Fix project-scoped grants never matching sub-agent worktree requests #188
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| # Nightly, a fresh seed each run -- the fixed-seed step above only ever | |
| # exercises one shuffle of the suite, so a leak that this particular | |
| # order does not disturb would otherwise stay invisible forever. | |
| - cron: "17 7 * * *" | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.3.14" | |
| # The runner image has no ripgrep, so the grep plugin silently exercised | |
| # its fallback walker and left the ripgrep path untested. | |
| - name: Install ripgrep | |
| run: sudo apt-get install -y ripgrep | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Typecheck | |
| run: bun run typecheck | |
| - name: Build | |
| run: bun run build | |
| # Corbits Code codebase only — ./src and ./tests. The vendored interchange | |
| # inference package (vendor/) is out of scope for this repo's CI. | |
| - name: Test | |
| run: bun run test | |
| # Catches tests that only pass because of the default file order (shared | |
| # module-level state, an unrestored global mock, a leaked env var). The | |
| # seed is fixed so a failure here reproduces locally with the same flag. | |
| - name: Test (randomized order) | |
| run: bun test ./src ./tests ./evals --randomize --seed 424242 | |
| randomize-nightly: | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "24" | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.3.14" | |
| - name: Install ripgrep | |
| run: sudo apt-get install -y ripgrep | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| # A fresh seed every run, printed up front so a failure here reproduces | |
| # locally with the exact same `--seed` regardless of which shuffle hit it. | |
| - name: Test (fresh random seed) | |
| run: | | |
| seed=$RANDOM$RANDOM | |
| echo "seed=$seed" | |
| bun test ./src ./tests ./evals --randomize --seed "$seed" |