pre-commit
|
||||
|
||||
- repo: local
|
||||
hooks:
|
||||
- id: env-file-check
|
||||
name: Check for .env files
|
||||
entry: bash -c 'if find . -name ".env*" -not -path "./node_modules/*" -not -name ".env.example" | grep -q .; then echo "Found .env files that may contain secrets"; exit 1; fi'
|
||||
- id: eslint
|
||||
name: eslint
|
||||
entry: npm run lint:check
|
||||
language: system
|
||||
pass_filenames: false
|
||||
- id: credential-scan
|
||||
name: Scan for hardcoded credentials
|
||||
entry: bash -c 'if grep -r "sk-\|ghp_\|AKIA\|xox[boas]\|AIza[0-9A-Za-z\\-_]\{35\}" --exclude-dir=node_modules --exclude-dir=.git .; then echo "Found potential hardcoded credentials"; exit 1; fi'
|
||||
files: \.(js|ts)$
|
||||
|
||||
- id: prettier
|
||||
name: prettier
|
||||
entry: npm run format:check
|
||||
language: system
|
||||
pass_filenames: false
|
||||
files: \.(js|ts|json|md)$
|
||||
@@ -71,6 +71,14 @@ This repository contains a webhook service that integrates Claude with GitHub, a
|
||||
- Fix security vulnerabilities: `npm run security:fix`
|
||||
- All CI tests: `npm run test:ci` (includes coverage)
|
||||
|
||||
### Pre-commit Hooks
|
||||
The project uses Husky for Git pre-commit hooks to ensure code quality:
|
||||
- **ESLint**: Checks code for linting errors
|
||||
- **Prettier**: Validates code formatting
|
||||
- **TypeScript**: Runs type checking
|
||||
- **Setup**: Hooks are automatically installed via `npm run prepare`
|
||||
- **Manual run**: Execute `.husky/pre-commit` to test locally
|
||||
|
||||
### End-to-End Testing
|
||||
Use the demo repository for testing auto-tagging and webhook functionality:
|
||||
- Demo repository: `https://github.com/intelligence-assist/demo-repository`
|
||||
|
||||
@@ -72,14 +72,12 @@ RUN chmod +x /usr/local/bin/init-firewall.sh && \
|
||||
echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
|
||||
chmod 0440 /etc/sudoers.d/node-firewall
|
||||
|
||||
# Create scripts directory and copy entrypoint scripts
|
||||
# Create scripts directory and copy unified entrypoint script
|
||||
RUN mkdir -p /scripts/runtime
|
||||
COPY scripts/runtime/claudecode-entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
COPY scripts/runtime/claudecode-entrypoint.sh /scripts/runtime/claudecode-entrypoint.sh
|
||||
COPY scripts/runtime/claudecode-tagging-entrypoint.sh /scripts/runtime/claudecode-tagging-entrypoint.sh
|
||||
RUN chmod +x /usr/local/bin/entrypoint.sh && \
|
||||
chmod +x /scripts/runtime/claudecode-entrypoint.sh && \
|
||||
chmod +x /scripts/runtime/claudecode-tagging-entrypoint.sh
|
||||
chmod +x /scripts/runtime/claudecode-entrypoint.sh
|
||||
|
||||
# Set the default shell to bash
|
||||
ENV SHELL /bin/zsh
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# Claude GitHub Webhook
|
||||
|
||||
[](https://github.com/intelligence-assist/claude-hub/actions/workflows/ci.yml)
|
||||
[](https://github.com/intelligence-assist/claude-hub/actions/workflows/main.yml)
|
||||
[](https://github.com/intelligence-assist/claude-hub/actions/workflows/security.yml)
|
||||
[](test/README.md)
|
||||
[](https://codecov.io/gh/intelligence-assist/claude-hub)
|
||||
|
||||
@@ -1,9 +1,11 @@
|
||||
const js = require('@eslint/js');
|
||||
const tseslint = require('@typescript-eslint/eslint-plugin');
|
||||
const tsparser = require('@typescript-eslint/parser');
|
||||
const prettierConfig = require('eslint-config-prettier');
|
||||
|
||||
module.exports = [
|
||||
js.configs.recommended,
|
||||
prettierConfig, // Disable all formatting rules that conflict with Prettier
|
||||
{
|
||||
languageOptions: {
|
||||
ecmaVersion: 'latest',
|
||||
@@ -34,11 +36,7 @@ module.exports = [
|
||||
'no-console': 'warn',
|
||||
'no-debugger': 'error',
|
||||
|
||||
// Code style
|
||||
'indent': ['error', 2],
|
||||
'quotes': ['error', 'single'],
|
||||
'semi': ['error', 'always'],
|
||||
'comma-dangle': ['error', 'never'],
|
||||
// Removed all formatting rules - let Prettier handle them
|
||||
|
||||
// Best practices
|
||||
'eqeqeq': 'error',
|
||||
|
||||
@@ -18,6 +18,11 @@ module.exports = {
|
||||
collectCoverage: true,
|
||||
coverageReporters: ['text', 'lcov'],
|
||||
coverageDirectory: 'coverage',
|
||||
coveragePathIgnorePatterns: [
|
||||
'/node_modules/',
|
||||
'/dist/',
|
||||
'/coverage/'
|
||||
],
|
||||
collectCoverageFrom: [
|
||||
'src/**/*.{js,ts}',
|
||||
'!src/**/*.d.ts',
|
||||
|
||||
21
package-lock.json
generated
21
package-lock.json
generated
@@ -1,12 +1,12 @@
|
||||
{
|
||||
"name": "claude-github-webhook",
|
||||
"version": "0.1.0",
|
||||
"version": "0.1.1",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "claude-github-webhook",
|
||||
"version": "0.1.0",
|
||||
"version": "0.1.1",
|
||||
"dependencies": {
|
||||
"@octokit/rest": "^22.0.0",
|
||||
"axios": "^1.6.2",
|
||||
@@ -33,6 +33,7 @@
|
||||
"babel-jest": "^29.7.0",
|
||||
"eslint": "^9.27.0",
|
||||
"eslint-config-node": "^4.1.0",
|
||||
"eslint-config-prettier": "^10.1.5",
|
||||
"husky": "^9.1.7",
|
||||
"jest": "^29.7.0",
|
||||
"jest-junit": "^16.0.0",
|
||||
@@ -5995,6 +5996,22 @@
|
||||
"which": "bin/which"
|
||||
}
|
||||
},
|
||||
"node_modules/eslint-config-prettier": {
|
||||
"version": "10.1.5",
|
||||
"resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.5.tgz",
|
||||
"integrity": "sha512-zc1UmCpNltmVY34vuLRV61r1K27sWuX39E+uyUnY8xS2Bex88VV9cugG+UZbRSRGtGyFboj+D8JODyme1plMpw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"bin": {
|
||||
"eslint-config-prettier": "bin/cli.js"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://opencollective.com/eslint-config-prettier"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"eslint": ">=7.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/eslint-import-resolver-node": {
|
||||
"version": "0.3.9",
|
||||
"resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.9.tgz",
|
||||
|
||||
@@ -29,7 +29,9 @@
|
||||
"format:check": "prettier --check src/ test/",
|
||||
"security:audit": "npm audit --audit-level=moderate",
|
||||
"security:fix": "npm audit fix",
|
||||
"setup:dev": "husky install"
|
||||
"setup:dev": "husky install",
|
||||
"setup:hooks": "husky",
|
||||
"prepare": "husky || true"
|
||||
},
|
||||
"dependencies": {
|
||||
"@octokit/rest": "^22.0.0",
|
||||
@@ -57,6 +59,7 @@
|
||||
"babel-jest": "^29.7.0",
|
||||
"eslint": "^9.27.0",
|
||||
"eslint-config-node": "^4.1.0",
|
||||
"eslint-config-prettier": "^10.1.5",
|
||||
"husky": "^9.1.7",
|
||||
"jest": "^29.7.0",
|
||||
"jest-junit": "^16.0.0",
|
||||
|
||||
@@ -1,6 +1,10 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Unified entrypoint for Claude Code operations
|
||||
# Handles both auto-tagging (minimal tools) and general operations (full tools)
|
||||
# Operation type is controlled by OPERATION_TYPE environment variable
|
||||
|
||||
# Initialize firewall - must be done as root
|
||||
# Temporarily disabled to test Claude Code
|
||||
# /usr/local/bin/init-firewall.sh
|
||||
@@ -68,8 +72,12 @@ else
|
||||
cd /workspace
|
||||
fi
|
||||
|
||||
# Checkout the correct branch
|
||||
if [ "${IS_PULL_REQUEST}" = "true" ] && [ -n "${BRANCH_NAME}" ]; then
|
||||
# Checkout the correct branch based on operation type
|
||||
if [ "${OPERATION_TYPE}" = "auto-tagging" ]; then
|
||||
# Auto-tagging always uses main branch (doesn't need specific branches)
|
||||
echo "Using main branch for auto-tagging" >&2
|
||||
sudo -u node git checkout main >&2 || sudo -u node git checkout master >&2
|
||||
elif [ "${IS_PULL_REQUEST}" = "true" ] && [ -n "${BRANCH_NAME}" ]; then
|
||||
echo "Checking out PR branch: ${BRANCH_NAME}" >&2
|
||||
sudo -u node git checkout "${BRANCH_NAME}" >&2
|
||||
else
|
||||
@@ -107,8 +115,14 @@ RESPONSE_FILE="/workspace/response.txt"
|
||||
touch "${RESPONSE_FILE}"
|
||||
chown node:node "${RESPONSE_FILE}"
|
||||
|
||||
# Run Claude Code with full GitHub CLI access as node user
|
||||
echo "Running Claude Code..." >&2
|
||||
# Determine allowed tools based on operation type
|
||||
if [ "${OPERATION_TYPE}" = "auto-tagging" ]; then
|
||||
ALLOWED_TOOLS="Read,GitHub,Bash(gh issue edit:*),Bash(gh issue view:*),Bash(gh label list:*)" # Minimal tools for auto-tagging (security)
|
||||
echo "Running Claude Code for auto-tagging with minimal tools..." >&2
|
||||
else
|
||||
ALLOWED_TOOLS="Bash,Create,Edit,Read,Write,GitHub" # Full tools for general operations
|
||||
echo "Running Claude Code with full tool access..." >&2
|
||||
fi
|
||||
|
||||
# Check if command exists
|
||||
if [ -z "${COMMAND}" ]; then
|
||||
@@ -135,7 +149,7 @@ sudo -u node -E env \
|
||||
ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}" \
|
||||
GH_TOKEN="${GITHUB_TOKEN}" \
|
||||
/usr/local/share/npm-global/bin/claude \
|
||||
--allowedTools Bash,Create,Edit,Read,Write,GitHub \
|
||||
--allowedTools "${ALLOWED_TOOLS}" \
|
||||
--print "${COMMAND}" \
|
||||
> "${RESPONSE_FILE}" 2>&1
|
||||
|
||||
|
||||
@@ -1,135 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Minimal entrypoint for auto-tagging workflow
|
||||
# Only allows Read and GitHub tools for security
|
||||
|
||||
# Environment variables (passed from service)
|
||||
# Simply reference the variables directly - no need to reassign
|
||||
# They are already available in the environment
|
||||
|
||||
# Ensure workspace directory exists and has proper permissions
|
||||
mkdir -p /workspace
|
||||
chown -R node:node /workspace
|
||||
|
||||
# Set up Claude authentication by syncing from captured auth directory
|
||||
if [ -d "/home/node/.claude" ]; then
|
||||
echo "Setting up Claude authentication from mounted auth directory..." >&2
|
||||
|
||||
# Create a writable copy of Claude configuration in workspace
|
||||
CLAUDE_WORK_DIR="/workspace/.claude"
|
||||
mkdir -p "$CLAUDE_WORK_DIR"
|
||||
|
||||
echo "DEBUG: Source auth directory contents:" >&2
|
||||
ls -la /home/node/.claude/ >&2 || echo "DEBUG: Source auth directory not accessible" >&2
|
||||
|
||||
# Sync entire auth directory to writable location (including database files, project state, etc.)
|
||||
if command -v rsync >/dev/null 2>&1; then
|
||||
rsync -av /home/node/.claude/ "$CLAUDE_WORK_DIR/" 2>/dev/null || echo "rsync failed, trying cp" >&2
|
||||
else
|
||||
# Fallback to cp with comprehensive copying
|
||||
cp -r /home/node/.claude/* "$CLAUDE_WORK_DIR/" 2>/dev/null || true
|
||||
cp -r /home/node/.claude/.* "$CLAUDE_WORK_DIR/" 2>/dev/null || true
|
||||
fi
|
||||
|
||||
echo "DEBUG: Working directory contents after sync:" >&2
|
||||
ls -la "$CLAUDE_WORK_DIR/" >&2 || echo "DEBUG: Working directory not accessible" >&2
|
||||
|
||||
# Set proper ownership and permissions for the node user
|
||||
chown -R node:node "$CLAUDE_WORK_DIR"
|
||||
chmod 600 "$CLAUDE_WORK_DIR"/.credentials.json 2>/dev/null || true
|
||||
chmod 755 "$CLAUDE_WORK_DIR" 2>/dev/null || true
|
||||
|
||||
echo "DEBUG: Final permissions check:" >&2
|
||||
ls -la "$CLAUDE_WORK_DIR/.credentials.json" >&2 || echo "DEBUG: .credentials.json not found" >&2
|
||||
|
||||
echo "Claude authentication directory synced to $CLAUDE_WORK_DIR" >&2
|
||||
else
|
||||
echo "WARNING: No Claude authentication source found at /home/node/.claude." >&2
|
||||
fi
|
||||
|
||||
# Configure GitHub authentication
|
||||
if [ -n "${GITHUB_TOKEN}" ]; then
|
||||
export GH_TOKEN="${GITHUB_TOKEN}"
|
||||
echo "${GITHUB_TOKEN}" | sudo -u node gh auth login --with-token
|
||||
sudo -u node gh auth setup-git
|
||||
else
|
||||
echo "No GitHub token provided, skipping GitHub authentication"
|
||||
fi
|
||||
|
||||
# Clone the repository as node user (needed for context)
|
||||
if [ -n "${GITHUB_TOKEN}" ] && [ -n "${REPO_FULL_NAME}" ]; then
|
||||
echo "Cloning repository ${REPO_FULL_NAME}..." >&2
|
||||
sudo -u node git clone "https://x-access-token:${GITHUB_TOKEN}@github.com/${REPO_FULL_NAME}.git" /workspace/repo >&2
|
||||
cd /workspace/repo
|
||||
else
|
||||
echo "Skipping repository clone - missing GitHub token or repository name" >&2
|
||||
cd /workspace
|
||||
fi
|
||||
|
||||
# Checkout main branch (tagging doesn't need specific branches)
|
||||
echo "Using main branch" >&2
|
||||
sudo -u node git checkout main >&2 || sudo -u node git checkout master >&2
|
||||
|
||||
# Configure git for minimal operations
|
||||
sudo -u node git config --global user.email "${BOT_EMAIL:-claude@example.com}"
|
||||
sudo -u node git config --global user.name "${BOT_USERNAME:-ClaudeBot}"
|
||||
|
||||
# Configure Claude authentication
|
||||
# Support both API key and interactive auth methods
|
||||
if [ -n "${ANTHROPIC_API_KEY}" ]; then
|
||||
echo "Using Anthropic API key for authentication..." >&2
|
||||
export ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}"
|
||||
elif [ -f "/workspace/.claude/.credentials.json" ]; then
|
||||
echo "Using Claude interactive authentication from working directory..." >&2
|
||||
# No need to set ANTHROPIC_API_KEY - Claude CLI will use the credentials file
|
||||
# Set HOME to point to our working directory for Claude CLI
|
||||
export CLAUDE_HOME="/workspace/.claude"
|
||||
else
|
||||
echo "WARNING: No Claude authentication found. Please set ANTHROPIC_API_KEY or ensure ~/.claude is mounted." >&2
|
||||
fi
|
||||
|
||||
# Create response file with proper permissions
|
||||
RESPONSE_FILE="/workspace/response.txt"
|
||||
touch "${RESPONSE_FILE}"
|
||||
chown node:node "${RESPONSE_FILE}"
|
||||
|
||||
# Run Claude Code with minimal tools for auto-tagging
|
||||
echo "Running Claude Code for auto-tagging..." >&2
|
||||
|
||||
# Check if command exists
|
||||
if [ -z "${COMMAND}" ]; then
|
||||
echo "ERROR: No command provided. COMMAND environment variable is empty." | tee -a "${RESPONSE_FILE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Log the command length for debugging
|
||||
echo "Command length: ${#COMMAND}" >&2
|
||||
|
||||
# Run Claude Code with minimal tool set: Read (for repository context) and GitHub (for label operations)
|
||||
# If we synced Claude auth to workspace, use workspace as HOME
|
||||
if [ -f "/workspace/.claude/.credentials.json" ]; then
|
||||
CLAUDE_USER_HOME="/workspace"
|
||||
echo "DEBUG: Using /workspace as HOME for Claude CLI (synced auth)" >&2
|
||||
else
|
||||
CLAUDE_USER_HOME="${CLAUDE_HOME:-/home/node}"
|
||||
echo "DEBUG: Using $CLAUDE_USER_HOME as HOME for Claude CLI (fallback)" >&2
|
||||
fi
|
||||
|
||||
sudo -u node -E env \
|
||||
HOME="$CLAUDE_USER_HOME" \
|
||||
PATH="/usr/local/bin:/usr/local/share/npm-global/bin:$PATH" \
|
||||
ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}" \
|
||||
GH_TOKEN="${GITHUB_TOKEN}" \
|
||||
/usr/local/share/npm-global/bin/claude \
|
||||
--allowedTools Read,GitHub \
|
||||
--print "${COMMAND}" \
|
||||
> "${RESPONSE_FILE}" 2>&1
|
||||
|
||||
# Check for errors
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "ERROR: Claude Code execution failed. See logs for details." | tee -a "${RESPONSE_FILE}" >&2
|
||||
fi
|
||||
|
||||
# Output the response
|
||||
cat "${RESPONSE_FILE}"
|
||||
44
scripts/setup/configure-runner-clean.sh
Normal file
44
scripts/setup/configure-runner-clean.sh
Normal file
@@ -0,0 +1,44 @@
|
||||
#!/bin/bash
|
||||
# Clean runner configuration - no hacks, just proper setup
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "🔧 Configuring GitHub Actions runner for clean builds..."
|
||||
|
||||
# 1. Set proper umask in runner service
|
||||
sudo tee /etc/systemd/system/actions.runner.*.service.d/override.conf << 'EOF'
|
||||
[Service]
|
||||
UMask=0022
|
||||
Environment=UMASK=022
|
||||
EOF
|
||||
|
||||
# 2. Configure runner user shell
|
||||
sudo tee -a ~gh-runner/.bashrc << 'EOF'
|
||||
# Set proper umask for all processes
|
||||
umask 022
|
||||
|
||||
# Clean workspace function
|
||||
clean_workspace() {
|
||||
if [ -n "${GITHUB_WORKSPACE:-}" ]; then
|
||||
sudo rm -rf "${GITHUB_WORKSPACE}" 2>/dev/null || true
|
||||
mkdir -p "${GITHUB_WORKSPACE}"
|
||||
fi
|
||||
}
|
||||
EOF
|
||||
|
||||
# 3. Add pre-action script to runner
|
||||
sudo tee /opt/actions-runner/pre-action.sh << 'EOF'
|
||||
#!/bin/bash
|
||||
# Clean workspace before each action
|
||||
umask 022
|
||||
sudo rm -rf "${GITHUB_WORKSPACE}" 2>/dev/null || true
|
||||
mkdir -p "${GITHUB_WORKSPACE}"
|
||||
EOF
|
||||
|
||||
sudo chmod +x /opt/actions-runner/pre-action.sh
|
||||
|
||||
# 4. Restart runner services
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl restart actions.runner.*.service
|
||||
|
||||
echo "✅ Runner configured for clean builds"
|
||||
50
scripts/setup/docker-runner-setup.sh
Normal file
50
scripts/setup/docker-runner-setup.sh
Normal file
@@ -0,0 +1,50 @@
|
||||
#!/bin/bash
|
||||
# Setup clean Docker-based GitHub Actions runners
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "🐳 Setting up Docker-based GitHub Actions runners..."
|
||||
|
||||
# Create docker-compose for runners
|
||||
cat > docker-compose.runners.yml << 'EOF'
|
||||
version: '3.8'
|
||||
|
||||
services:
|
||||
github-runner-1:
|
||||
image: myoung34/github-runner:latest
|
||||
environment:
|
||||
REPO_URL: https://github.com/intelligence-assist/claude-hub
|
||||
RUNNER_TOKEN: ${RUNNER_TOKEN}
|
||||
RUNNER_NAME: docker-runner-1
|
||||
RUNNER_WORKDIR: /tmp/runner/work
|
||||
RUNNER_GROUP: default
|
||||
LABELS: linux,x64,docker
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- runner1-work:/tmp/runner/work
|
||||
restart: unless-stopped
|
||||
|
||||
github-runner-2:
|
||||
image: myoung34/github-runner:latest
|
||||
environment:
|
||||
REPO_URL: https://github.com/intelligence-assist/claude-hub
|
||||
RUNNER_TOKEN: ${RUNNER_TOKEN}
|
||||
RUNNER_NAME: docker-runner-2
|
||||
RUNNER_WORKDIR: /tmp/runner/work
|
||||
RUNNER_GROUP: default
|
||||
LABELS: linux,x64,docker
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
- runner2-work:/tmp/runner/work
|
||||
restart: unless-stopped
|
||||
|
||||
volumes:
|
||||
runner1-work:
|
||||
runner2-work:
|
||||
EOF
|
||||
|
||||
echo "✅ Docker runner configuration created"
|
||||
echo "📝 To deploy:"
|
||||
echo " 1. Get runner token from GitHub repo settings"
|
||||
echo " 2. export RUNNER_TOKEN=your_token"
|
||||
echo " 3. docker-compose -f docker-compose.runners.yml up -d"
|
||||
119
scripts/setup/fix-runner-permissions.sh
Executable file
119
scripts/setup/fix-runner-permissions.sh
Executable file
@@ -0,0 +1,119 @@
|
||||
#!/bin/bash
|
||||
# fix-runner-permissions.sh
|
||||
# Permanent fix for GitHub Actions runner permission issues
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo "🔧 Fixing GitHub Actions runner permission issues..."
|
||||
|
||||
# 1. Fix existing coverage directories
|
||||
echo "📁 Cleaning existing coverage directories..."
|
||||
find /home/gh-runner* -name "coverage" -type d 2>/dev/null | while read -r dir; do
|
||||
echo " Fixing permissions for: $dir"
|
||||
sudo chmod -R 755 "$dir" 2>/dev/null || true
|
||||
sudo rm -rf "$dir" 2>/dev/null || true
|
||||
done
|
||||
|
||||
# 2. Set default umask for GitHub Actions runner
|
||||
echo "🔒 Setting default umask for runner processes..."
|
||||
RUNNER_PROFILE="/home/gh-runner*/.bashrc"
|
||||
if ! grep -q "umask 022" $RUNNER_PROFILE 2>/dev/null; then
|
||||
echo "umask 022" | sudo tee -a $RUNNER_PROFILE
|
||||
fi
|
||||
|
||||
# 3. Create systemd drop-in for runner service
|
||||
echo "⚙️ Creating systemd configuration..."
|
||||
sudo mkdir -p /etc/systemd/system/actions.runner.*.service.d/
|
||||
cat << 'EOF' | sudo tee /etc/systemd/system/actions.runner.*.service.d/permissions.conf
|
||||
[Service]
|
||||
# Set umask for all processes
|
||||
UMask=0022
|
||||
|
||||
# Ensure proper file permissions
|
||||
ExecStartPre=/bin/bash -c 'find /home/gh-runner*/actions-runner/_work -name "coverage" -type d -exec chmod -R 755 {} \; 2>/dev/null || true'
|
||||
ExecStartPre=/bin/bash -c 'find /home/gh-runner*/actions-runner/_work -name "node_modules" -type d -exec chmod -R 755 {} \; 2>/dev/null || true'
|
||||
EOF
|
||||
|
||||
# 4. Reload systemd and restart runner services
|
||||
echo "🔄 Reloading systemd configuration..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
# 5. Create cleanup script for cron
|
||||
echo "🕐 Setting up periodic cleanup..."
|
||||
cat << 'EOF' | sudo tee /usr/local/bin/github-runner-cleanup.sh
|
||||
#!/bin/bash
|
||||
# Periodic cleanup of runner workspaces
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Clean up old coverage directories
|
||||
find /home/gh-runner*/actions-runner/_work -name "coverage" -type d -mtime +1 -exec rm -rf {} \; 2>/dev/null || true
|
||||
|
||||
# Fix permissions on current workspaces
|
||||
find /home/gh-runner*/actions-runner/_work -type d -exec chmod 755 {} \; 2>/dev/null || true
|
||||
find /home/gh-runner*/actions-runner/_work -type f -exec chmod 644 {} \; 2>/dev/null || true
|
||||
|
||||
# Clean up node_modules with restricted permissions
|
||||
find /home/gh-runner*/actions-runner/_work -name "node_modules" -type d -exec chmod -R 755 {} \; 2>/dev/null || true
|
||||
|
||||
echo "$(date): GitHub runner cleanup completed"
|
||||
EOF
|
||||
|
||||
sudo chmod +x /usr/local/bin/github-runner-cleanup.sh
|
||||
|
||||
# 6. Add to cron (run every 30 minutes)
|
||||
if ! sudo crontab -l 2>/dev/null | grep -q "github-runner-cleanup"; then
|
||||
(sudo crontab -l 2>/dev/null; echo "*/30 * * * * /usr/local/bin/github-runner-cleanup.sh >> /var/log/github-runner-cleanup.log 2>&1") | sudo crontab -
|
||||
fi
|
||||
|
||||
# 7. Set proper directory permissions for runner users
|
||||
echo "👤 Setting runner user permissions..."
|
||||
for runner_home in /home/gh-runner*; do
|
||||
if [ -d "$runner_home" ]; then
|
||||
sudo chown -R "$(basename "$runner_home")":"$(basename "$runner_home")" "$runner_home"
|
||||
sudo chmod 755 "$runner_home"
|
||||
fi
|
||||
done
|
||||
|
||||
# 8. Create a pre-checkout script
|
||||
echo "📋 Creating pre-checkout script..."
|
||||
cat << 'EOF' | sudo tee /usr/local/bin/pre-checkout-cleanup.sh
|
||||
#!/bin/bash
|
||||
# Pre-checkout cleanup script
|
||||
# Usage: /usr/local/bin/pre-checkout-cleanup.sh [workspace_path]
|
||||
|
||||
WORKSPACE_PATH="${1:-$GITHUB_WORKSPACE}"
|
||||
WORKSPACE_PATH="${WORKSPACE_PATH:-$(pwd)}"
|
||||
|
||||
echo "🧹 Cleaning workspace: $WORKSPACE_PATH"
|
||||
|
||||
# Remove coverage directories with any permissions
|
||||
find "$WORKSPACE_PATH" -name "coverage" -type d -exec chmod -R 755 {} \; 2>/dev/null || true
|
||||
find "$WORKSPACE_PATH" -name "coverage" -type d -exec rm -rf {} \; 2>/dev/null || true
|
||||
|
||||
# Remove node_modules with restricted permissions
|
||||
find "$WORKSPACE_PATH" -name "node_modules" -type d -exec chmod -R 755 {} \; 2>/dev/null || true
|
||||
|
||||
# Remove any .git directories that might have permission issues
|
||||
find "$WORKSPACE_PATH" -name ".git" -type d -exec chmod -R 755 {} \; 2>/dev/null || true
|
||||
|
||||
# Set proper umask for subsequent operations
|
||||
umask 022
|
||||
|
||||
echo "✅ Workspace cleaned successfully"
|
||||
EOF
|
||||
|
||||
sudo chmod +x /usr/local/bin/pre-checkout-cleanup.sh
|
||||
|
||||
echo "✅ GitHub Actions runner permission fixes applied!"
|
||||
echo "📝 Summary of changes:"
|
||||
echo " - Set default umask to 022 for all runner processes"
|
||||
echo " - Created systemd drop-in for automatic cleanup"
|
||||
echo " - Added periodic cleanup cron job (every 30 minutes)"
|
||||
echo " - Created pre-checkout cleanup script"
|
||||
echo " - Fixed existing permission issues"
|
||||
echo ""
|
||||
echo "🔄 Restart runner services for changes to take effect:"
|
||||
echo " sudo systemctl restart actions.runner.*.service"
|
||||
echo ""
|
||||
echo "🧪 Test the fix by running a workflow with coverage generation."
|
||||
@@ -6,11 +6,7 @@ import { createLogger } from './utils/logger';
|
||||
import { StartupMetrics } from './utils/startup-metrics';
|
||||
import githubRoutes from './routes/github';
|
||||
import claudeRoutes from './routes/claude';
|
||||
import type {
|
||||
WebhookRequest,
|
||||
HealthCheckResponse,
|
||||
ErrorResponse
|
||||
} from './types/express';
|
||||
import type { WebhookRequest, HealthCheckResponse, ErrorResponse } from './types/express';
|
||||
import { execSync } from 'child_process';
|
||||
|
||||
const app = express();
|
||||
@@ -151,7 +147,6 @@ app.get('/health', (req: WebhookRequest, res: express.Response<HealthCheckRespon
|
||||
res.status(200).json(checks);
|
||||
});
|
||||
|
||||
|
||||
// Error handling middleware
|
||||
app.use(
|
||||
(
|
||||
|
||||
@@ -56,7 +56,8 @@ export async function processCommand({
|
||||
|
||||
// In test mode, skip execution and return a mock response
|
||||
// Support both classic (ghp_) and fine-grained (github_pat_) GitHub tokens
|
||||
const isValidGitHubToken = githubToken && (githubToken.includes('ghp_') || githubToken.includes('github_pat_'));
|
||||
const isValidGitHubToken =
|
||||
githubToken && (githubToken.includes('ghp_') || githubToken.includes('github_pat_'));
|
||||
if (process.env['NODE_ENV'] === 'test' || !isValidGitHubToken) {
|
||||
logger.info(
|
||||
{
|
||||
@@ -94,8 +95,8 @@ For real functionality, please configure valid GitHub and Claude API tokens.`;
|
||||
});
|
||||
}
|
||||
|
||||
// Select appropriate entrypoint script based on operation type
|
||||
const entrypointScript = getEntrypointScript(operationType);
|
||||
// Use unified entrypoint script for all operation types
|
||||
const entrypointScript = getEntrypointScript();
|
||||
logger.info(
|
||||
{ operationType },
|
||||
`Using ${operationType === 'auto-tagging' ? 'minimal tools for auto-tagging operation' : 'full tool set for standard operation'}`
|
||||
@@ -225,18 +226,12 @@ For real functionality, please configure valid GitHub and Claude API tokens.`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get appropriate entrypoint script based on operation type
|
||||
* Get entrypoint script for Claude Code execution
|
||||
* Uses unified entrypoint that handles all operation types based on OPERATION_TYPE env var
|
||||
*/
|
||||
function getEntrypointScript(operationType: OperationType): string {
|
||||
switch (operationType) {
|
||||
case 'auto-tagging':
|
||||
return '/scripts/runtime/claudecode-tagging-entrypoint.sh';
|
||||
case 'pr-review':
|
||||
case 'default':
|
||||
default:
|
||||
function getEntrypointScript(): string {
|
||||
return '/scripts/runtime/claudecode-entrypoint.sh';
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Create prompt based on operation type and context
|
||||
|
||||
@@ -56,7 +56,6 @@ export interface HealthCheckResponse {
|
||||
healthCheckDuration?: number;
|
||||
}
|
||||
|
||||
|
||||
export interface ErrorResponse {
|
||||
error: string;
|
||||
message?: string;
|
||||
|
||||
@@ -202,7 +202,7 @@ class ContainerExecutor {
|
||||
return this.exec({
|
||||
entrypoint: '/bin/bash',
|
||||
command:
|
||||
'echo \'=== AWS files ===\'; ls -la /home/node/.aws/; echo \'=== Config content ===\'; cat /home/node/.aws/config; echo \'=== Test AWS profile ===\'; export AWS_PROFILE=claude-webhook; export AWS_CONFIG_FILE=/home/node/.aws/config; export AWS_SHARED_CREDENTIALS_FILE=/home/node/.aws/credentials; aws sts get-caller-identity --profile claude-webhook',
|
||||
"echo '=== AWS files ==='; ls -la /home/node/.aws/; echo '=== Config content ==='; cat /home/node/.aws/config; echo '=== Test AWS profile ==='; export AWS_PROFILE=claude-webhook; export AWS_CONFIG_FILE=/home/node/.aws/config; export AWS_SHARED_CREDENTIALS_FILE=/home/node/.aws/credentials; aws sts get-caller-identity --profile claude-webhook",
|
||||
volumes: [`${homeDir}/.aws:/home/node/.aws:ro`],
|
||||
...options
|
||||
});
|
||||
|
||||
@@ -100,7 +100,6 @@ function conditionalDescribe(suiteName, suiteFunction, options = {}) {
|
||||
console.warn(
|
||||
`⚠️ Skipping test suite '${suiteName}': Missing environment variables: ${missing.join(', ')}`
|
||||
);
|
||||
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
@@ -52,7 +52,7 @@ jest.mock('../../src/utils/secureCredentials', () => ({
|
||||
|
||||
jest.mock('util', () => ({
|
||||
...jest.requireActual('util'),
|
||||
promisify: jest.fn((fn) => fn ? async (...args: any[]) => fn(...args) : fn)
|
||||
promisify: jest.fn(fn => (fn ? (...args: any[]) => fn(...args) : fn))
|
||||
}));
|
||||
|
||||
// Mock the entire claudeService to avoid complex dependency issues
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
|
||||
import request from 'supertest';
|
||||
import express from 'express';
|
||||
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
|
||||
import request from 'supertest';
|
||||
import express from 'express';
|
||||
import type { Request, Response } from 'express';
|
||||
|
||||
@@ -98,13 +98,15 @@ describe('Claude Service - Docker Container Integration', () => {
|
||||
const testError = new Error('Claude API rate limit exceeded');
|
||||
processCommand.mockRejectedValueOnce(testError);
|
||||
|
||||
await expect(processCommand({
|
||||
await expect(
|
||||
processCommand({
|
||||
repoFullName: 'owner/repo',
|
||||
issueNumber: 123,
|
||||
command: 'analyze repository',
|
||||
isPullRequest: false,
|
||||
branchName: null
|
||||
})).rejects.toThrow('Claude API rate limit exceeded');
|
||||
})
|
||||
).rejects.toThrow('Claude API rate limit exceeded');
|
||||
});
|
||||
|
||||
it('should handle network timeouts', async () => {
|
||||
@@ -112,13 +114,15 @@ describe('Claude Service - Docker Container Integration', () => {
|
||||
timeoutError.code = 'TIMEOUT';
|
||||
processCommand.mockRejectedValueOnce(timeoutError);
|
||||
|
||||
await expect(processCommand({
|
||||
await expect(
|
||||
processCommand({
|
||||
repoFullName: 'owner/repo',
|
||||
issueNumber: 123,
|
||||
command: 'analyze large repository',
|
||||
isPullRequest: false,
|
||||
branchName: null
|
||||
})).rejects.toThrow('Request timeout');
|
||||
})
|
||||
).rejects.toThrow('Request timeout');
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
@@ -75,7 +75,7 @@ describe('Claude Service', () => {
|
||||
});
|
||||
|
||||
// Verify test mode response
|
||||
expect(result).toContain('Hello! I\'m Claude responding to your request.');
|
||||
expect(result).toContain("Hello! I'm Claude responding to your request.");
|
||||
expect(result).toContain('test/repo');
|
||||
expect(sanitizeBotMentions).toHaveBeenCalled();
|
||||
|
||||
|
||||
@@ -393,7 +393,7 @@ describe('githubService - Simple Coverage Tests', () => {
|
||||
it('should handle container keywords for docker', async () => {
|
||||
const labels = await githubService.getFallbackLabels(
|
||||
'Container startup issue',
|
||||
'The container won\'t start properly'
|
||||
"The container won't start properly"
|
||||
);
|
||||
|
||||
expect(labels).toContain('component:docker');
|
||||
|
||||
@@ -154,7 +154,7 @@ region = us-west-2
|
||||
process.env.AWS_PROFILE = 'non-existent-profile';
|
||||
|
||||
await expect(awsCredentialProvider.getCredentials()).rejects.toThrow(
|
||||
'Profile \'non-existent-profile\' not found'
|
||||
"Profile 'non-existent-profile' not found"
|
||||
);
|
||||
|
||||
// Restore AWS_PROFILE
|
||||
@@ -172,7 +172,7 @@ aws_access_key_id = test-access-key
|
||||
fsPromises.readFile.mockImplementationOnce(() => Promise.resolve(mockConfigFile));
|
||||
|
||||
await expect(awsCredentialProvider.getCredentials()).rejects.toThrow(
|
||||
'Incomplete credentials for profile \'test-profile\''
|
||||
"Incomplete credentials for profile 'test-profile'"
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
|
||||
import type { Request, Response, NextFunction } from 'express';
|
||||
|
||||
// Mock the logger
|
||||
|
||||
Reference in New Issue
Block a user