ci: real CI for the Tier A require-all gate (python tests, secret scan, forge) #5

Merged

buddysan merged 1 commit from release/ci-workflow into main 2026-09-16 13:35:46 +00:00

Conversation 2 Commits 1 Files changed 5 +428

buddysan commented 2026-09-16 13:31:16 +00:00

Owner

Copy link

Summary

Tracks OpenProject WP 7920 (CI workflows + Makefile, release-director wave 1). Implements the test/CI conventions in docs/architecture.md §6 (offline unittest < 60 s, fixtures under bot/tests/fixtures/<module>/, fork tests gated behind ARC_RPC_URL — verified a vm.skip inside forge test still exits 0, so the job reports success, never a skipped status).

Gives `fortiblox/arc-mev-bot` real CI so the Tier A "all reported checks must pass" gate means something.

• `.forgejo/workflows/ci.yml` — two unconditional jobs on every PR + push to main:
  • python-tests (`ubuntu-latest`): `make lint` (py_compile + secret/token scan that fails the build — the prevention gate for the token-in-config class found on LXC 140) then `make test` (offline stdlib unittest).
  • forge-tests (`ghcr.io/foundry-rs/foundry:v1.8.1`, the exact forge on LXC 140): git checkout of the PR SHA, version pin assertion, `forge build && forge test -vv`, zero-tests guard (fails once any `.sol` exists with no tests).
• No `paths:` filters, no `if:`, no label gates, only `actions/*` — a `skipped` status permanently blocks auto-merge in require-all mode.
• `Makefile` — `test`, `lint`, `forge-test`, `probe` (placeholder for `bot/rpc_probe.py`, devops lane), `ci`. Local == CI.
• `docs/ci.md` — the CI contract.
• `bot/tests/test_smoke.py` — seeds the offline suite.

No `contracts/foundry.toml` bootstrap was needed: `forge build && forge test` exit 0 on an empty tree (verified on runner 120 and on LXC 140).

Test plan

• `make lint test` green locally and inside the fleet runner image (runner 120)
• secret-scan proven to FAIL on planted fakes for every rule, without echoing the secret; `.env.example` correctly exempt
• forge recipe lines green on LXC 140 (forge 1.8.1, empty tree)
• both CI jobs green on a real Forgejo runner: run 1 on head fdf86bd — python-tests 4 s on forgejo-runner-d (LXC 120), forge-tests 23 s on forgejo-runner-lxc112 (tasks 171282/171283)

🤖 Generated with Claude Code

## Summary Tracks OpenProject **WP 7920** (CI workflows + Makefile, release-director wave 1). Implements the test/CI conventions in `docs/architecture.md` §6 (offline unittest < 60 s, fixtures under `bot/tests/fixtures/<module>/`, fork tests gated behind `ARC_RPC_URL` — verified a `vm.skip` inside `forge test` still exits 0, so the job reports `success`, never a `skipped` status). Gives \`fortiblox/arc-mev-bot\` real CI so the Tier A "all reported checks must pass" gate means something. - \`.forgejo/workflows/ci.yml\` — two unconditional jobs on every PR + push to main: - **python-tests** (\`ubuntu-latest\`): \`make lint\` (py_compile + secret/token scan that fails the build — the prevention gate for the token-in-config class found on LXC 140) then \`make test\` (offline stdlib unittest). - **forge-tests** (\`ghcr.io/foundry-rs/foundry:v1.8.1\`, the exact forge on LXC 140): git checkout of the PR SHA, version pin assertion, \`forge build && forge test -vv\`, zero-tests guard (fails once any \`.sol\` exists with no tests). - No \`paths:\` filters, no \`if:\`, no label gates, only \`actions/*\` — a \`skipped\` status permanently blocks auto-merge in require-all mode. - \`Makefile\` — \`test\`, \`lint\`, \`forge-test\`, \`probe\` (placeholder for \`bot/rpc_probe.py\`, devops lane), \`ci\`. Local == CI. - \`docs/ci.md\` — the CI contract. - \`bot/tests/test_smoke.py\` — seeds the offline suite. No \`contracts/foundry.toml\` bootstrap was needed: \`forge build && forge test\` exit 0 on an empty tree (verified on runner 120 and on LXC 140). ## Test plan - [x] \`make lint test\` green locally and inside the fleet runner image (runner 120) - [x] secret-scan proven to FAIL on planted fakes for every rule, without echoing the secret; \`.env.example\` correctly exempt - [x] forge recipe lines green on LXC 140 (forge 1.8.1, empty tree) - [x] both CI jobs green on a real Forgejo runner: run 1 on head fdf86bd — python-tests 4 s on forgejo-runner-d (LXC 120), forge-tests 23 s on forgejo-runner-lxc112 (tasks 171282/171283) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

buddysan added 1 commit 2026-09-16 13:31:17 +00:00

ci: real CI for the Tier A require-all gate (python tests, secret scan, forge) ... fdf86bd13e

Adds .forgejo/workflows/ci.yml with two unconditional jobs on every PR and
push to main:

- python-tests (ubuntu-latest): make lint (py_compile over bot/**/*.py +
  secret/token scan that FAILS the build on credential URLs, 40-hex tokens,
  PEM key blocks, 64-hex EVM keys in key context, keystore JSON, known token
  prefixes, and forbidden tracked files such as .env / *.key /
  config/rpc-pool.toml) then make test (offline stdlib unittest discover).
- forge-tests (ghcr.io/foundry-rs/foundry:v1.8.1 = exact forge on LXC 140,
  commit 982849d): git checkout of the PR SHA (image has no node), version
  pin assertion, forge build + forge test -vv, plus a zero-tests guard so
  the job cannot stay vacuously green once Solidity sources exist.

No paths: filters, no if:, no label gates, only actions/* — a skipped
status permanently blocks auto-merge in require-all mode on this instance.

Makefile gives local == CI (test, lint, forge-test, probe placeholder for
bot/rpc_probe.py from the devops lane). docs/ci.md is the contract: what
runs, why it is shaped this way, how to read a red check, automerger flow.

bot/tests/test_smoke.py seeds the offline suite (import, stdlib-only,
PairCreated decode on a synthetic log).

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Signed-off-by: BuddySan <[email protected]>

buddysan force-pushed release/ci-workflow from fdf86bd13e to ba4a69d591 2026-09-16 13:33:08 +00:00 Compare

buddysan changed title from WIP: ci: real CI for the Tier A require-all gate (python tests, secret scan, forge) to ci: real CI for the Tier A require-all gate (python tests, secret scan, forge) 2026-09-16 13:33:34 +00:00

buddysan added the

auto-merge

label 2026-09-16 13:33:34 +00:00

fortiblox-dev approved these changes 2026-09-16 13:35:46 +00:00

fortiblox-dev left a comment

Copy link

automerger v2 auto-approved: all 7 gates pass. Approver: fortiblox-dev (opposite-identity rule). Gates: mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker.

automerger v2 auto-approved: all 7 gates pass. Approver: fortiblox-dev (opposite-identity rule). Gates: mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker.

buddysan merged commit ba4a69d591 into main 2026-09-16 13:35:46 +00:00

buddysan deleted branch release/ci-workflow 2026-09-16 13:35:46 +00:00

buddysan commented 2026-09-16 13:35:47 +00:00

Author

Owner

Copy link

Auto-merged by forgejo-automerger at 2026-09-16 13:35:47 UTC. Approver: fortiblox-dev (opposite-identity rule, Option C upgrade 2026-05-13). Merger: buddysan via fast-forward-only (NOT admin force_merge). Criteria passed: mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker. Branch ba4a69d591 merged onto main and feature branch deleted. See project_forgejo_automerger memory for rationale.

Auto-merged by **forgejo-automerger** at 2026-09-16 13:35:47 UTC. **Approver:** `fortiblox-dev` (opposite-identity rule, Option C upgrade 2026-05-13). **Merger:** `buddysan` via `fast-forward-only` (NOT admin `force_merge`). **Criteria passed:** `mergeable=true,label=auto-merge,author=buddysan,identity=ok,status_checks=not_required,signatures=upstream_BP_only,opt_in=repo_marker`. Branch `ba4a69d591` merged onto `main` and feature branch deleted. See `project_forgejo_automerger` memory for rationale.

buddysan referenced this pull request 2026-09-16 13:55:32 +00:00

feat(contracts): ArcCycleExecutor + CREATE2 deploy + key-management design (Phase 3, WP 7908/7909/7910) #9

buddysan referenced this pull request 2026-09-16 13:56:02 +00:00

docs: fold research deltas into architecture contract + plan #10

buddysan referenced this pull request from a commit 2026-09-16 13:56:03 +00:00

docs: fold research deltas into architecture contract + plan

buddysan referenced this pull request from a commit 2026-09-16 13:58:35 +00:00

docs: fold research deltas into architecture contract + plan

buddysan referenced this pull request from a commit 2026-09-16 14:13:24 +00:00

docs: fold research deltas into architecture contract + plan

Sign in to join this conversation.

Reviewers

No reviewers

fortiblox-dev

Labels

Clear labels   

auto-merge

Opt-in: automerger will land this PR after CI green + all gates pass

  

auto-merge

Automerge when CI passes (set by webhook bridge)

No labels

auto-merge

auto-merge

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fortiblox/arc-mev-bot!5

No description provided.