From 1b2626668a20fcadb554b1e3b87a39e16dce999f Mon Sep 17 00:00:00 2001 From: Oliver Meyer Date: Fri, 13 Nov 2026 15:51:02 +0100 Subject: [PATCH 1/6] ci: remove Claude Code workflows Delete the four Claude Code workflows and their labels, so that the ANTHROPIC_API_KEY copies can be deleted. Co-Authored-By: Claude Opus 5.5 --- .github/CLAUDE.md | 34 +- .github/labels.yml | 12 - .github/workflows/_claude-code.yml | 107 ------- .github/workflows/actions.lock | 20 -- ...tomation-operational-excellence-weekly.yml | 296 ------------------ .../claude-code-automation-pr-review.yml | 270 ---------------- .github/workflows/claude-code-interactive.yml | 35 --- CLAUDE.md | 2 - 8 files changed, 2 insertions(+), 774 deletions(-) delete mode 100644 .github/workflows/_claude-code.yml delete mode 100644 .github/workflows/claude-code-automation-operational-excellence-weekly.yml delete mode 100644 .github/workflows/claude-code-automation-pr-review.yml delete mode 100644 .github/workflows/claude-code-interactive.yml diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md index 95d7f535f..ea1bf0ddc 100644 --- a/.github/CLAUDE.md +++ b/.github/CLAUDE.md @@ -18,9 +18,6 @@ workflows (`> …`, prefixed `_`) are called via `uses:`. | `publish-release.yml` | workflow_dispatch | — | | `merge-release.yml` | workflow_dispatch | — | | `build-native-only.yml` | push/PR/release when msg/label has `build:native:only` | `_build-native-only` | -| `claude-code-interactive.yml` | `@claude` mentions + workflow_dispatch | `_claude-code` (interactive) | -| `claude-code-automation-pr-review.yml` | PR with `claude` label or `ready_for_review` | `_claude-code` (automation) | -| `claude-code-automation-operational-excellence-weekly.yml` | schedule + workflow_dispatch | `_claude-code` (automation) | | `scheduled-testing-staging-hourly.yml` | cron `0 * * * *` | `_scheduled-test-hourly` (staging) | | `scheduled-testing-staging-daily.yml` | cron `0 12 * * *` | `_scheduled-test-daily` (staging) | | `scheduled-testing-production-hourly.yml` | cron `0 * * * *` | `_scheduled-test-hourly` (production) | @@ -31,7 +28,7 @@ workflows (`> …`, prefixed `_`) are called via `uses:`. Reusable: `_lint`, `_docs`, `_audit`, `_test`, `_codeql`, `_ketryx_report_and_check`, `_package-publish`, `_build-native-only`, -`_claude-code`, `_scheduled-audit`, `_scheduled-test-hourly`, +`_scheduled-audit`, `_scheduled-test-hourly`, `_scheduled-test-daily`, `_scheduled-test-stress`. (`stress-testing-staging.yml.paused` is currently disabled.) @@ -119,32 +116,6 @@ Runners: `ubuntu-latest` (stable) plus experimental `ubuntu-24.04-arm`, `macos-latest`, `macos-15-intel`, `windows-latest` (UPX), `windows-11-arm`. Output: `aignostics.7z` per platform. Local: `make dist_native`. -## Claude Code (`_claude-code.yml`) - -One reusable workflow, two modes via the `mode` input: - -- **interactive** — full git history (`fetch-depth: 0`). - `claude-code-interactive.yml` triggers it on `@claude` mentions - (issue/PR comments, reviews, issues, PRs) and `workflow_dispatch`. It passes - only `mode` and `track_progress` — there are **no** `prompt`/`max_turns`/ - `environment` inputs to fill in. -- **automation** — shallow history (`fetch-depth: 1`), runs a fixed `prompt`. - `claude-code-automation-pr-review.yml` triggers it when a PR carries the - `claude` label or becomes `ready_for_review`. `max_turns` is not set, so it - uses the `_claude-code.yml` default (200). Review tools include - `mcp__github_inline_comment__create_inline_comment` and posts a - `claude:review:passed` / `claude:review:failed` verdict label. - -`_claude-code.yml` inputs: `mode` (required), `prompt`, `max_turns` (default -`200`), `allowed_tools` (default defined in the workflow — read it there rather -than copying), `track_progress`, `use_sticky_comment`. Model is -`claude-sonnet-4-5-20250929`. - -**Setup**: installs `uv`, dev tools (`_install_dev_tools.bash`), -`uv sync --all-extras --locked`, headless display. Only secret available is -`ANTHROPIC_API_KEY` — Claude Code workflows intentionally have **no** platform -or GCP credentials. - ## Scheduled jobs - **Testing** — staging and production each run **hourly** (`0 * * * *`, via @@ -171,8 +142,7 @@ Secrets: `BETTERSTACK_AUDIT_HEARTBEAT_URL`, E2E. **Production** (`platform.aignostics.com`) is used only by scheduled jobs and release validation — never in PR CI. -GitHub secrets: `ANTHROPIC_API_KEY`, -`AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, +GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, the BetterStack URLs above, `CODECOV_TOKEN`, `SONAR_TOKEN`, `SENTRY_DSN`/`SENTRY_AUTH_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`/`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`. diff --git a/.github/labels.yml b/.github/labels.yml index 7630d58d2..507256a1d 100644 --- a/.github/labels.yml +++ b/.github/labels.yml @@ -130,18 +130,6 @@ color: "1d76db" # AI Assistant Labels -- name: claude - description: Trigger Claude Code automation - color: "b41d8f" - -- name: claude:review:passed - description: Automated Claude PR review found no blocking issues on the current head commit - color: "0e8a16" - -- name: claude:review:failed - description: Automated Claude PR review found blocking issues on the current head commit - color: "b60205" - - name: copilot description: GitHub Copilot related color: "e6dac6" diff --git a/.github/workflows/_claude-code.yml b/.github/workflows/_claude-code.yml deleted file mode 100644 index 4cc90ae41..000000000 --- a/.github/workflows/_claude-code.yml +++ /dev/null @@ -1,107 +0,0 @@ -name: "> Claude Code" - -on: - workflow_call: - inputs: - mode: - description: 'Mode: interactive or automation' - required: true - type: string - prompt: - description: 'Prompt for automation mode' - required: false - type: string - max_turns: - description: 'Maximum number of turns for Claude' - required: false - default: '200' - type: string - allowed_tools: - description: 'Allowed tools for Claude' - required: false - default: 'mcp__github_inline_comment__create_inline_comment,Read,Write,Edit,MultiEdit,Glob,Grep,LS,WebFetch,WebSearch,Bash(git:*),Bash(bun:*),Bash(npm:*),Bash(npx:*),Bash(gh:*),Bash(uv:*),Bash(make:*),Bash(export:*)' - type: string - track_progress: - description: 'Track progress (set to false for workflow_dispatch)' - required: false - default: true - type: boolean - use_sticky_comment: - description: 'Use just one comment to deliver PR comments (only applies for pull_request event workflows)' - required: false - default: false - type: boolean - secrets: - ANTHROPIC_API_KEY: - required: true - -jobs: - claude-code: - runs-on: ubuntu-latest - permissions: - actions: read # github_ci MCP server of claude-code-action reads workflow runs and job logs - contents: read - id-token: write # anthropics/claude-code-action exchanges the OIDC token for the Claude App token - pull-requests: read # github_ci MCP server of claude-code-action reads the pull request (pulls.get) - steps: - - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: ${{ inputs.mode == 'interactive' && 0 || 1 }} - - - name: Install uv - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 - with: - version-file: "pyproject.toml" - enable-cache: true - cache-dependency-glob: uv.lock - - - name: Install dev tools - shell: bash - run: .github/workflows/_install_dev_tools.bash - - - name: Install Python, venv and dependencies - shell: bash - run: uv sync --all-extras --locked --link-mode=copy - - - name: Setup display - uses: pyvista/setup-headless-display-action@10e6efb97af3cd1523828f0e22c39f0e4567f3e4 # v5.2 - - - name: Print development version info - if: ${{ !startsWith(github.ref, 'refs/tags/v') }} - shell: bash - run: | - TOML_VERSION=$(uv run --locked python -c "import tomli; print(tomli.load(open('pyproject.toml', 'rb'))['project']['version'])") - echo "Development build - Current version in pyproject.toml: $TOML_VERSION" - - - name: Run Claude Code (Interactive Mode) - if: inputs.mode == 'interactive' - uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254 - with: - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} - track_progress: ${{ inputs.track_progress }} - additional_permissions: | - actions: read - allowed_bots: "dependabot[bot],renovate[bot]" - claude_args: >- - --max-turns ${{ inputs.max_turns }} - --model claude-sonnet-4-5-20250929 - --allowed-tools "${{ inputs.allowed_tools }}" - --system-prompt "Read the CLAUDE.md file in the root folder of this repository and explicitely acknowledge you will apply **all** guidance therein and in **all** linked documents." - - - name: Run Claude Code (Automation Mode) - if: inputs.mode == 'automation' - uses: anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c # v1.0.254 - with: - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} - track_progress: ${{ inputs.track_progress }} - use_sticky_comment: ${{ inputs.use_sticky_comment }} - additional_permissions: | - actions: read - allowed_bots: "dependabot[bot],renovate[bot]" - claude_args: >- - --max-turns ${{ inputs.max_turns }} - --model claude-sonnet-4-5-20250929 - --allowed-tools "${{ inputs.allowed_tools }}" - --system-prompt "Read the CLAUDE.md file in this repository and explicitely acknowledge you will apply the guidance therein." - prompt: ${{ inputs.prompt }} diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index eaac5329e..05cbe7a6f 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -11,11 +11,6 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884' - '.github/workflows/_claude-code.yml': - - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - - 'anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c' - - 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884' - - 'pyvista/setup-headless-display-action@10e6efb97af3cd1523828f0e22c39f0e4567f3e4' '.github/workflows/_codeql.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'github/codeql-action@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee' @@ -72,9 +67,6 @@ workflows: - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' '.github/workflows/ci-cd.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - '.github/workflows/claude-code-automation-operational-excellence-weekly.yml': [] - '.github/workflows/claude-code-automation-pr-review.yml': [] - '.github/workflows/claude-code-interactive.yml': [] '.github/workflows/codeql-scheduled.yml': [] '.github/workflows/labels-sync.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' @@ -126,13 +118,6 @@ dependencies: commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' owner_id: 44036562 repo_id: 192625955 - 'anthropics/claude-code-action@db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c': - ref: 'v1.0.254' - commit: 'sha1-db77d4d3c98f3f6380e7cd45ffba2342a3dbde3c' - owner_id: 76263028 - repo_id: 986421638 - uses: - - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6' 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884': ref: 'v10.3.0' commit: 'sha1-1c37ad07a6a961277cf70c0d37d6f313000f5884' @@ -177,11 +162,6 @@ dependencies: commit: 'sha1-a9a95522b26fe6403f7bb24031f21fb573d0f5ff' owner_id: 24392180 repo_id: 377964066 - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6': - ref: 'v2.2.0' - commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6' - owner_id: 108928776 - repo_id: 512644635 'pyvista/setup-headless-display-action@10e6efb97af3cd1523828f0e22c39f0e4567f3e4': ref: 'v5.2.0' commit: 'sha1-10e6efb97af3cd1523828f0e22c39f0e4567f3e4' diff --git a/.github/workflows/claude-code-automation-operational-excellence-weekly.yml b/.github/workflows/claude-code-automation-operational-excellence-weekly.yml deleted file mode 100644 index 343f058c7..000000000 --- a/.github/workflows/claude-code-automation-operational-excellence-weekly.yml +++ /dev/null @@ -1,296 +0,0 @@ -name: "+ Claude Code / Automation / Operational Excellence (Weekly)" - -on: - schedule: - # Every Monday at 6:00 AM UTC - - cron: "0 6 * * 1" - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }} - cancel-in-progress: true - -jobs: - operational-excellence: - uses: ./.github/workflows/_claude-code.yml - permissions: - actions: read # github_ci MCP server of claude-code-action in _claude-code.yml reads workflow runs and job logs - contents: read - id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token - pull-requests: read # github_ci MCP server of claude-code-action in _claude-code.yml reads the pull request (pulls.get) - with: - mode: 'automation' - track_progress: false - allowed_tools: 'Read,Write,Edit,Glob,Grep,LS,,WebFetch,WebSearch,Bash(git:*),Bash(gh:*)' - prompt: | - # 🎯 AI-POWERED OPERATIONAL EXCELLENCE AUDIT - - **REPO**: ${{ github.repository }} - **DATE**: $(date -u +"%Y-%m-%d %H:%M UTC") - - ## Your Mission - - Perform weekly quality audit focusing on **human judgment** areas that automated - tools (Ruff, MyPy, PyRight, Codecov, SonarQube, etc.) cannot assess. - - Read and apply standards from: - - **CODE_STYLE.md** - Coding standards for humans and AI assistants - - **CONTRIBUTING.md** - Development workflow - - **OPERATIONAL_EXCELLENCE.md** - Toolchain overview - - **Best practices** - Research independently, using web search and loading web pages as needed - - Be critical, do never just rubber-stamp. - - Getting 5 stars must be challenging; look for subtle issues. - - Insist to raise the bar; aim for excellence in every aspect. - - Provide clear examples to illustrate your points; don't just state opinions. - - Apply radical candor in your feedback; care personally while challenging directly. - - Prioritize findings by impact on customer experience, maintainability, and security - - Ultrathink to find patterns and learnings; don't settle for surface-level observations. - - ## Audit Areas - - ### 1. Documentation Quality ⭐ PRIMARY - - **CLAUDE.md Files** - Find and review all dynamically: - ```bash - find . -name "CLAUDE.md" -type f - ``` - - For each file, assess: - - **Accuracy**: Does doc match code? Verify imports, signatures, examples - - **Clarity**: Can humans understand? Is context provided (why, not just what)? - - **Completeness**: Missing features? Outdated references? - - **Check for missing CLAUDE.md**: - ```bash - # Modules with _service.py but no CLAUDE.md - find src/aignostics -name "_service.py" -exec dirname {} \; | while read dir; do - [ ! -f "$dir/CLAUDE.md" ] && echo "Missing: $dir/CLAUDE.md" - done - ``` - - **Suggest new CLAUDE.md** where valuable (complex modules, integrations, etc.) - - **docs/partials/*.md** - Check narrative flow, working examples - - **Top-level docs** - CONTRIBUTING.md, CODE_STYLE.md, SECURITY.md accuracy - - ### 2. Docstring Quality - - Sample 10-20 docstrings from key modules. Assess meaningfulness: - - ❌ Vague: "Returns the result" - - ✅ Specific: "Returns Run with status 'pending', signed URLs valid 7 days" - - ### 3. Code Readability - - Review recent commits for human comprehension: - ```bash - git log --since="2 weeks ago" --name-only --pretty=format: | sort -u | grep "\.py$" - ``` - - Sample 5-10 files - check intent clarity, variable names, helpful comments - - ### 4. Architecture Consistency - - Verify modulith principles - do modules follow BaseService pattern? - - ### 5. Technical Debt Patterns - - ```bash - grep -rn "TODO\|FIXME\|HACK" src/ tests/ --include="*.py" - ``` - - Analyze by age (git blame), impact, patterns. Prioritize 3-5 items. - - ### 6. Meta-Improvements - - Suggest improvements to this workflow itself! Missing checks? Better approach? - - ## Output: Parent Issue + Branches - - ### Create Parent Issue - - ```bash - cat > /tmp/oe-report.md << 'EOF' - # 🤖 Operational Excellence - Weekly Quality Audit - - **Date**: $(date -u +"%Y-%m-%d") - **Commit**: $(git rev-parse --short HEAD) - - ## 🎯 Executive Summary - - [2-3 sentences overview] - - **Assessment**: 🟢 Excellent / 🟡 Good / 🟠 Needs Attention / 🔴 Critical - - ## 🏆 Quality Champions Leaderboard - - ### Top Contributors (Last 7 Days) - ```bash - git log --since="7 days ago" --pretty=format:"%an" | sort | uniq -c | sort -rn | head -5 - ``` - - 1. 🥇 **@contributor1** - [commits] commits, [quality score] - 2. 🥈 **@contributor2** - [commits] commits, [quality score] - 3. 🥉 **@contributor3** - [commits] commits, [quality score] - - ### 🎖️ Special Recognition - - **📚 Best Documentation**: @[name] - [specific achievement] - - **✨ Code Clarity Award**: @[name] - [specific example] - - **🏛️ Architecture Excellence**: @[name] - [what they did] - - **📈 Most Improved**: @[name] - [improvement metric] - - ### 📊 Team Stats - - Commits this week: [X] - - Quality score: [X]/10 (trend ↑↓) - - Technical debt: [X] TODOs (trend ↑↓) - - CLAUDE.md files: [X] (new: [Y]) - - ## 📋 Findings & Fix Branches - - For each finding below, a branch has been created. Review, create PR, merge, or close. - - ### 1️⃣ Documentation Issues - - - [ ] **Branch: `oe/fix-doc-module-x`** - CLAUDE.md accuracy issue - - File: `src/aignostics/module/CLAUDE.md:45` - - Issue: [specific problem] - - Fix: [what was changed] - - Commands: `git checkout oe/fix-doc-module-x` → review → create PR - - - [ ] **Branch: `oe/add-missing-claude-md`** - Missing CLAUDE.md - - Missing in: `src/aignostics/newmodule/` - - Rationale: [why needed] - - Commands: `git checkout oe/add-missing-claude-md` → review → create PR - - ### 2️⃣ Docstring Quality - - - [ ] **Branch: `oe/improve-docstrings-platform`** - Vague docstrings - - Files: [list] - - Before/After examples in branch - - Commands: `git checkout oe/improve-docstrings-platform` → review → create PR - - ### 3️⃣ Code Readability - - - [ ] **Discussion Needed** - Complex logic in `module/_file.py:123` - - Current: [description of issue] - - Suggestion: [how to improve] - - No branch (needs design discussion) - - ### 4️⃣ Architecture - - ✅ **All Good** - Modulith principles followed consistently - - ### 5️⃣ Technical Debt Priority - - 1. [ ] **Branch: `oe/fix-todo-auth-refresh`** - Auth token refresh (6mo old) - 2. [ ] **Branch: `oe/refactor-tile-processing`** - Recurring pattern (4 modules) - 3. [ ] **Discussion Needed** - [item requiring design decision] - - ### 6️⃣ Meta-Improvements - - Suggestions for this workflow: - - [ ] Add check for [X] - - [ ] Consider tool [Y] for [Z] - - [ ] Workflow could be improved by [...] - - ## 🎓 Kudos - - **Excellent Examples This Week**: - - `wsi._service.extract_tiles()` - Clear, well-documented, great naming - - `platform.CLAUDE.md` - Perfect module documentation template - - [Other positive examples] - - ## 📈 Trends - - - Documentation drift: [improving/stable/worsening] - - Code quality: [improving/stable/worsening] - - Team velocity: [metric] - - --- - *Next audit: [next Monday date]* - *Workflow: `.github/workflows/claude-code-automation-operational-excellence.yml`* - EOF - - gh issue create \ - --title "[OE Audit] $(date +%Y-%m-%d)" \ - --body-file /tmp/oe-report.md \ - --label "documentation,code-quality,automated-check" - ``` - - ### Create Fix Branches - - For **each actionable finding**, create a branch with the fix: - - ```bash - # Example: Fix CLAUDE.md in module X - git checkout -b oe/fix-doc-module-x main - # Make the fix (edit the file) - git add . - git commit -m "docs(module): fix CLAUDE.md accuracy issue - - - Corrected method signature documentation - - Updated example code - - Fixed import path - - Ref: [OE Audit] YYYY-MM-DD" - git push origin oe/fix-doc-module-x - - # Add link to issue body - echo "- Branch: oe/fix-doc-module-x" >> /tmp/branches.txt - ``` - - **Branch naming convention**: `oe/fix-{category}-{brief-desc}` - - `oe/fix-doc-*` - Documentation fixes - - `oe/improve-docstrings-*` - Docstring improvements - - `oe/refactor-*` - Code readability refactors - - `oe/add-*` - New documentation/files - - **Guidelines for branches**: - - Only create branches for **clear, mechanical fixes** - - Don't create branches for items needing discussion - - Each branch = one atomic fix - - Branch commit message references parent issue - - Push branches but **don't create PRs** (users will) - - ### If No Issues Found - - ```markdown - # ✅ Operational Excellence Audit - All Clear - - No significant issues detected this week! - - ## 🏆 Leaderboard - - [Include leaderboard anyway] - - ## 🎓 Highlights - - - [Something done especially well] - - [Great example to follow] - - Keep up the excellent work! 🎉 - - Next audit: [date] - ``` - - ## Important Guidelines - - 1. **Be constructive** - Frame as opportunities, not criticism - 2. **Be specific** - File:line references, before/after examples - 3. **Be pragmatic** - Focus on high-impact items - 4. **Be positive** - Always highlight good work (leaderboard, kudos) - 5. **Be actionable** - Clear steps to resolve each item - 6. **Be collaborative** - Users create PRs, you provide branches - - ## Medical Device Context - - Documentation quality = regulatory compliance = patient safety. - Be thorough on documentation accuracy - it's not just "nice to have". - - ## Meta - - Suggest improvements to this workflow! You're continuously learning what works. - - secrets: - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/claude-code-automation-pr-review.yml b/.github/workflows/claude-code-automation-pr-review.yml deleted file mode 100644 index 05b428db4..000000000 --- a/.github/workflows/claude-code-automation-pr-review.yml +++ /dev/null @@ -1,270 +0,0 @@ -name: "+ Claude Code / Automation / PR Review" - -on: - pull_request: - types: [opened, reopened, synchronize, ready_for_review, labeled] - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }} - cancel-in-progress: true - -jobs: - claude-review: - if: | - (github.event.action == 'labeled' && github.event.label.name == 'claude') || - (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'claude')) || - github.event.action == 'ready_for_review' - uses: ./.github/workflows/_claude-code.yml - permissions: - actions: read # github_ci MCP server of claude-code-action in _claude-code.yml reads workflow runs and job logs - contents: read - id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token - pull-requests: read # github_ci MCP server of claude-code-action in _claude-code.yml reads the pull request (pulls.get) - with: - mode: 'automation' - allowed_tools: 'mcp__github_inline_comment__create_inline_comment,Read,Write,Edit,MultiEdit,Glob,Grep,LS,WebFetch,WebSearch,Bash(git:*),Bash(bun:*),Bash(npm:*),Bash(npx:*),Bash(gh:*),Bash(uv:*),Bash(make:*)' - track_progress: ${{ github.event_name == 'pull_request' && contains(fromJSON('["opened", "synchronize", "ready_for_review", "reopened"]'), github.event.action) }} - use_sticky_comment: true - prompt: | - # PR REVIEW FOR AIGNOSTICS PYTHON SDK - - **REPO**: ${{ github.repository }} - **PR**: #${{ github.event.pull_request.number }} - **BRANCH**: ${{ github.head_ref }} - - ## Context - - This is a **medical device software SDK** for computational pathology. You are reviewing code that: - - Processes whole slide images (WSI) - gigapixel medical images - - Integrates with FDA/MDR regulated AI/ML applications - - Handles sensitive medical data (HIPAA compliance required) - - Follows a **modulith architecture** with strict module boundaries - - ## Documentation References - - **IMPORTANT**: This repository has comprehensive documentation you MUST reference: - - **CLAUDE.md** (root) - Architecture, testing workflow, development standards - - **.github/CLAUDE.md** - Complete CI/CD guide (19 workflows, test strategy) - - **src/aignostics/*/CLAUDE.md** - Module-specific implementation guides - - Read these files and apply their guidance throughout your review. - - ## CRITICAL CHECKS (BLOCKING - Must Pass) - - ### 1. Test Markers (CRITICAL!) - - **EVERY test MUST have at least one marker: `unit`, `integration`, or `e2e`** - - Tests without these markers will **NOT run in CI** because the pipeline explicitly filters by markers. - - ```bash - # Find unmarked tests (should return 0 tests): - uv run pytest -m "not unit and not integration and not e2e" --collect-only - - # If unmarked tests found, check the specific files changed in this PR: - uv run pytest tests/aignostics//_test.py --collect-only - ``` - - **Action if violations found**: - - List all test files missing markers with file paths and line numbers - - Provide exact decorator to add (e.g., `@pytest.mark.unit`) - - Reference `.github/CLAUDE.md` test categorization guide - - ### 2. Test Coverage (85% Minimum) - - If coverage drops below 85%, identify which new code lacks tests. - - ### 3. Code Quality (Must Pass) - - ```bash - # Check linting: - make lint - # Runs: ruff format, ruff check, pyright (basic), mypy (strict) - ``` - - All 4 checks must pass. If failures occur, provide specific fixes. - - ### 4. Conventional Commits - - All commits must follow: `type(scope): description` - - Valid types: `feat`, `fix`, `docs`, `refactor`, `test`, `chore`, `ci`, `perf`, `build` - - ```bash - # Check commit messages: - git log --oneline origin/main..HEAD - ``` - - ## Repository-Specific Review Areas - - ### 5. Architecture Compliance - - **Modulith Principles**: - - Each module is self-contained (Service + optional CLI + optional GUI) - - **CRITICAL**: CLI and GUI must NEVER depend on each other - - Both depend on Service layer only - - No circular dependencies between modules - - **Service Pattern**: - - All services inherit from `BaseService` (from `utils`) - - Must implement `health()` → `Health` and `info()` → `dict` - - Use dependency injection via `locate_implementations(BaseService)` - - No decorator-based DI - - **Check**: - ```bash - # Find all service implementations: - grep -r "class.*Service.*BaseService" src/aignostics/ - - # Check for circular imports: - # Look for cross-module imports that shouldn't exist - ``` - - ### 6. Testing Strategy - - **Test Categories** (see `.github/CLAUDE.md` for full details): - - `unit`: Isolated, no external deps, <10s timeout, sequential (XDIST_WORKER_FACTOR=0.0) - - `integration`: Mocked external services, <5min, limited parallel (0.2) - - `e2e`: Real API calls, staging environment, full parallel (1.0) - - `long_running`: E2E tests ≥5min, aggressive parallel (2.0), opt-out with label - - `very_long_running`: E2E tests ≥60min, only run when explicitly enabled - - **For new tests, verify**: - - Correct marker applied based on test characteristics - - Timeout set if >10s (use `@pytest.mark.timeout(60)`) - - E2E tests only run against staging (never production in PR CI) - - ### 7. Medical Device & Security - - **Check for**: - - Secrets/tokens in code or commits (use .env, never hardcode) - - Sensitive data masking in logs (use `mask_secrets=True`) - - Medical data handling (DICOM compliance, proper anonymization) - - OAuth token management (refresh before 5min expiry) - - **WSI Processing**: - - Large images processed in tiles (never load full image in memory) - - Proper cleanup of temp files - - Progress tracking for long operations - - ### 8. Breaking Changes - - **Check if PR introduces**: - - API client method signature changes - - CLI command changes (breaking user scripts) - - Environment variable changes - - Configuration file format changes - - OpenAPI model changes (from codegen) - - If breaking changes detected, verify: - - Proper deprecation warnings added - - Migration guide in PR description - - Version bump appropriate (major vs minor) - - ### 9. CI/CD Impact - - **If workflow files changed** (`.github/workflows/*.yml`): - - Verify syntax is correct - - Check reusable workflow inputs/secrets match - - Validate test marker filtering logic - - Ensure BetterStack heartbeats still work - - **If new tests added**: - - Are they categorized correctly for CI execution? - - Do they need to be scheduled tests? - - Is XDIST_WORKER_FACTOR appropriate? - - ### 10. Documentation Updates - - **If new features added**: - - Is CLAUDE.md updated? (root or module-specific) - - Are docstrings added (Google style)? - - Is README updated if user-facing change? - - Are type hints complete? - - ## Code Quality Standards - - - **Type Checking**: Dual checking (MyPy strict + PyRight basic) - both must pass - - **Line Length**: 120 chars max - - **Imports**: stdlib → 3rd-party → local, use relative imports within modules - - **Docstrings**: Google style for all public APIs - - **Error Handling**: Custom exceptions from `system/_exceptions.py` - - **Logging**: Structured logging via `get_logger(__name__)` - - ## Review Output Format - - For each issue found, provide: - - 1. **Location**: `file_path:line_number` (e.g., `src/aignostics/platform/_client.py:123`) - 2. **Issue**: Clear description with reference to CLAUDE.md section - 3. **Reproduce**: Exact command to reproduce (e.g., `uv run pytest tests/...`) - 4. **Fix**: Concrete code example or command - 5. **Verify**: Command to verify fix works (e.g., `make lint && make test`) - - **Use inline comments** for specific code issues. - **Use PR-level comment** for: - - Summary of findings (blocking vs suggestions) - - Overall architecture feedback - - Praise for excellent work - - Missing CLAUDE.md updates needed - - ## Final Steps - - After completing your review: - - 1. **Summarize findings** in PR comment using `gh pr comment` - 2. **Categorize issues**: Blocking (must fix) vs Suggestions (nice to have) - 3. **Provide commands** to fix all blocking issues in one go if possible - 4. **Reference documentation**: Link to relevant CLAUDE.md sections - - Use `gh pr comment` with your Bash tool to leave your comprehensive review as a comment on the PR. - - ## Machine-Readable Verdict (MANDATORY) - - After posting your review comment, you MUST emit a single-label verdict on the PR. This label is consumed by branch-protection rules to gate auto-merge — it is the only deterministic signal of your review outcome. - - **Verdict criteria** (all must hold for PASS): - - - No blocking findings under "CRITICAL CHECKS" — i.e. no missing test markers, no coverage drop below 85%, no `make lint` failures, no conventional-commit violations. - - No blocking architecture or security violations under "Repository-Specific Review Areas". - - Suggestions / nice-to-haves do NOT block the verdict. - - If any blocking finding remains: verdict is **FAIL**. - Otherwise: verdict is **PASS**. - - **Apply the label** (the two labels are mutually exclusive — always remove the opposite one): - - ```bash - # PASS: - gh pr edit ${{ github.event.pull_request.number }} \ - --add-label "claude:review:passed" \ - --remove-label "claude:review:failed" - - # FAIL: - gh pr edit ${{ github.event.pull_request.number }} \ - --add-label "claude:review:failed" \ - --remove-label "claude:review:passed" - ``` - - Note: `--remove-label` is a no-op if the label is not present, so it is safe to always include it. - - Also include the verdict as the final line of your sticky review comment, formatted exactly as: - - ``` - **Verdict**: ✅ claude:review:passed - ``` - - or - - ``` - **Verdict**: ❌ claude:review:failed - ``` - - This makes the verdict visible to humans without scrolling through all findings. - - --- - - **Remember**: This is medical device software. Insist on highest standards. Be thorough, actionable, and kind. - secrets: - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/.github/workflows/claude-code-interactive.yml b/.github/workflows/claude-code-interactive.yml deleted file mode 100644 index f1ab3078b..000000000 --- a/.github/workflows/claude-code-interactive.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: "+ Claude Code / Interactive" - -on: - issue_comment: - types: [created] - pull_request_review_comment: - types: [created] - issues: - types: [opened, assigned, labeled] - pull_request: - types: [opened, assigned, labeled] - pull_request_review: - types: [submitted] - workflow_dispatch: - -jobs: - claude: - if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) || - (github.event_name == 'pull_request' && (contains(github.event.pull_request.body, '@claude') || contains(github.event.pull_request.title, '@claude'))) || - github.event_name == 'workflow_dispatch' - uses: ./.github/workflows/_claude-code.yml - permissions: - actions: read # github_ci MCP server of claude-code-action in _claude-code.yml reads workflow runs and job logs - contents: read - id-token: write # anthropics/claude-code-action in _claude-code.yml exchanges the OIDC token for the Claude App token - pull-requests: read # github_ci MCP server of claude-code-action in _claude-code.yml reads the pull request (pulls.get) - with: - mode: 'interactive' - track_progress: ${{ github.event_name != 'workflow_dispatch' && true || false }} - secrets: - ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} diff --git a/CLAUDE.md b/CLAUDE.md index 74321bcd4..390ca38fe 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -912,7 +912,6 @@ gh pr edit --add-label "skip:test:long_running" * Security audit (~3 min) * Test matrix on Python 3.11, 3.12, 3.13, 3.14 (~15 min) * CodeQL security scanning (~10 min) -* Claude Code automated review (~10 min) * Ketryx compliance reporting **6. Address Review Feedback** @@ -1089,7 +1088,6 @@ make merge-release → push to main → full CI pipeline See [.github/CLAUDE.md](.github/CLAUDE.md) for comprehensive CI/CD documentation including: * Complete workflow architecture -* Claude Code automation (PR reviews, interactive sessions) * Environment configuration (staging/production) * Scheduled testing (6h staging, 24h production) * Debugging failed CI runs From 30ae03c662ef586dc408a347d09a987dc13726e7 Mon Sep 17 00:00:00 2001 From: Oliver Meyer Date: Fri, 13 Nov 2026 15:52:02 +0100 Subject: [PATCH 2/6] ci: remove BetterStack heartbeats and badge Drop the heartbeat steps of the scheduled tests and audit and the uptime badge, so that the five BETTERSTACK_* secrets can be deleted. Co-Authored-By: Claude Opus 5.5 --- .github/CLAUDE.md | 27 +++---- .github/workflows/_scheduled-audit.yml | 54 +------------- .github/workflows/_scheduled-test-daily.yml | 70 +------------------ .github/workflows/_scheduled-test-hourly.yml | 48 ------------- .github/workflows/scheduled-audit-hourly.yml | 2 - .../scheduled-testing-production-daily.yml | 2 - .../scheduled-testing-production-hourly.yml | 2 - .../scheduled-testing-staging-daily.yml | 2 - .../scheduled-testing-staging-hourly.yml | 2 - README.md | 1 - docs/partials/README_header.md | 1 - 11 files changed, 11 insertions(+), 200 deletions(-) diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md index ea1bf0ddc..0d934b400 100644 --- a/.github/CLAUDE.md +++ b/.github/CLAUDE.md @@ -120,22 +120,13 @@ Output: `aignostics.7z` per platform. Local: `make dist_native`. - **Testing** — staging and production each run **hourly** (`0 * * * *`, via `_scheduled-test-hourly.yml`) and **daily at 12:00 UTC** (`0 12 * * *`, via - `_scheduled-test-daily.yml`). Run `make test_scheduled`, send a BetterStack - heartbeat. Staging → `https://platform-staging.aignostics.com`, production → - `https://platform.aignostics.com`. + `_scheduled-test-daily.yml`). Run `make test_scheduled`, send a Sentry cron + monitor check-in. Staging → `https://platform-staging.aignostics.com`, + production → `https://platform.aignostics.com`. - **Audit** — hourly (`_scheduled-audit.yml`): `pip-audit`, `pip-licenses`, - Trivy SBOM scan + BetterStack heartbeat. + Trivy SBOM scan. - **CodeQL** — weekly Tue 03:22 (`_codeql.yml`). -### BetterStack heartbeats - -Scheduled test/audit jobs POST a metadata JSON payload to -`{HEARTBEAT_URL}/{EXIT_CODE}` (0 = success) so BetterStack alerts on failures or -missed beats. If the URL secret is unset the step logs a warning and continues. -Secrets: `BETTERSTACK_AUDIT_HEARTBEAT_URL`, -`BETTERSTACK_HEARTBEAT_URL_{STAGING,PRODUCTION}` (hourly), -`BETTERSTACK_HEARTBEAT_URL_FLOWS_{STAGING,PRODUCTION}` (daily). - ## Environments & secrets **Staging** (`platform-staging.aignostics.com`) is the default for all PR CI and @@ -143,9 +134,9 @@ E2E. **Production** (`platform.aignostics.com`) is used only by scheduled jobs and release validation — never in PR CI. GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, -`AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, the BetterStack URLs above, -`CODECOV_TOKEN`, `SONAR_TOKEN`, `SENTRY_DSN`/`SENTRY_AUTH_TOKEN`, -`UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`/`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`. +`AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`, `SONAR_TOKEN`, +`SENTRY_DSN`, `SENTRY_AUTH_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, +`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`. Local `.env` for E2E: @@ -176,8 +167,8 @@ can push. Reproduce locally with the same make targets CI uses: `make lint`, `make test_unit` / `test_integration` / `test_e2e` (E2E needs `.env`), `make dist_native`, `uv run pip-audit`. Coverage minimum is enforced via -Codecov (see `codecov.yml`). For scheduled-job failures, check the BetterStack -dashboard and the workflow run logs (usual causes: API changes in the target +Codecov (see `codecov.yml`). For scheduled-job failures, check the Sentry cron +monitors and the workflow run logs (usual causes: API changes in the target environment, expired credentials). Run scheduled workflows manually: diff --git a/.github/workflows/_scheduled-audit.yml b/.github/workflows/_scheduled-audit.yml index 237e788ab..6328a0c66 100644 --- a/.github/workflows/_scheduled-audit.yml +++ b/.github/workflows/_scheduled-audit.yml @@ -2,9 +2,6 @@ name: "> Scheduled Audit (Hourly)" on: workflow_call: - secrets: - BETTERSTACK_AUDIT_HEARTBEAT_URL: - required: false jobs: audit-scheduled: @@ -34,56 +31,7 @@ jobs: - name: Audit shell: bash - env: - BETTERSTACK_AUDIT_HEARTBEAT_URL: "${{ secrets.BETTERSTACK_AUDIT_HEARTBEAT_URL }}" - run: | - set +e - make audit - EXIT_CODE=$? - # Provide heartbeat to BetterStack for monitoring/alerting if heartbeat url is configured as secret - if [ -n "$BETTERSTACK_AUDIT_HEARTBEAT_URL" ]; then - BETTERSTACK_METADATA_PAYLOAD=$(jq -n \ - --arg github_workflow "${{ github.workflow }}" \ - --arg github_run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \ - --arg github_run_id "${{ github.run_id }}" \ - --arg github_job "${{ github.job }}" \ - --arg github_sha "${{ github.sha }}" \ - --arg github_actor "${{ github.actor }}" \ - --arg github_repository "${{ github.repository }}" \ - --arg github_ref "${{ github.ref }}" \ - --arg job_status "${{ job.status }}" \ - --arg github_event_name "${{ github.event_name }}" \ - --arg timestamp "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ - '{ - github: { - workflow: $github_workflow, - run_url: $github_run_url, - run_id: $github_run_id, - job: $github_job, - sha: $github_sha, - actor: $github_actor, - repository: $github_repository, - ref: $github_ref, - event_name: $github_event_name - }, - job: { - status: $job_status, - }, - timestamp: $timestamp, - }' - ) - curl \ - --fail-with-body \ - --silent \ - --request POST \ - --header "Content-Type: application/json" \ - --data-binary "${BETTERSTACK_METADATA_PAYLOAD}" \ - "${BETTERSTACK_AUDIT_HEARTBEAT_URL}/${EXIT_CODE}" - echo "INFO: Sent heartbeat to betterstack with exit code '${EXIT_CODE}'" - else - echo "WARNING: No BetterStack heartbeat URL configured, skipped heartbeat notification." - fi - exit $EXIT_CODE + run: make audit - name: Upload test results uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 diff --git a/.github/workflows/_scheduled-test-daily.yml b/.github/workflows/_scheduled-test-daily.yml index e550f2f6c..b0e659904 100644 --- a/.github/workflows/_scheduled-test-daily.yml +++ b/.github/workflows/_scheduled-test-daily.yml @@ -13,14 +13,10 @@ on: required: true AIGNOSTICS_REFRESH_TOKEN_STAGING: required: true - BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING: - required: true AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true - BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION: - required: true CODECOV_TOKEN: required: true SONAR_TOKEN: @@ -237,78 +233,14 @@ jobs: - name: Heartbeat if: always() env: - BETTERSTACK_HEARTBEAT_URL: "${{ inputs.platform_environment == 'staging' && secrets.BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING || secrets.BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION }}" SENTRY_DSN: ${{ secrets.SENTRY_DSN }} shell: bash run: | EXIT_CODE=${{ steps.test-status.outputs.exit_code }} - FAILED_TESTS="${{ steps.test-status.outputs.failed_tests }}" - + # Send heartbeat to Sentry, defining the schedule on the fly SENTRY_EXIT_CODE=$(sentry-cli monitors run -e CI --schedule "0 12 * * *" --check-in-margin 30 --max-runtime 1 scheduled-testing-${{ inputs.platform_environment }}-hourly --timezone "Europe/Berlin" -- sh -c "exit $EXIT_CODE") - # Provide heartbeat to BetterStack for monitoring/alerting if heartbeat url is configured as secret - if [ -n "$BETTERSTACK_HEARTBEAT_URL" ]; then - BETTERSTACK_METADATA_PAYLOAD=$(jq -n \ - --arg github_workflow "${{ github.workflow }}" \ - --arg github_run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \ - --arg github_run_id "${{ github.run_id }}" \ - --arg github_job "${{ github.job }}" \ - --arg github_sha "${{ github.sha }}" \ - --arg github_actor "${{ github.actor }}" \ - --arg github_repository "${{ github.repository }}" \ - --arg github_ref "${{ github.ref }}" \ - --arg job_status "${{ job.status }}" \ - --arg github_event_name "${{ github.event_name }}" \ - --arg timestamp "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ - --arg failed_tests "${FAILED_TESTS}" \ - --arg validate_status "${{ steps.validate.outcome }}" \ - --arg smoke_status "${{ steps.smoke.outcome }}" \ - --arg unit_status "${{ steps.unit.outcome }}" \ - --arg integration_status "${{ steps.integration.outcome }}" \ - --arg e2e_regular_status "${{ steps.e2e-regular.outcome }}" \ - --arg e2e_long_running_status "${{ steps.e2e-long-running.outcome }}" \ - --arg e2e_very_long_running_status "${{ steps.e2e-very-long-running.outcome }}" \ - '{ - github: { - workflow: $github_workflow, - run_url: $github_run_url, - run_id: $github_run_id, - job: $github_job, - sha: $github_sha, - actor: $github_actor, - repository: $github_repository, - ref: $github_ref, - event_name: $github_event_name - }, - job: { - status: $job_status, - }, - tests: { - failed: $failed_tests, - validation: $validate_status, - smoke: $smoke_status, - unit: $unit_status, - integration: $integration_status, - e2e_regular: $e2e_regular_status, - e2e_long_runnin: $e2e_long_running_status, - e2e_very_long_running: $e2e_very_long_running_status - }, - timestamp: $timestamp, - }' - ) - curl \ - --fail-with-body \ - --silent \ - --request POST \ - --header "Content-Type: application/json" \ - --data-binary "${BETTERSTACK_METADATA_PAYLOAD}" \ - "${BETTERSTACK_HEARTBEAT_URL}/${EXIT_CODE}" - echo "INFO: Sent heartbeat to betterstack with exit code '${EXIT_CODE}' and failed tests: '${FAILED_TESTS}'" - else - echo "WARNING: No BetterStack heartbeat URL configured, skipped heartbeat notification." - fi - - name: Upload coverage reports to Codecov uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT')}} diff --git a/.github/workflows/_scheduled-test-hourly.yml b/.github/workflows/_scheduled-test-hourly.yml index 7464867df..4a10faaea 100644 --- a/.github/workflows/_scheduled-test-hourly.yml +++ b/.github/workflows/_scheduled-test-hourly.yml @@ -18,14 +18,10 @@ on: required: true AIGNOSTICS_REFRESH_TOKEN_STAGING: required: true - BETTERSTACK_HEARTBEAT_URL_STAGING: - required: true AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true - BETTERSTACK_HEARTBEAT_URL_PRODUCTION: - required: true SENTRY_DSN: required: true @@ -79,7 +75,6 @@ jobs: - name: Test / scheduled env: - BETTERSTACK_HEARTBEAT_URL: "${{ inputs.platform_environment == 'staging' && secrets.BETTERSTACK_HEARTBEAT_URL_STAGING || secrets.BETTERSTACK_HEARTBEAT_URL_PRODUCTION }}" SENTRY_DSN: ${{ secrets.SENTRY_DSN }} shell: bash run: | @@ -111,49 +106,6 @@ jobs: # Send heartbeat to Sentry, defining the schedule on the fly SENTRY_EXIT_CODE=$(sentry-cli monitors run -e CI --schedule "0 * * * *" --check-in-margin 30 --max-runtime 1 scheduled-testing-${{ inputs.platform_environment }}-hourly --timezone "Europe/Berlin" -- sh -c "exit $EXIT_CODE") - # Provide heartbeat to BetterStack for monitoring/alerting if heartbeat url is configured as secret - if [ -n "$BETTERSTACK_HEARTBEAT_URL" ]; then - BETTERSTACK_METADATA_PAYLOAD=$(jq -n \ - --arg github_workflow "${{ github.workflow }}" \ - --arg github_run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \ - --arg github_run_id "${{ github.run_id }}" \ - --arg github_job "${{ github.job }}" \ - --arg github_sha "${{ github.sha }}" \ - --arg github_actor "${{ github.actor }}" \ - --arg github_repository "${{ github.repository }}" \ - --arg github_ref "${{ github.ref }}" \ - --arg job_status "${{ job.status }}" \ - --arg github_event_name "${{ github.event_name }}" \ - --arg timestamp "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \ - '{ - github: { - workflow: $github_workflow, - run_url: $github_run_url, - run_id: $github_run_id, - job: $github_job, - sha: $github_sha, - actor: $github_actor, - repository: $github_repository, - ref: $github_ref, - event_name: $github_event_name - }, - job: { - status: $job_status, - }, - timestamp: $timestamp, - }' - ) - curl \ - --fail-with-body \ - --silent \ - --request POST \ - --header "Content-Type: application/json" \ - --data-binary "${BETTERSTACK_METADATA_PAYLOAD}" \ - "${BETTERSTACK_HEARTBEAT_URL}/${EXIT_CODE}" - echo "INFO: Sent heartbeat to betterstack with exit code '${EXIT_CODE}'" - else - echo "WARNING: No BetterStack heartbeat URL configured, skipped heartbeat notification." - fi exit $EXIT_CODE - name: Upload test results diff --git a/.github/workflows/scheduled-audit-hourly.yml b/.github/workflows/scheduled-audit-hourly.yml index fdc5434d6..745dba507 100644 --- a/.github/workflows/scheduled-audit-hourly.yml +++ b/.github/workflows/scheduled-audit-hourly.yml @@ -16,5 +16,3 @@ jobs: uses: ./.github/workflows/_scheduled-audit.yml permissions: contents: read - secrets: - BETTERSTACK_AUDIT_HEARTBEAT_URL: ${{ secrets.BETTERSTACK_AUDIT_HEARTBEAT_URL }} diff --git a/.github/workflows/scheduled-testing-production-daily.yml b/.github/workflows/scheduled-testing-production-daily.yml index 2c273176e..fea333d0d 100644 --- a/.github/workflows/scheduled-testing-production-daily.yml +++ b/.github/workflows/scheduled-testing-production-daily.yml @@ -22,10 +22,8 @@ jobs: secrets: AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/scheduled-testing-production-hourly.yml b/.github/workflows/scheduled-testing-production-hourly.yml index 4dbc13d93..3122b46c5 100644 --- a/.github/workflows/scheduled-testing-production-hourly.yml +++ b/.github/workflows/scheduled-testing-production-hourly.yml @@ -21,8 +21,6 @@ jobs: secrets: AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - BETTERSTACK_HEARTBEAT_URL_STAGING: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - BETTERSTACK_HEARTBEAT_URL_PRODUCTION: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_PRODUCTION }} SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/scheduled-testing-staging-daily.yml b/.github/workflows/scheduled-testing-staging-daily.yml index b598f6ada..e488cda6d 100644 --- a/.github/workflows/scheduled-testing-staging-daily.yml +++ b/.github/workflows/scheduled-testing-staging-daily.yml @@ -22,10 +22,8 @@ jobs: secrets: AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_FLOWS_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_FLOWS_PRODUCTION }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/scheduled-testing-staging-hourly.yml b/.github/workflows/scheduled-testing-staging-hourly.yml index 81edbe3cb..95ed7fc42 100644 --- a/.github/workflows/scheduled-testing-staging-hourly.yml +++ b/.github/workflows/scheduled-testing-staging-hourly.yml @@ -21,8 +21,6 @@ jobs: secrets: AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - BETTERSTACK_HEARTBEAT_URL_STAGING: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - BETTERSTACK_HEARTBEAT_URL_PRODUCTION: ${{ secrets.BETTERSTACK_HEARTBEAT_URL_PRODUCTION }} SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/README.md b/README.md index 6d7d48318..b33bbd700 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,6 @@ [![Security](https://sonarcloud.io/api/project_badges/measure?project=aignostics_python-sdk&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=aignostics_python-sdk) [![Maintainability](https://sonarcloud.io/api/project_badges/measure?project=aignostics_python-sdk&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=aignostics_python-sdk) [![Coverage](https://codecov.io/gh/aignostics/python-sdk/graph/badge.svg?token=SX34YRP30E)](https://codecov.io/gh/aignostics/python-sdk) -[![Uptime](https://uptime.betterstack.com/status-badges/v2/monitor/1wbqa.svg)](https://aignostics.betteruptime.com) ## Introduction diff --git a/docs/partials/README_header.md b/docs/partials/README_header.md index 7d6b2d8dd..79972cfdc 100644 --- a/docs/partials/README_header.md +++ b/docs/partials/README_header.md @@ -21,4 +21,3 @@ [![Security](https://sonarcloud.io/api/project_badges/measure?project=aignostics_python-sdk&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=aignostics_python-sdk) [![Maintainability](https://sonarcloud.io/api/project_badges/measure?project=aignostics_python-sdk&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=aignostics_python-sdk) [![Coverage](https://codecov.io/gh/aignostics/python-sdk/graph/badge.svg?token=SX34YRP30E)](https://codecov.io/gh/aignostics/python-sdk) -[![Uptime](https://uptime.betterstack.com/status-badges/v2/monitor/1wbqa.svg)](https://aignostics.betteruptime.com) From f14259f8364ef60a93018a8cba58c77fe417d929 Mon Sep 17 00:00:00 2001 From: Oliver Meyer Date: Fri, 13 Nov 2026 15:52:11 +0100 Subject: [PATCH 3/6] ci: remove Sentry cron monitor check-ins Drop the Sentry check-ins of the scheduled tests, the Sentry settings in the test .env files and the sentry-cli install, so that SENTRY_DSN can be deleted. A later step still fails the daily job on test failures. Allowlist the two Trivy checksums that detect-secrets flags. Co-Authored-By: Claude Opus 5.5 --- .github/CLAUDE.md | 16 +++++++-------- .github/workflows/_install_dev_tools.bash | 8 ++------ .github/workflows/_scheduled-test-daily.yml | 20 ------------------- .github/workflows/_scheduled-test-hourly.yml | 14 ------------- .github/workflows/_scheduled-test-stress.yml | 9 --------- .github/workflows/_test.yml | 9 --------- .github/workflows/ci-cd.yml | 1 - .../scheduled-testing-production-daily.yml | 1 - .../scheduled-testing-production-hourly.yml | 1 - .../scheduled-testing-staging-daily.yml | 1 - .../scheduled-testing-staging-hourly.yml | 1 - .../stress-testing-staging.yml.paused | 1 - 12 files changed, 10 insertions(+), 72 deletions(-) diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md index 0d934b400..984f4a058 100644 --- a/.github/CLAUDE.md +++ b/.github/CLAUDE.md @@ -120,9 +120,9 @@ Output: `aignostics.7z` per platform. Local: `make dist_native`. - **Testing** — staging and production each run **hourly** (`0 * * * *`, via `_scheduled-test-hourly.yml`) and **daily at 12:00 UTC** (`0 12 * * *`, via - `_scheduled-test-daily.yml`). Run `make test_scheduled`, send a Sentry cron - monitor check-in. Staging → `https://platform-staging.aignostics.com`, - production → `https://platform.aignostics.com`. + `_scheduled-test-daily.yml`) and run `make test_scheduled`. Staging → + `https://platform-staging.aignostics.com`, production → + `https://platform.aignostics.com`. - **Audit** — hourly (`_scheduled-audit.yml`): `pip-audit`, `pip-licenses`, Trivy SBOM scan. - **CodeQL** — weekly Tue 03:22 (`_codeql.yml`). @@ -135,8 +135,8 @@ and release validation — never in PR CI. GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`, `SONAR_TOKEN`, -`SENTRY_DSN`, `SENTRY_AUTH_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, -`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`. +`SENTRY_AUTH_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, `KETRYX_API_KEY`, +`SLACK_*_RELEASE_ANNOUNCEMENT`. Local `.env` for E2E: @@ -167,9 +167,9 @@ can push. Reproduce locally with the same make targets CI uses: `make lint`, `make test_unit` / `test_integration` / `test_e2e` (E2E needs `.env`), `make dist_native`, `uv run pip-audit`. Coverage minimum is enforced via -Codecov (see `codecov.yml`). For scheduled-job failures, check the Sentry cron -monitors and the workflow run logs (usual causes: API changes in the target -environment, expired credentials). +Codecov (see `codecov.yml`). For scheduled-job failures, check the workflow run +logs (usual causes: API changes in the target environment, expired +credentials). Run scheduled workflows manually: diff --git a/.github/workflows/_install_dev_tools.bash b/.github/workflows/_install_dev_tools.bash index bf5149087..1215673bf 100755 --- a/.github/workflows/_install_dev_tools.bash +++ b/.github/workflows/_install_dev_tools.bash @@ -26,11 +26,11 @@ TRIVY_VERSION=v0.76.1 case "$(uname -m)" in x86_64) trivy_arch="64bit" - TRIVY_SHA256="c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0" # trivy_0.76.1_Linux-64bit.tar.gz + TRIVY_SHA256="c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0" # trivy_0.76.1_Linux-64bit.tar.gz # pragma: allowlist secret ;; aarch64 | arm64) trivy_arch="ARM64" - TRIVY_SHA256="e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f" # trivy_0.76.1_Linux-ARM64.tar.gz + TRIVY_SHA256="e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f" # trivy_0.76.1_Linux-ARM64.tar.gz # pragma: allowlist secret ;; *) echo "No Trivy checksum for architecture $(uname -m)" >&2 @@ -47,10 +47,6 @@ sudo install -m 0755 "${trivy_tmp}/trivy" /usr/local/bin/trivy rm -rf "${trivy_tmp}" trivy --version -# Install further tools not project specific -# Download Sentry CLI securely: enforce HTTPS, disable redirects -wget --secure-protocol=TLSv1_2 --max-redirect=0 -qO - https://sentry.io/get-cli/ | SENTRY_CLI_VERSION="2.57.0" sh - # Install project specific tools .github/workflows/_install_dev_tools_project.bash diff --git a/.github/workflows/_scheduled-test-daily.yml b/.github/workflows/_scheduled-test-daily.yml index b0e659904..30bf597ee 100644 --- a/.github/workflows/_scheduled-test-daily.yml +++ b/.github/workflows/_scheduled-test-daily.yml @@ -21,8 +21,6 @@ on: required: true SONAR_TOKEN: required: true - SENTRY_DSN: - required: true env: # https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15 @@ -75,13 +73,6 @@ jobs: envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - envkey_AIGNOSTICS_SENTRY_ENABLED: true - envkey_AIGNOSTICS_SENTRY_DSN: ${{ secrets.SENTRY_DSN}} - envkey_AIGNOSTICS_SENTRY_DEBUG: false - envkey_AIGNOSTICS_SENTRY_SEND_DEFAULT_PII: false - envkey_AIGNOSTICS_SENTRY_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_TRACES_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_PROFILES_SAMPLE_RATE: 0 fail_on_empty: false - name: Validate installation (single Python version) @@ -230,17 +221,6 @@ jobs: echo "❌ Failed test types: ${FAILED_LIST}" >> $GITHUB_STEP_SUMMARY fi - - name: Heartbeat - if: always() - env: - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} - shell: bash - run: | - EXIT_CODE=${{ steps.test-status.outputs.exit_code }} - - # Send heartbeat to Sentry, defining the schedule on the fly - SENTRY_EXIT_CODE=$(sentry-cli monitors run -e CI --schedule "0 12 * * *" --check-in-margin 30 --max-runtime 1 scheduled-testing-${{ inputs.platform_environment }}-hourly --timezone "Europe/Berlin" -- sh -c "exit $EXIT_CODE") - - name: Upload coverage reports to Codecov uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT')}} diff --git a/.github/workflows/_scheduled-test-hourly.yml b/.github/workflows/_scheduled-test-hourly.yml index 4a10faaea..3fba62fc0 100644 --- a/.github/workflows/_scheduled-test-hourly.yml +++ b/.github/workflows/_scheduled-test-hourly.yml @@ -22,8 +22,6 @@ on: required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true - SENTRY_DSN: - required: true env: # https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15 @@ -64,18 +62,9 @@ jobs: envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - envkey_AIGNOSTICS_SENTRY_ENABLED: true - envkey_AIGNOSTICS_SENTRY_DSN: ${{ secrets.SENTRY_DSN}} - envkey_AIGNOSTICS_SENTRY_DEBUG: false - envkey_AIGNOSTICS_SENTRY_SEND_DEFAULT_PII: false - envkey_AIGNOSTICS_SENTRY_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_TRACES_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_PROFILES_SAMPLE_RATE: 0 fail_on_empty: false - name: Test / scheduled - env: - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} shell: bash run: | set +e @@ -103,9 +92,6 @@ jobs: echo "" >> $GITHUB_STEP_SUMMARY fi - # Send heartbeat to Sentry, defining the schedule on the fly - SENTRY_EXIT_CODE=$(sentry-cli monitors run -e CI --schedule "0 * * * *" --check-in-margin 30 --max-runtime 1 scheduled-testing-${{ inputs.platform_environment }}-hourly --timezone "Europe/Berlin" -- sh -c "exit $EXIT_CODE") - exit $EXIT_CODE - name: Upload test results diff --git a/.github/workflows/_scheduled-test-stress.yml b/.github/workflows/_scheduled-test-stress.yml index a318bc2af..d2ce5df94 100644 --- a/.github/workflows/_scheduled-test-stress.yml +++ b/.github/workflows/_scheduled-test-stress.yml @@ -22,8 +22,6 @@ on: required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true - SENTRY_DSN: - required: true env: # https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15 @@ -64,13 +62,6 @@ jobs: envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - envkey_AIGNOSTICS_SENTRY_ENABLED: true - envkey_AIGNOSTICS_SENTRY_DSN: ${{ secrets.SENTRY_DSN}} - envkey_AIGNOSTICS_SENTRY_DEBUG: false - envkey_AIGNOSTICS_SENTRY_SEND_DEFAULT_PII: false - envkey_AIGNOSTICS_SENTRY_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_TRACES_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_PROFILES_SAMPLE_RATE: 0 fail_on_empty: false - name: Test / stress diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index 2403c0034..6e19bffe8 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -25,8 +25,6 @@ on: required: false SONAR_TOKEN: required: false - SENTRY_DSN: - required: false env: # https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15 @@ -114,13 +112,6 @@ jobs: envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - envkey_AIGNOSTICS_SENTRY_ENABLED: true - envkey_AIGNOSTICS_SENTRY_DSN: ${{ secrets.SENTRY_DSN}} - envkey_AIGNOSTICS_SENTRY_DEBUG: false - envkey_AIGNOSTICS_SENTRY_SEND_DEFAULT_PII: false - envkey_AIGNOSTICS_SENTRY_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_TRACES_SAMPLE_RATE: 0 - envkey_AIGNOSTICS_SENTRY_PROFILES_SAMPLE_RATE: 0 fail_on_empty: false - name: Validate installation (single Python version) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 7fa9ba8b5..181beab9d 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -133,7 +133,6 @@ jobs: AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics codeql: needs: [get-commit-message] diff --git a/.github/workflows/scheduled-testing-production-daily.yml b/.github/workflows/scheduled-testing-production-daily.yml index fea333d0d..49fc98923 100644 --- a/.github/workflows/scheduled-testing-production-daily.yml +++ b/.github/workflows/scheduled-testing-production-daily.yml @@ -26,4 +26,3 @@ jobs: AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/scheduled-testing-production-hourly.yml b/.github/workflows/scheduled-testing-production-hourly.yml index 3122b46c5..7dc203464 100644 --- a/.github/workflows/scheduled-testing-production-hourly.yml +++ b/.github/workflows/scheduled-testing-production-hourly.yml @@ -23,4 +23,3 @@ jobs: AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/scheduled-testing-staging-daily.yml b/.github/workflows/scheduled-testing-staging-daily.yml index e488cda6d..93164ef24 100644 --- a/.github/workflows/scheduled-testing-staging-daily.yml +++ b/.github/workflows/scheduled-testing-staging-daily.yml @@ -26,4 +26,3 @@ jobs: AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/scheduled-testing-staging-hourly.yml b/.github/workflows/scheduled-testing-staging-hourly.yml index 95ed7fc42..b8bab038c 100644 --- a/.github/workflows/scheduled-testing-staging-hourly.yml +++ b/.github/workflows/scheduled-testing-staging-hourly.yml @@ -23,4 +23,3 @@ jobs: AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat diff --git a/.github/workflows/stress-testing-staging.yml.paused b/.github/workflows/stress-testing-staging.yml.paused index e4ed509b5..8dc7eed39 100644 --- a/.github/workflows/stress-testing-staging.yml.paused +++ b/.github/workflows/stress-testing-staging.yml.paused @@ -23,4 +23,3 @@ jobs: AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} - SENTRY_DSN: ${{ secrets.SENTRY_DSN }} # For metrics and heartbeat From ad3f32c4ab17851495469ca109681e9dbdcad333 Mon Sep 17 00:00:00 2001 From: Oliver Meyer Date: Fri, 13 Nov 2026 15:52:20 +0100 Subject: [PATCH 4/6] ci: remove Sentry release step The SDK gets no further releases, so SENTRY_AUTH_TOKEN and the SENTRY_ORG and SENTRY_PROJECT variables can be deleted. Co-Authored-By: Claude Opus 5.5 --- .github/CLAUDE.md | 2 +- .github/workflows/_package-publish.yml | 12 ------------ .github/workflows/actions.lock | 13 ------------- .github/workflows/ci-cd.yml | 1 - 4 files changed, 1 insertion(+), 27 deletions(-) diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md index 984f4a058..f1f34b6d8 100644 --- a/.github/CLAUDE.md +++ b/.github/CLAUDE.md @@ -135,7 +135,7 @@ and release validation — never in PR CI. GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`, `SONAR_TOKEN`, -`SENTRY_AUTH_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, `KETRYX_API_KEY`, +`UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, `KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`. Local `.env` for E2E: diff --git a/.github/workflows/_package-publish.yml b/.github/workflows/_package-publish.yml index fb5883d94..2b437d49d 100644 --- a/.github/workflows/_package-publish.yml +++ b/.github/workflows/_package-publish.yml @@ -14,8 +14,6 @@ on: required: true SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT: required: true - SENTRY_AUTH_TOKEN: - required: true env: # https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15 @@ -222,16 +220,6 @@ jobs: gh release create "$GH_REF_NAME" ./dist/* ./dist_native_zipped/* ./audit-results/* \ --notes-file "$GIT_CLIFF_CHANGELOG" - - name: Inform Sentry about release - uses: getsentry/action-release@6fb9aeade7061441cf3864e34fbe11a1457ad7dc # v3.7.1 - env: - SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} - SENTRY_ORG: ${{ vars.SENTRY_ORG }} - SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT }} - with: - environment: production - release: ${{ github.ref_name }} - - name: Convert release notes from Markdown to Slack mrkdwn shell: bash env: diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 05cbe7a6f..0426bf4c9 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -29,7 +29,6 @@ workflows: - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884' - - 'getsentry/action-release@6fb9aeade7061441cf3864e34fbe11a1457ad7dc' - 'orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff' - 'slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d' '.github/workflows/_scheduled-audit.yml': @@ -108,11 +107,6 @@ dependencies: commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd' owner_id: 44036562 repo_id: 205262760 - 'actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f': - ref: 'v6.3.0' - commit: 'sha1-53b83947a5a98c8d113130e565377fae1a50d02f' - owner_id: 44036562 - repo_id: 189476904 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9': ref: 'v7.0.2' commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' @@ -140,13 +134,6 @@ dependencies: commit: 'sha1-548a7c3603594ec17c819e1239f281a3b801ab4d' owner_id: 1951866 repo_id: 216050313 - 'getsentry/action-release@6fb9aeade7061441cf3864e34fbe11a1457ad7dc': - ref: 'v3.7.1' - commit: 'sha1-6fb9aeade7061441cf3864e34fbe11a1457ad7dc' - owner_id: 1396951 - repo_id: 273043452 - uses: - - 'actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f' 'github/codeql-action@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee': ref: 'v4.39.0' commit: 'sha1-6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee' diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 181beab9d..199879ac3 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -197,4 +197,3 @@ jobs: UV_PUBLISH_TOKEN: ${{ secrets.UV_PUBLISH_TOKEN }} SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT: ${{ secrets.SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT }} SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT: ${{ secrets.SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT }} - SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} From f8cd2ade7a09768a613d7086f7e2a21aa2a2ed1a Mon Sep 17 00:00:00 2001 From: Oliver Meyer Date: Fri, 13 Nov 2026 15:52:28 +0100 Subject: [PATCH 5/6] ci: remove Slack release announcement The SDK gets no further releases, so the Slack webhook and channel ID secrets can be deleted. Co-Authored-By: Claude Opus 5.5 --- .github/CLAUDE.md | 3 +-- .github/workflows/_package-publish.yml | 36 -------------------------- .github/workflows/actions.lock | 6 ----- .github/workflows/ci-cd.yml | 2 -- 4 files changed, 1 insertion(+), 46 deletions(-) diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md index f1f34b6d8..9bde3c60e 100644 --- a/.github/CLAUDE.md +++ b/.github/CLAUDE.md @@ -135,8 +135,7 @@ and release validation — never in PR CI. GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`, `SONAR_TOKEN`, -`UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, `KETRYX_API_KEY`, -`SLACK_*_RELEASE_ANNOUNCEMENT`. +`UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, `KETRYX_API_KEY`. Local `.env` for E2E: diff --git a/.github/workflows/_package-publish.yml b/.github/workflows/_package-publish.yml index 2b437d49d..259ecfa6e 100644 --- a/.github/workflows/_package-publish.yml +++ b/.github/workflows/_package-publish.yml @@ -10,10 +10,6 @@ on: secrets: UV_PUBLISH_TOKEN: required: true - SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT: - required: true - SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT: - required: true env: # https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15 @@ -220,38 +216,6 @@ jobs: gh release create "$GH_REF_NAME" ./dist/* ./dist_native_zipped/* ./audit-results/* \ --notes-file "$GIT_CLIFF_CHANGELOG" - - name: Convert release notes from Markdown to Slack mrkdwn - shell: bash - env: - GIT_CLIFF_CONTENT: ${{ steps.git-cliff.outputs.content }} - run: | - # Convert Markdown links [text](url) to Slack mrkdwn - # Convert bold **text** to *text* - NOTES_CONVERTED=$(printf '%s\n' "$GIT_CLIFF_CONTENT" | \ - sed -E 's/\[([^]]+)\]\(([^)]+)\)/<\2|\1>/g' | \ - sed -E 's/\*\*([^*]+)\*\*/*\1*/g') - RELEASE_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}" - if [ "$(printf '%s' "$NOTES_CONVERTED" | wc -c)" -gt 2700 ]; then - NOTES_TRUNCATED=$(printf '%s' "$NOTES_CONVERTED" | head -c 2700) - NOTES_CONVERTED="${NOTES_TRUNCATED}"$'\n'"...<${RELEASE_URL}|Read full release notes>" - fi - # JSON-escape: backslashes first, then double quotes, then collapse newlines to \n - NOTES=$(printf '%s' "$NOTES_CONVERTED" | sed 's/\\/\\\\/g' | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g') - echo "SLACK_RELEASE_NOTES=$NOTES" >> "$GITHUB_ENV" - - - name: Release Announcement - uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0 - with: - webhook: ${{ secrets.SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT }} - webhook-type: webhook-trigger - payload: | - { - "repository": "${{ github.repository }}", - "version": "${{ steps.git-cliff.outputs.version }}", - "release_notes": "${{ env.SLACK_RELEASE_NOTES }}", - "channel_id": "${{ secrets.SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT }}" - } - - name: Allow other workflows to trigger on release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 0426bf4c9..7960dbf1b 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -30,7 +30,6 @@ workflows: - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' - 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884' - 'orhun/git-cliff-action@a9a95522b26fe6403f7bb24031f21fb573d0f5ff' - - 'slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d' '.github/workflows/_scheduled-audit.yml': - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9' @@ -154,11 +153,6 @@ dependencies: commit: 'sha1-10e6efb97af3cd1523828f0e22c39f0e4567f3e4' owner_id: 50384771 repo_id: 453513731 - 'slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d': - ref: 'v4.0.0' - commit: 'sha1-dcb1066f776dd043e64d0e8ba94ca15cc7e1875d' - owner_id: 6962987 - repo_id: 306439799 'sonarsource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9': ref: 'v8.3.0' commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9' diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 199879ac3..bb1827e7b 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -195,5 +195,3 @@ jobs: contents: write # gh release create, gh api repos/.../dispatches in _package-publish.yml secrets: UV_PUBLISH_TOKEN: ${{ secrets.UV_PUBLISH_TOKEN }} - SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT: ${{ secrets.SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT }} - SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT: ${{ secrets.SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT }} From 0339f55e5f3cf2a7692ba584bb5208a0026f175f Mon Sep 17 00:00:00 2001 From: Oliver Meyer Date: Fri, 13 Nov 2026 15:56:34 +0100 Subject: [PATCH 6/6] ci: drop device client IDs, use Ketryx var CI logs in with the refresh token, which sends the public interactive client ID from _constants.py. Only the device flow reads AIGNOSTICS_CLIENT_ID_DEVICE, so stop passing it. The Ketryx project ID is public, so read it from a repository variable instead of a secret. Co-Authored-By: Claude Opus 5.5 --- .github/CLAUDE.md | 11 ++++++++--- .github/workflows/_ketryx_report_and_check.yml | 4 +--- .github/workflows/_scheduled-test-daily.yml | 5 ----- .github/workflows/_scheduled-test-hourly.yml | 5 ----- .github/workflows/_scheduled-test-stress.yml | 5 ----- .github/workflows/_test.yml | 5 ----- .github/workflows/ci-cd.yml | 3 --- .../workflows/scheduled-testing-production-daily.yml | 2 -- .../workflows/scheduled-testing-production-hourly.yml | 2 -- .github/workflows/scheduled-testing-staging-daily.yml | 2 -- .../workflows/scheduled-testing-staging-hourly.yml | 2 -- .github/workflows/stress-testing-staging.yml.paused | 2 -- CLAUDE.md | 2 +- 13 files changed, 10 insertions(+), 40 deletions(-) diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md index 9bde3c60e..874601ccf 100644 --- a/.github/CLAUDE.md +++ b/.github/CLAUDE.md @@ -133,9 +133,14 @@ Output: `aignostics.7z` per platform. Local: `make dist_native`. E2E. **Production** (`platform.aignostics.com`) is used only by scheduled jobs and release validation — never in PR CI. -GitHub secrets: `AIGNOSTICS_CLIENT_ID_DEVICE_{STAGING,PRODUCTION}`, -`AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`, `SONAR_TOKEN`, -`UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`, `KETRYX_API_KEY`. +GitHub secrets: `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`, +`SONAR_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_API_KEY`. + +GitHub variables: `KETRYX_PROJECT`. + +CI logs in with the refresh token, which uses the public interactive client ID +from `src/aignostics/platform/_constants.py`. Only the device flow reads +`AIGNOSTICS_CLIENT_ID_DEVICE`, so CI does not set it. Local `.env` for E2E: diff --git a/.github/workflows/_ketryx_report_and_check.yml b/.github/workflows/_ketryx_report_and_check.yml index 7015be37e..a36292cc9 100644 --- a/.github/workflows/_ketryx_report_and_check.yml +++ b/.github/workflows/_ketryx_report_and_check.yml @@ -16,8 +16,6 @@ on: required: false type: string secrets: - KETRYX_PROJECT: - required: false KETRYX_API_KEY: required: false @@ -78,7 +76,7 @@ jobs: continue-on-error: ${{ github.event_name == 'pull_request' }} uses: Ketryx/ketryx-github-action@e7ad6ff71022a4e8158477c4458778bf4d93353b # v2.0.0 with: - project: ${{ secrets.KETRYX_PROJECT }} + project: ${{ vars.KETRYX_PROJECT }} api-key: ${{ secrets.KETRYX_API_KEY }} commit-sha: ${{ inputs.version == '' && inputs.commit-sha || '' }} version: ${{ inputs.version }} diff --git a/.github/workflows/_scheduled-test-daily.yml b/.github/workflows/_scheduled-test-daily.yml index 30bf597ee..49b45ce3b 100644 --- a/.github/workflows/_scheduled-test-daily.yml +++ b/.github/workflows/_scheduled-test-daily.yml @@ -9,12 +9,8 @@ on: default: 'staging' type: string secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: - required: true AIGNOSTICS_REFRESH_TOKEN_STAGING: required: true - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: - required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true CODECOV_TOKEN: @@ -71,7 +67,6 @@ jobs: with: # The following 3 lines are correct even if vscode complains envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} - envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} fail_on_empty: false diff --git a/.github/workflows/_scheduled-test-hourly.yml b/.github/workflows/_scheduled-test-hourly.yml index 3fba62fc0..808663bd5 100644 --- a/.github/workflows/_scheduled-test-hourly.yml +++ b/.github/workflows/_scheduled-test-hourly.yml @@ -14,12 +14,8 @@ on: default: '' type: string secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: - required: true AIGNOSTICS_REFRESH_TOKEN_STAGING: required: true - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: - required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true @@ -60,7 +56,6 @@ jobs: with: # The following 3 lines are correct even if vscode complains envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} - envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} fail_on_empty: false diff --git a/.github/workflows/_scheduled-test-stress.yml b/.github/workflows/_scheduled-test-stress.yml index d2ce5df94..52552e16b 100644 --- a/.github/workflows/_scheduled-test-stress.yml +++ b/.github/workflows/_scheduled-test-stress.yml @@ -14,12 +14,8 @@ on: default: '' type: string secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: - required: true AIGNOSTICS_REFRESH_TOKEN_STAGING: required: true - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: - required: true AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: true @@ -60,7 +56,6 @@ jobs: with: # The following 3 lines are correct even if vscode complains envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} - envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} fail_on_empty: false diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index 6e19bffe8..2cf74fc06 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -13,12 +13,8 @@ on: required: false type: string secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: - required: false AIGNOSTICS_REFRESH_TOKEN_STAGING: required: false - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: - required: false AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: required: false CODECOV_TOKEN: @@ -110,7 +106,6 @@ jobs: with: # The following 3 lines are correct even if vscode complains envkey_AIGNOSTICS_API_ROOT: ${{ inputs.platform_environment == 'staging' && 'https://platform-staging.aignostics.com' || 'https://platform.aignostics.com' }} - envkey_AIGNOSTICS_CLIENT_ID_DEVICE: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING || secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} envkey_AIGNOSTICS_REFRESH_TOKEN: ${{ inputs.platform_environment == 'staging' && secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING || secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} fail_on_empty: false diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index bb1827e7b..876b580ac 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -127,9 +127,7 @@ jobs: permissions: contents: read secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} @@ -178,7 +176,6 @@ jobs: permissions: contents: read secrets: - KETRYX_PROJECT: ${{ secrets.KETRYX_PROJECT }} KETRYX_API_KEY: ${{ secrets.KETRYX_API_KEY }} package_publish: diff --git a/.github/workflows/scheduled-testing-production-daily.yml b/.github/workflows/scheduled-testing-production-daily.yml index 49fc98923..95dfc3ed3 100644 --- a/.github/workflows/scheduled-testing-production-daily.yml +++ b/.github/workflows/scheduled-testing-production-daily.yml @@ -20,9 +20,7 @@ jobs: permissions: contents: read secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/scheduled-testing-production-hourly.yml b/.github/workflows/scheduled-testing-production-hourly.yml index 7dc203464..68183ed7b 100644 --- a/.github/workflows/scheduled-testing-production-hourly.yml +++ b/.github/workflows/scheduled-testing-production-hourly.yml @@ -19,7 +19,5 @@ jobs: permissions: contents: read secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} diff --git a/.github/workflows/scheduled-testing-staging-daily.yml b/.github/workflows/scheduled-testing-staging-daily.yml index 93164ef24..0b64915e0 100644 --- a/.github/workflows/scheduled-testing-staging-daily.yml +++ b/.github/workflows/scheduled-testing-staging-daily.yml @@ -20,9 +20,7 @@ jobs: permissions: contents: read secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.github/workflows/scheduled-testing-staging-hourly.yml b/.github/workflows/scheduled-testing-staging-hourly.yml index b8bab038c..9400a6899 100644 --- a/.github/workflows/scheduled-testing-staging-hourly.yml +++ b/.github/workflows/scheduled-testing-staging-hourly.yml @@ -19,7 +19,5 @@ jobs: permissions: contents: read secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} diff --git a/.github/workflows/stress-testing-staging.yml.paused b/.github/workflows/stress-testing-staging.yml.paused index 8dc7eed39..c8bc91546 100644 --- a/.github/workflows/stress-testing-staging.yml.paused +++ b/.github/workflows/stress-testing-staging.yml.paused @@ -19,7 +19,5 @@ jobs: permissions: contents: read secrets: - AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }} AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }} - AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_PRODUCTION }} AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }} diff --git a/CLAUDE.md b/CLAUDE.md index 390ca38fe..5df847cc7 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -706,7 +706,7 @@ AIGNOSTICS_REFRESH_TOKEN=your-staging-refresh-token **In CI/CD:** * GitHub Actions secrets automatically populate .env -* Uses `AIGNOSTICS_CLIENT_ID_DEVICE_STAGING` and `AIGNOSTICS_REFRESH_TOKEN_STAGING` +* Uses `AIGNOSTICS_REFRESH_TOKEN_STAGING`. The refresh token flow does not need `AIGNOSTICS_CLIENT_ID_DEVICE` **Running E2E locally:**