Qualify every public target branch under GitHub authority (#256)

durable-workflow-ops · durable-workflow-ops · commit ad16770eb43c · 2026-07-16T19:55:22.000Z
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -3,6 +3,8 @@ name: CI
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
   workflow_dispatch:
 
 permissions:
@@ -11,6 +13,7 @@ permissions:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -22,7 +25,9 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
+      fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
@@ -35,6 +40,7 @@ jobs:
 
   package:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -50,48 +56,69 @@ jobs:
 
   cli-parity:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
         with:
           path: sdk-python
-      - uses: actions/checkout@v6
-        with:
-          repository: durable-workflow/cli
-          path: cli
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
+      - name: Checkout public CLI integration source
+        run: python sdk-python/scripts/ci/checkout-public-repository.py cli cli
       - name: Compare shared control-plane parity fixtures
         working-directory: sdk-python
         run: python scripts/check-cli-parity.py --cli ../cli
 
   integration:
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     needs: [lint, test]
     steps:
       - uses: actions/checkout@v6
         with:
           path: sdk-python
-      - uses: actions/checkout@v6
-        with:
-          repository: durable-workflow/server
-          path: server
       - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
+      - name: Checkout public Server integration source
+        run: python sdk-python/scripts/ci/checkout-public-repository.py server server
       - run: pip install -e '.[dev]'
         working-directory: sdk-python
       - name: Start server stack
         working-directory: sdk-python
         run: |
-          docker compose -f docker-compose.test.yml up -d --wait --timeout 120
+          docker compose -f docker-compose.test.yml up -d --wait --timeout 300
+      - name: Select and probe integration endpoint
+        working-directory: sdk-python
+        run: python scripts/ci/configure-integration-endpoint.py
       - name: Run integration tests
         working-directory: sdk-python
         env:
-          DURABLE_WORKFLOW_SERVER_URL: http://localhost:8080
           DURABLE_WORKFLOW_AUTH_TOKEN: test-token
         run: pytest tests/integration/ -v
       - name: Teardown
         if: always()
         working-directory: sdk-python
         run: docker compose -f docker-compose.test.yml down -v
+
+  target-branch-qualification:
+    name: Target branch qualification
+    if: ${{ always() }}
+    needs: [lint, test, package, cli-parity, integration]
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Require every supported Python and integration cell
+        env:
+          LINT_RESULT: ${{ needs.lint.result }}
+          TEST_RESULT: ${{ needs.test.result }}
+          PACKAGE_RESULT: ${{ needs.package.result }}
+          PARITY_RESULT: ${{ needs.cli-parity.result }}
+          INTEGRATION_RESULT: ${{ needs.integration.result }}
+        run: |
+          test "$LINT_RESULT" = success
+          test "$TEST_RESULT" = success
+          test "$PACKAGE_RESULT" = success
+          test "$PARITY_RESULT" = success
+          test "$INTEGRATION_RESULT" = success
diff --git a/scripts/ci/checkout-public-repository.py b/scripts/ci/checkout-public-repository.py
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Checkout a public integration source from its GitHub authority."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import subprocess
+from collections.abc import Sequence
+from pathlib import Path
+
+PUBLIC_REPOSITORIES = {
+    "cli": "https://github.com/durable-workflow/cli.git",
+    "server": "https://github.com/durable-workflow/server.git",
+}
+
+
+def checkout(repository: str, destination: Path) -> None:
+    """Clone a supported public repository without runner-host credentials."""
+    environment = os.environ.copy()
+    environment["GIT_TERMINAL_PROMPT"] = "0"
+
+    subprocess.run(
+        [
+            "git",
+            "-c",
+            "credential.helper=",
+            "clone",
+            "--depth=1",
+            "--no-tags",
+            PUBLIC_REPOSITORIES[repository],
+            str(destination),
+        ],
+        check=True,
+        env=environment,
+    )
+
+
+def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("repository", choices=sorted(PUBLIC_REPOSITORIES))
+    parser.add_argument("destination", type=Path)
+    return parser.parse_args(argv)
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = parse_args(argv)
+    checkout(args.repository, args.destination)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/ci/configure-integration-endpoint.py b/scripts/ci/configure-integration-endpoint.py
@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+"""Select and probe the integration server endpoint for the current CI runner."""
+
+from __future__ import annotations
+
+import argparse
+import os
+import socket
+import struct
+import time
+import urllib.error
+import urllib.request
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+from urllib.parse import urlsplit
+
+HEALTH_PATH = "/api/health"
+PUBLIC_GITHUB_HOST = "github.com"
+
+
+def _docker_host_name(value: str) -> str | None:
+    if not value or value.startswith("unix:"):
+        return None
+
+    parsed = urlsplit(value if "://" in value else f"//{value}")
+    return parsed.hostname
+
+
+def _default_route_gateway(route_file: Path = Path("/proc/net/route")) -> str | None:
+    try:
+        routes = route_file.read_text(encoding="ascii").splitlines()[1:]
+    except OSError:
+        return None
+
+    for route in routes:
+        fields = route.split()
+        if len(fields) < 4 or fields[1] != "00000000":
+            continue
+
+        try:
+            flags = int(fields[3], 16)
+            gateway = socket.inet_ntoa(struct.pack("<L", int(fields[2], 16)))
+        except (OSError, ValueError, struct.error):
+            continue
+
+        if flags & 0x2:
+            return gateway
+
+    return None
+
+
+def _host_docker_internal() -> str | None:
+    try:
+        socket.getaddrinfo("host.docker.internal", None, type=socket.SOCK_STREAM)
+    except socket.gaierror:
+        return None
+    return "host.docker.internal"
+
+
+def _endpoint(host: str, port: int) -> str:
+    formatted_host = f"[{host}]" if ":" in host and not host.startswith("[") else host
+    return f"http://{formatted_host}:{port}"
+
+
+def endpoint_candidates(environment: Mapping[str, str]) -> list[str]:
+    """Return runner-appropriate endpoints in reachability preference order."""
+    runner_host = urlsplit(environment.get("GITHUB_SERVER_URL", "https://github.com")).hostname
+    port = int(environment.get("SERVER_PORT", "8080"))
+    if not 1 <= port <= 65535:
+        raise ValueError("SERVER_PORT must be between 1 and 65535")
+
+    if runner_host == PUBLIC_GITHUB_HOST:
+        hosts = ["localhost"]
+    else:
+        hosts = [
+            _docker_host_name(environment.get("DURABLE_WORKFLOW_DOCKER_HOST", "")),
+            _docker_host_name(environment.get("DOCKER_HOST", "")),
+            _host_docker_internal(),
+            _default_route_gateway(),
+            "localhost",
+        ]
+
+    unique_hosts = list(dict.fromkeys(host for host in hosts if host))
+    return [_endpoint(host, port) for host in unique_hosts]
+
+
+def probe_endpoint(
+    candidates: Sequence[str],
+    *,
+    attempts: int,
+    retry_delay: float,
+    timeout: float,
+) -> str:
+    """Return the first endpoint with a healthy HTTP response."""
+    if attempts < 1:
+        raise ValueError("attempts must be at least 1")
+
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}))
+    failures: dict[str, str] = {}
+    for attempt in range(1, attempts + 1):
+        for endpoint in candidates:
+            health_url = f"{endpoint}{HEALTH_PATH}"
+            try:
+                request = urllib.request.Request(health_url, method="GET")
+                with opener.open(request, timeout=timeout) as response:
+                    if 200 <= response.status < 400:
+                        return endpoint
+                    failures[endpoint] = f"HTTP {response.status}"
+            except (OSError, urllib.error.URLError) as error:
+                failures[endpoint] = str(error)
+
+        if attempt < attempts:
+            time.sleep(retry_delay)
+
+    details = "; ".join(f"{endpoint}: {failures.get(endpoint, 'unreachable')}" for endpoint in candidates)
+    raise RuntimeError(f"integration server health probe failed after {attempts} attempts ({details})")
+
+
+def export_endpoint(endpoint: str, github_environment: Path) -> None:
+    with github_environment.open("a", encoding="utf-8") as environment_file:
+        environment_file.write(f"DURABLE_WORKFLOW_SERVER_URL={endpoint}\n")
+
+
+def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--attempts", type=int, default=30)
+    parser.add_argument("--retry-delay", type=float, default=2.0)
+    parser.add_argument("--timeout", type=float, default=2.0)
+    return parser.parse_args(argv)
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = parse_args(argv)
+    github_environment = os.environ.get("GITHUB_ENV")
+    if not github_environment:
+        raise RuntimeError("GITHUB_ENV must name the CI environment export file")
+
+    candidates = endpoint_candidates(os.environ)
+    endpoint = probe_endpoint(
+        candidates,
+        attempts=args.attempts,
+        retry_delay=args.retry_delay,
+        timeout=args.timeout,
+    )
+    export_endpoint(endpoint, Path(github_environment))
+    print(f"Integration server is reachable at {endpoint}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/test_ci_checkout.py b/tests/test_ci_checkout.py
@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+CHECKOUT_SCRIPT = ROOT / "scripts" / "ci" / "checkout-public-repository.py"
+CI_WORKFLOW = ROOT / ".github" / "workflows" / "ci.yml"
+
+
+@pytest.mark.parametrize(
+    "runner_server_url",
+    ["https://github.com", "https://forgejo.example.test"],
+    ids=["github", "forgejo"],
+)
+@pytest.mark.parametrize(
+    ("repository", "public_url"),
+    [
+        ("cli", "https://github.com/durable-workflow/cli.git"),
+        ("server", "https://github.com/durable-workflow/server.git"),
+    ],
+)
+def test_public_checkout_uses_github_authority_on_every_runner(
+    tmp_path: Path,
+    runner_server_url: str,
+    repository: str,
+    public_url: str,
+) -> None:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    git_capture = tmp_path / "git-arguments"
+    fake_git = bin_dir / "git"
+    fake_git.write_text('#!/bin/sh\nprintf "%s\\n" "$@" > "$GIT_CAPTURE"\n')
+    fake_git.chmod(0o755)
+
+    environment = os.environ.copy()
+    environment.update(
+        {
+            "GITHUB_SERVER_URL": runner_server_url,
+            "GIT_CAPTURE": str(git_capture),
+            "PATH": f"{bin_dir}{os.pathsep}{environment['PATH']}",
+        }
+    )
+    destination = tmp_path / repository
+
+    subprocess.run(
+        [sys.executable, str(CHECKOUT_SCRIPT), repository, str(destination)],
+        check=True,
+        env=environment,
+    )
+
+    assert git_capture.read_text().splitlines() == [
+        "-c",
+        "credential.helper=",
+        "clone",
+        "--depth=1",
+        "--no-tags",
+        public_url,
+        str(destination),
+    ]
+
+
+def test_ci_workflow_uses_portable_public_checkouts() -> None:
+    workflow = CI_WORKFLOW.read_text()
+
+    assert "checkout-public-repository.py cli cli" in workflow
+    assert "checkout-public-repository.py server server" in workflow
+    assert "repository: durable-workflow/" not in workflow
diff --git a/tests/test_ci_integration_endpoint.py b/tests/test_ci_integration_endpoint.py
