Skip to content

ci(workflows): validate AGENTCTL_INSTALL allowlist #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leo-aa88 merged 1 commit into from
Jun 1, 2026
Merged

ci(workflows): validate AGENTCTL_INSTALL allowlist #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion .github/workflows/agentctl-pr-review-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,14 @@ jobs:
- name: Checkout
uses: actions/checkout@v4

- name: Validate AGENTCTL_INSTALL
run: |
set -euo pipefail
case "${AGENTCTL_INSTALL:-go-build}" in
go-build|release) ;;
*) echo "AGENTCTL_INSTALL must be 'go-build' or 'release', got '${AGENTCTL_INSTALL}'" >&2; exit 1 ;;
esac

- name: Cache SQLite state (optional)
if: env.AGENTIC_CACHE_STATE == 'true'
uses: actions/cache@v4
Expand All @@ -71,7 +79,7 @@ jobs:
agentctl version

- name: Install agentctl (release tarball)
if: env.AGENTCTL_INSTALL != 'go-build'
if: env.AGENTCTL_INSTALL == 'release'
run: |
set -euo pipefail
version="${AGENTCTL_VERSION}"
Expand Down
10 changes: 9 additions & 1 deletion .github/workflows/agentctl-pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,14 @@ jobs:
set -euo pipefail
echo "gh_pr_comment=${AGENTIC_GH_PR_COMMENT:-false}" >> "$GITHUB_OUTPUT"

- name: Validate AGENTCTL_INSTALL
run: |
set -euo pipefail
case "${AGENTCTL_INSTALL:-go-build}" in
go-build|release) ;;
*) echo "AGENTCTL_INSTALL must be 'go-build' or 'release', got '${AGENTCTL_INSTALL}'" >&2; exit 1 ;;
esac

- name: Cache SQLite state (optional)
if: env.AGENTIC_CACHE_STATE == 'true'
uses: actions/cache@v4
Expand All @@ -88,7 +96,7 @@ jobs:
agentctl version

- name: Install agentctl (release tarball)
if: env.AGENTCTL_INSTALL != 'go-build'
if: env.AGENTCTL_INSTALL == 'release'
run: |
set -euo pipefail
version="${AGENTCTL_VERSION}"
Expand Down
6 changes: 3 additions & 3 deletions docs/GITHUB_ACTIONS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,12 +97,12 @@ comment. **`upsert: true`** is an alias for **`replace`**.

## Installing `agentctl` in Actions

The template supports two modes via **`AGENTCTL_INSTALL`**:
The template supports exactly two values for **`AGENTCTL_INSTALL`**. Any other value fails the workflow early with a clear error.

| Value | When to use |
|-------|-------------|
| **`go-build`** (default in this monorepo) | The workflow checks out this repository and runs **`go build ./cmd/agentctl`**. Use this while developing here so CI always matches the native tools on the branch (no waiting on a release asset). |
| **`release`** | Set **`AGENTCTL_INSTALL`** to **`release`** (any value other than **`go-build`**) in a **downstream** repo that only copies the YAML project, not the Go source. Then set **`AGENTCTL_VERSION`** (e.g. **`v0.1.9`**) to a tag whose asset **`agentctl-<tag>-linux-amd64.tar.gz`** exists on **Releases**. |
| **`release`** | Set **`AGENTCTL_INSTALL`** to **`release`** in a **downstream** repo that only copies the YAML project, not the Go source. Then set **`AGENTCTL_VERSION`** (e.g. **`v0.1.9`**) to a tag whose asset **`agentctl-<tag>-linux-amd64.tar.gz`** exists on **Releases**. |

### arm64 and other non-amd64 runners

Expand Down Expand Up @@ -138,7 +138,7 @@ The workflow template sets these **workflow-level** env vars (tune after copying

| Variable | Default | Purpose |
|----------|---------|---------|
| **`AGENTCTL_INSTALL`** | `go-build` in-repo | **`go-build`** compiles **`./cmd/agentctl`** after checkout. Downstream copies should use **`release`** and **`AGENTCTL_VERSION`**. |
| **`AGENTCTL_INSTALL`** | `go-build` in-repo | **`go-build`** or **`release`** only (invalid values fail fast). **`go-build`** compiles **`./cmd/agentctl`** after checkout. Downstream copies should use **`release`** and **`AGENTCTL_VERSION`**. |
| **`AGENTIC_CACHE_STATE`** | `false` | When `true`, restores/saves the SQLite state file between runs (update **`hashFiles()`** globs if **`AGENTIC_PROJECT`** is not **`examples/pr-review-github-actions`**). |
| **`AGENTIC_GH_PR_COMMENT`** | `false` | When `true`, the **`review`** job exports this flag so the follow-up **`post-pointer`** job can run (**`gh pr comment`** pointer to the Actions run). Job-level **`if:`** cannot read workflow **`env`**, so the template uses a step output instead. |

Expand Down
Loading