ci: harden workflows and preserve diagnostics (#9)

OgeonX-Ai · Aitomates · web-flow · commit 2481c6ab70ab · 2026-07-05T10:33:07.000+03:00
* ci: harden workflow permissions and timeouts

* test(contracts): sync immutable registry release

* fix(foundry): preserve workflow failure causes

* fix(api): preserve workflow failure chaining

* fix(security): sanitize provider span failures

---------

Co-authored-by: Kim Harjamäki &lt;kim.harjamaki@prosimo.fi&gt;
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -7,11 +7,11 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
@@ -30,6 +30,10 @@ jobs:
 
   docker:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
     needs: validate
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -8,6 +8,7 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
@@ -6,14 +6,13 @@ on:
       - master
 permissions:
   contents: read
-  pages: write
-  id-token: write
 concurrency:
   group: "pages"
   cancel-in-progress: false
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -25,10 +24,14 @@ jobs:
         with:
           path: ./site
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages
diff --git a/tests/contracts/cas-contracts/v0.1.0/artifact-manifest.schema.json b/tests/contracts/cas-contracts/v0.1.0/artifact-manifest.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/artifact-manifest.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/artifact-manifest.schema.json",
     "title":  "ArtifactManifest",
     "type":  "object",
     "allOf":  [
diff --git a/tests/contracts/cas-contracts/v0.1.0/common.schema.json b/tests/contracts/cas-contracts/v0.1.0/common.schema.json
@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://schemas.coding-autopilot.dev/v0.1/common.schema.json",
+  "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/common.schema.json",
   "title": "CAS Common Definitions",
   "$defs": {
     "actor": {
diff --git a/tests/contracts/cas-contracts/v0.1.0/evaluation-result.schema.json b/tests/contracts/cas-contracts/v0.1.0/evaluation-result.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/evaluation-result.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/evaluation-result.schema.json",
     "title":  "EvaluationResult",
     "type":  "object",
     "allOf":  [
diff --git a/tests/contracts/cas-contracts/v0.1.0/manifest.json b/tests/contracts/cas-contracts/v0.1.0/manifest.json
@@ -2,44 +2,44 @@
   "version": "0.1.0",
   "schemas": [
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/artifact-manifest.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/artifact-manifest.schema.json",
       "path": "artifact-manifest.schema.json",
-      "sha256": "6c2192fb6ca79843361695f3dccd5ebf1dda8ce320c974db2630b0a2b78705bd"
+      "sha256": "6a18c8f2f279b3ef10f7705ba4e9f39b46ba5a2b2ef0d7072ce7225f06f12ea7"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/common.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/common.schema.json",
       "path": "common.schema.json",
-      "sha256": "c7ce72a6f5da8394e48f2421820588a8142546962e05152997bd1e6ced994928"
+      "sha256": "6c86075df043ec924f6b7aa004c6a694916a6c3d7a822dda4235f1ee8368f92a"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/evaluation-result.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/evaluation-result.schema.json",
       "path": "evaluation-result.schema.json",
-      "sha256": "12e8019f858dc0cda80ac8994ca1251a9a229a8642b05706227bd9c995c5799a"
+      "sha256": "34ff39414099d16d9aed32e416a0c6538e7738c93df01e5fb0940e042b5904d7"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/policy-decision.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/policy-decision.schema.json",
       "path": "policy-decision.schema.json",
-      "sha256": "9cf259d405664560b30b7afd25d08d888337fd9a81a6a388ceeb36cbf7edcc33"
+      "sha256": "32d29407ae471c153705b238a550fa97e1e6c9ac064a5291d5164cc3de369e5a"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/prompt-envelope.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/prompt-envelope.schema.json",
       "path": "prompt-envelope.schema.json",
-      "sha256": "58a991862031f40c2ffcc073743776d05206684534fac2c20c67c274fbf05c84"
+      "sha256": "3d41fcde3223f208e9c268d88474979de6f315ca7fc82c98207dfff3e6d83471"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/run-event.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/run-event.schema.json",
       "path": "run-event.schema.json",
-      "sha256": "1bcaee2ff546439ea81d64d57dcb51cd9f57dd790fe300fd90e251823e27a36f"
+      "sha256": "d03702b78d431cdb05b81ca5f44c5dc0301619660dcf149ae3024bd1ad8b1e3a"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/verification-result.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/verification-result.schema.json",
       "path": "verification-result.schema.json",
-      "sha256": "aeff3d41eeb99b3017b460c2a2a8d07b4e1c828830b72853d5f41d93d6abe012"
+      "sha256": "a66c5b02b7791f4b163c6b2b0dfd476ff60dde67246f3bfcf372f416dc1de253"
     },
     {
-      "id": "https://schemas.coding-autopilot.dev/v0.1/work-request.schema.json",
+      "id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/work-request.schema.json",
       "path": "work-request.schema.json",
-      "sha256": "543e1dd2313cff2a1ebeb1470db3085b89c3933694231eb5b4798096f147e4a7"
+      "sha256": "e4648cfc04494030b26cc8a1cf79fbe92bb9ad841316e0b920f3a15c997967f3"
     }
   ]
 }
diff --git a/tests/contracts/cas-contracts/v0.1.0/policy-decision.schema.json b/tests/contracts/cas-contracts/v0.1.0/policy-decision.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/policy-decision.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/policy-decision.schema.json",
     "title":  "PolicyDecision",
     "type":  "object",
     "allOf":  [
diff --git a/tests/contracts/cas-contracts/v0.1.0/prompt-envelope.schema.json b/tests/contracts/cas-contracts/v0.1.0/prompt-envelope.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/prompt-envelope.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/prompt-envelope.schema.json",
     "title":  "PromptEnvelope",
     "type":  "object",
     "allOf":  [
diff --git a/tests/contracts/cas-contracts/v0.1.0/run-event.schema.json b/tests/contracts/cas-contracts/v0.1.0/run-event.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/run-event.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/run-event.schema.json",
     "title":  "RunEvent",
     "type":  "object",
     "allOf":  [
diff --git a/tests/contracts/cas-contracts/v0.1.0/verification-result.schema.json b/tests/contracts/cas-contracts/v0.1.0/verification-result.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/verification-result.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/verification-result.schema.json",
     "title":  "VerificationResult",
     "type":  "object",
     "allOf":  [
diff --git a/tests/contracts/cas-contracts/v0.1.0/work-request.schema.json b/tests/contracts/cas-contracts/v0.1.0/work-request.schema.json
@@ -1,6 +1,6 @@
 {
     "$schema":  "https://json-schema.org/draft/2020-12/schema",
-    "$id":  "https://schemas.coding-autopilot.dev/v0.1/work-request.schema.json",
+    "$id":  "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/work-request.schema.json",
     "title":  "WorkRequest",
     "type":  "object",
     "allOf":  [
diff --git a/tests/test_service_factory.py b/tests/test_service_factory.py
@@ -88,5 +88,9 @@ def test_foundry_service_sanitizes_sdk_failure(envelope: "Any") -> None:
         )
         service = FoundryWorkflowAgentService(settings)
 
-        with pytest.raises(WorkflowAgentServiceError, match="Foundry workflow invocation failed"):
+        with pytest.raises(
+            WorkflowAgentServiceError, match="Foundry workflow invocation failed"
+        ) as caught:
             service.run(envelope)
+
+    assert caught.value.__cause__ is None

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"$schema": "https://json-schema.org/draft/2020-12/schema",`
`3`		`- "$id": "https://schemas.coding-autopilot.dev/v0.1/artifact-manifest.schema.json",`
	`3`	`+ "$id": "https://coding-autopilot-system.github.io/cas-contracts/registry/v0.1/artifact-manifest.schema.json",`
`4`	`4`	`"title": "ArtifactManifest",`
`5`	`5`	`"type": "object",`
`6`	`6`	`"allOf": [`