amplifier-agent/.github/workflows/install-script.yml at main · microsoft/amplifier-agent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: install-script

# Verifies the customer's actual install path:
#   curl -fsSL .../install.sh | bash
#
# Runs when install.sh changes, and on every engine tag push -- a release is
# exactly when this path is most likely to break and least likely to be noticed.

on:
  pull_request:
    paths:
      - install.sh
      - .github/workflows/install-script.yml
  push:
    branches: [main]
    paths:
      - install.sh
      - .github/workflows/install-script.yml
    # `paths` is not applied to tag pushes (actions/runner#3932), so every v*
    # tag runs this workflow regardless of what the tagged commit touched.
    # That is the behavior we want here -- do not "fix" it.
    tags:
      - 'v*'

# Cancel in-flight runs for the same ref when a new commit is pushed.
# Never cancel a tag run -- it verifies the release users are about to install.
concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref_type != 'tag' }}

jobs:
  shellcheck:
    name: shellcheck
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install shellcheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck

      - name: Run shellcheck
        run: shellcheck install.sh

  smoke-test:
    name: smoke test (pushed tag, else latest release)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    container:
      image: python:3.12-slim
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install prerequisites
        run: |
          apt-get update
          apt-get install -y curl ca-certificates git
          curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      # Two paths, no hardcoded version:
      #   tag push  -> install THAT tag, so the release is verified before users get it
      #   otherwise -> pass no --tag, which is the literal customer command and also
      #                exercises install.sh's own latest-release resolution
      # Priming is deliberately NOT skipped: `amplifier-agent-post-install` is
      # otherwise tested by nothing, and install.sh treats a priming failure as a
      # warning while still printing success -- so the assertion below is what
      # actually catches it.
      - name: Run installer
        run: |
          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
            echo "Installing pushed tag: ${GITHUB_REF_NAME}"
            bash install.sh --yes --tag "${GITHUB_REF_NAME}"
          else
            echo "Installing latest release (resolved by install.sh)"
            bash install.sh --yes
          fi

      - name: Verify install
        run: amplifier-agent --help

      # install.sh swallows priming failures. Assert the prepared-bundle cache
      # actually exists so a broken post-install hook cannot pass as a green run.
      - name: Verify bundle cache was primed
        run: |
          cache_root="${HOME}/.amplifier-agent/cache"
          if ! find "$cache_root" -name manifest.json -print -quit 2>/dev/null | grep -q .; then
            echo "::error::no prepared-bundle manifest under ${cache_root}"
            echo "amplifier-agent-post-install did not prime the cache."
            ls -R "$cache_root" 2>/dev/null || echo "(cache root does not exist)"
            exit 1
          fi
          echo "prepared-bundle cache present:"
          find "$cache_root" -name manifest.json