Repository navigation
Add CI pipeline - #1
Merged
Merged
Conversation
…ntegration smoke test - TypeScript: type-check, build, console.log audit - Python: ruff lint + format, pyright, import check, pytest - Security: hardcoded secret scan, pip-audit for CVEs - Integration: build verification, service component init, manifest validation - Runs on push to main and all PRs
- Install openclaw package for plugin-sdk types in CI - Make tsc type-check warn-only (plugin SDK types may not fully resolve) - Make ruff format warn-only until codebase is reformatted - Build step still hard-fails (must produce dist/)
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions CI workflow to automatically validate the TypeScript plugin and Python service on pushes/PRs to main, plus basic secret/vulnerability scanning and an integration smoke job.
Changes:
- Introduces a TypeScript job to install deps, type-check, build, and scan for
console.log. - Introduces a Python job to lint/format/type-check, import-verify, and run unit tests when present.
- Adds security scanning and an integration smoke test job.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
added 5 commits
March 29, 2026 16:02
TokenRanger uses fetchWithSsrFGuard which isn't in the published openclaw package yet. Build with --skipLibCheck until SDK is released.
The plugin uses unreleased openclaw plugin-sdk APIs (fetchWithSsrFGuard with custom Response type). Build will hard-fail once SDK is published. Python, security, and integration jobs are the hard gates for now.
synchronic1
added a commit
that referenced
this pull request
Sep 13, 2026
…ice smoke test Four Copilot findings from PR #1 were still open on main. Three were real and are fixed here; three were not, and are deliberately left alone. Fixed: - The hardcoded-secret scan used a PCRE lookahead (`(?!$)`) under `grep -E`. grep exits 2 on an invalid ERE, and that exit status is what the `if` tests, so the pattern silently read as "no match" and was never scanned. Now POSIX ERE: `[[:space:]]`, and a quote followed by a non-quote for the non-empty case. The `\s` half of the report was wrong — GNU grep accepts `\s` in ERE as an extension. - The scan set FOUND=1 and then exited 0 regardless, so it could never block a merge. It now exits 1 with an ::error:: annotation. Checked against the current tree first: no existing matches, so this does not turn main red. - The "Start Python service" step was silently broken. `Settings` declares `env_prefix="TOKENRANGER_"`, so OLLAMA_URL/LOG_LEVEL were never read, and `s.service_url` / `s.preferred_model` do not exist on `Settings` — the step raised AttributeError, hidden by a trailing `|| true`. Now uses the real prefix and field names and drops `|| true`. Verified exit 0 against service/ with its dependencies installed. - The console.log audit never failed the job. It now does, scoped to `src/` only: `index.ts` is the plugin entry point whose `setup` command prints to the console deliberately, so enforcing it there would fail the build on legitimate output. Not changed, with reasons: - Three reports that the `python -c` bodies are indented and would raise IndentationError are incorrect: the YAML block scalar dedents those lines before the shell sees them, which is why the step passes today. - The TypeScript finding (`openclaw/plugin-sdk` absent from package.json) does not fail CI — the job is warn-only by design (`continue-on-error`, plus a comment saying it will hard-fail once the SDK is published). Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
A GitHub Actions CI pipeline that runs automatically on every push to main and every PR.
4 Jobs:
1. TypeScript Build & Lint
tsc --noEmitdist/console.login production code2. Python Service Checks
ruffruff formatpyright(warn-only)pytest(when tests exist)3. Security Scan
pip-audit4. Integration Smoke Test (runs after TS + Python pass)
dist/outputopenclaw.plugin.jsonmanifestCost
Uses GitHub Actions free tier (2,000 min/month for public repos — unlimited).
No extra subscriptions needed.