UN-3636 [MISC] Make the rig unit/integration CI job green on main#2115
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughCritical-path status tracking now records scope, the rig and manifest configuration were updated, and ChangesCritical-path scope gating
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
| Filename | Overview |
|---|---|
| .github/workflows/ci-test.yaml | Refactored path filtering from trigger-level to job-level using dorny/paths-filter with predicate-quantifier: every; splits tiers into a parallel matrix; adds a report aggregation job as the single required check gate. The every quantifier causes CI to skip for PRs that touch both ignored dirs (docker/frontend/docs) and backend code simultaneously — a behavioral regression from the original paths-ignore. |
| tests/rig/cli.py | Adds --update-baseline to report combine, _coverage_attesting_groups (excludes empty/exit-5 groups), _marker_proven_paths, _db_env_from_postgres_url, _inject_infra_env, and TestcontainersRuntime provisioning for requires_services groups. Logic for in-scope vs out-of-scope gap gating is correct and well-tested. |
| tests/rig/critical_paths.py | Adds proof: marker field to CriticalPath, in_scope flag (now defaulting False) to CriticalPathStatus, and extracts _status_for/_gap_note helpers. Logic is correct: marker-proof paths require both a green covering group AND a passing marked test; in-scope vs out-of-scope gap classification is accurate. |
| tests/rig/reporting.py | Adds passed_critical_path_ids which reads junit XML to find critical-path ids attested by passing tests only. Minor: prop.get("value") is called twice (guard + add), causing a type-annotation mismatch a checker would flag. |
| tests/rig/pytest_plugin/rig_critical_path.py | New pytest plugin that copies @pytest.mark.critical_path marker args into junit testcase properties at collection time. Stdlib-only, isolated in its own directory to avoid PYTHONPATH collisions. Logic is correct for the junit-property attestation flow. |
| backend/conftest.py | Adds central pytest_collection_modifyitems hook that auto-marks all Django TestCase/TransactionTestCase and django_db tests as integration, eliminating hand-maintained per-file markers and enabling exact unit/integration tier split. |
| tests/groups.yaml | Replaces hand-listed paths with paths: ["."] + marker-based selection for backend groups; adds integration-backend (DB-backed) and integration-connectors (MinIO-backed); removes unit-runner and unit-tool-registry dead groups. |
| tests/critical_paths.yaml | Wires adapter-register-llm to integration-backend with proof:marker; removes tool-sandbox-exec (unit-runner deleted). All other paths retain proof:group with existing covered_by mappings. |
| backend/adapter_processor_v2/tests/test_adapter_api.py | New integration test that drives POST /api/v1/adapter/ end-to-end with only the SDK context-window call mocked; correctly marked critical_path("adapter-register-llm"). Auto-detected as integration via conftest hook due to TestCase subclassing. |
| backend/workflow_manager/endpoint_v2/tests/destination-connectors/test_destination_connector_postgres.py | Adds xfail marker to test_insert_into_db_with_error_postgresql documenting the real latent jsonb bug (data=None serialized as literal string 'None'); fixes schema and table-name casing issues. |
Sequence Diagram
%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant GH as GitHub push/PR
participant CH as changes job
participant TU as test (unit) job
participant TI as test (integration) job
participant RP as report job
participant CA as actions/cache
GH->>CH: trigger
CH->>CH: dorny/paths-filter (every, negated globs)
CH-->>TU: "relevant=true schedule"
CH-->>TI: "relevant=true schedule"
TU->>TU: tox -e unit -- --fail-on-critical-gap
TI->>TI: tox -e integration -- --fail-on-critical-gap
TU->>TU: suffix .coverage to .coverage.tier-unit
TI->>TI: suffix .coverage to .coverage.tier-integration
TU-->>RP: upload artifact reports-unit
TI-->>RP: upload artifact reports-integration
RP->>CA: restore previous-summary.json (read-only)
RP->>RP: download-artifact merge-multiple
RP->>RP: tox -e rig -- report combine optional update-baseline
RP->>CA: save updated baseline (main only)
RP->>GH: sticky PR comment (combined report)
RP->>RP: "needs.test.result == success or exit 1"
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant GH as GitHub push/PR
participant CH as changes job
participant TU as test (unit) job
participant TI as test (integration) job
participant RP as report job
participant CA as actions/cache
GH->>CH: trigger
CH->>CH: dorny/paths-filter (every, negated globs)
CH-->>TU: "relevant=true schedule"
CH-->>TI: "relevant=true schedule"
TU->>TU: tox -e unit -- --fail-on-critical-gap
TI->>TI: tox -e integration -- --fail-on-critical-gap
TU->>TU: suffix .coverage to .coverage.tier-unit
TI->>TI: suffix .coverage to .coverage.tier-integration
TU-->>RP: upload artifact reports-unit
TI-->>RP: upload artifact reports-integration
RP->>CA: restore previous-summary.json (read-only)
RP->>RP: download-artifact merge-multiple
RP->>RP: tox -e rig -- report combine optional update-baseline
RP->>CA: save updated baseline (main only)
RP->>GH: sticky PR comment (combined report)
RP->>RP: "needs.test.result == success or exit 1"
Reviews (21): Last reviewed commit: "refactor: address SonarCloud issues on r..." | Re-trigger Greptile
chandrasekharan-zipstack
changed the title
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
chandrasekharan-zipstack
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/critical_paths.yaml`:
- Around line 57-63: Keep `tool-sandbox-exec` active in
`tests/critical_paths.yaml` until the runner/tool-registry flow is fully
removed; the current commented-out entry is excluded from `evaluate()`, so
restore the `tool-sandbox-exec` item in place with `covered_by: []` and keep its
`entry`/`description` intact so the warn-only path still reports the gap.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 247fbb34-d0f1-417c-97a5-76915cbe3c0f
📒 Files selected for processing (2)
tests/critical_paths.yamltests/groups.yaml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (1)
unstract/connectors/tests/filesystems/test_sharepoint_fs.py (1)
118-122: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winEncode the current schema contract instead of skipping it.
If
is_personalis intentionally not part of the JSON schema, please assert that explicitly here rather than disabling the test. Leaving it skipped means accidental schema drift in either direction will pass unnoticed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@unstract/connectors/tests/filesystems/test_sharepoint_fs.py` around lines 118 - 122, The SharePoint filesystem test is skipped instead of asserting the intended schema contract, so replace the skip in test_sharepoint_fs.py with an explicit assertion in the relevant test around is_personal/json_schema.json behavior. Use the existing SharePoint filesystem test class and helpers to verify that is_personal is intentionally absent from the JSON schema (and that personal/site is inferred from site_url), so future schema drift is caught by the test instead of being ignored.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@backend/prompt_studio/prompt_studio_core_v2/tests/test_build_index_payload.py`:
- Around line 86-96: The module restore helper currently clears only the saved
collaborator stubs, but it also needs to evict prompt_studio_helper from
sys.modules so later imports reload it with real dependencies. Update
_restore_modules in test_build_index_payload.py to pop the prompt_studio_helper
module entry after _psh_mod has already been bound, and make sure the same
cleanup is applied wherever the tests reset module state (including the later
restore block referenced in the comment).
In `@backend/usage_v2/tests/test_helper.py`:
- Around line 20-30: Avoid the module-level reassignment of the Usage symbol in
test_helper.py, because it leaves backend.usage_v2.helper patched for the rest
of the test run. Move the FakeUsage substitution into a test fixture or
monkeypatch setup/teardown so helper_mod.Usage is only overridden within the
scope of each test, while keeping get_usage_by_model and UsageHelper as the
relevant symbols to target.
In `@tests/rig/cli.py`:
- Around line 680-683: The project-root editable install in the CLI test setup
is redundant because uv run already installs the current project editable, so
the install_editable flag is not actually controlling behavior for unit-core.
Update the logic around group.install_editable in cli.py so it does not
unconditionally add --with-editable str(workdir) for the project root; instead,
either remove this branch or switch to the appropriate uv flags (--no-project or
--no-editable) if the flag is intended to control project installation.
In `@unstract/connectors/tests/databases/test_redshift_db.py`:
- Around line 8-18: The Redshift integration test only skips when
REDSHIFT_TEST_PASSWORD is set, but test_user_name_and_password still directly
requires REDSHIFT_TEST_HOST through os.environ[], so the test can fail instead
of skipping. Update the unittest.skipUnless guard on test_user_name_and_password
in test_redshift_db.py to require all mandatory Redshift env vars used by
Redshift initialization, especially REDSHIFT_TEST_PASSWORD and
REDSHIFT_TEST_HOST, so the test is skipped unless every required setting is
present.
In `@unstract/connectors/tests/databases/test_snowflake_db.py`:
- Around line 8-21: Update the test guard in test_snowflake_db.py so the
Snowflake integration test is skipped unless all required mandatory environment
variables are set, not just SNOWFLAKE_TEST_PASSWORD. In test_something, adjust
the `@unittest.skipUnless` condition to check the presence of SNOWFLAKE_TEST_USER,
SNOWFLAKE_TEST_PASSWORD, and SNOWFLAKE_TEST_ACCOUNT before constructing
SnowflakeDB, while keeping the optional defaults for database, schema,
warehouse, and role unchanged.
In `@unstract/connectors/tests/filesystems/test_google_drive_fs.py`:
- Around line 8-10: The Google Drive integration test is only gated on
GDRIVE_GOOGLE_SERVICE_ACCOUNT, so it can still run and fail when the Google
Drive environment is only partially configured. Update the unittest.skipUnless
condition in test_google_drive_fs to require the full Google Drive env contract
used by GoogleDriveFS initialization, including both
GDRIVE_GOOGLE_SERVICE_ACCOUNT and GDRIVE_GOOGLE_PROJECT_ID, so the test is
skipped unless all required settings are present.
In `@unstract/connectors/tests/filesystems/test_miniofs.py`:
- Around line 35-37: The MinIO integration test skip guard only checks
MINIO_ACCESS_KEY_ID, so it can still run without MINIO_SECRET_ACCESS_KEY and
fail later. Update the skip condition in test_miniofs.py around the
unittest.skipUnless on the MinioFSTest class to require both MINIO_ACCESS_KEY_ID
and MINIO_SECRET_ACCESS_KEY before running, so the test cleanly skips unless a
usable MinIO client can be built.
In `@unstract/connectors/tests/filesystems/test_pcs.py`:
- Around line 8-10: The PCS integration test gating is incomplete because it
only checks GOOGLE_STORAGE_ACCESS_KEY_ID while the test setup also depends on
GOOGLE_STORAGE_SECRET_ACCESS_KEY. Update the skip condition in the test
decorator for the PCS test in test_pcs.py so it skips unless both credentials
are present, using the existing unittest.skipUnless on the test class or method
that configures the PCS client.
---
Nitpick comments:
In `@unstract/connectors/tests/filesystems/test_sharepoint_fs.py`:
- Around line 118-122: The SharePoint filesystem test is skipped instead of
asserting the intended schema contract, so replace the skip in
test_sharepoint_fs.py with an explicit assertion in the relevant test around
is_personal/json_schema.json behavior. Use the existing SharePoint filesystem
test class and helpers to verify that is_personal is intentionally absent from
the JSON schema (and that personal/site is inferred from site_url), so future
schema drift is caught by the test instead of being ignored.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3ead960d-5f5a-4850-8f85-5e9cb6850294
⛔ Files ignored due to path filters (1)
backend/uv.lockis excluded by!**/*.lock
📒 Files selected for processing (22)
backend/dashboard_metrics/tests/test_tasks.pybackend/prompt_studio/prompt_studio_core_v2/tests/test_build_index_payload.pybackend/pyproject.tomlbackend/usage_v2/tests/test_helper.pybackend/utils/file_storage/__init__.pybackend/utils/file_storage/helpers/__init__.pybackend/utils/file_storage/helpers/prompt_studio_file_helper.pypyproject.tomltests/groups.yamltests/rig/cli.pyunstract/connectors/tests/databases/test_mariadb.pyunstract/connectors/tests/databases/test_mssql_db.pyunstract/connectors/tests/databases/test_mysql_db.pyunstract/connectors/tests/databases/test_postgresql_db.pyunstract/connectors/tests/databases/test_redshift_db.pyunstract/connectors/tests/databases/test_snowflake_db.pyunstract/connectors/tests/filesystems/test_box_fs.pyunstract/connectors/tests/filesystems/test_google_drive_fs.pyunstract/connectors/tests/filesystems/test_miniofs.pyunstract/connectors/tests/filesystems/test_pcs.pyunstract/connectors/tests/filesystems/test_sharepoint_fs.pyunstract/connectors/tests/filesystems/test_zs_dropbox_fs.py
💤 Files with no reviewable changes (1)
- pyproject.toml
✅ Files skipped from review due to trivial changes (2)
- backend/utils/file_storage/helpers/prompt_studio_file_helper.py
- unstract/connectors/tests/databases/test_mariadb.py
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/groups.yaml
… main runs green The rig's unit/integration CI job had never passed on main. `--fail-on-critical-gap` (passed only on the main push) failed the build on EVERY uncovered critical path, including e2e-only paths run during the unit/integration tier and paths with no test anywhere. Every group-level failure was already non-gating (optional groups, or exit 5 = no tests collected), so the gap gate was the sole cause of redness. - Split critical-path gaps into in-scope vs out-of-scope (add `in_scope` to CriticalPathStatus; evaluate() already computed it). --fail-on-critical-gap now gates only on in-scope gaps — a declared in-tier covering group that didn't run green (real coverage regressed). Out-of-scope gaps (covered only by an unrun tier, or no declared coverage) are reported + logged but never gate that tier. - Wire honest coverage that exists today: adapter-register-llm -> unit-sdk1. Gives the path teeth: if sdk1 regresses, it flips to an in-scope gap and fails. - Drop unit-tool-registry group (component slated for removal; can't even collect). - Delete 3 dead tests referencing removed code: core test_pandora_account.py (account_services removed), core test_pubsub_helper.py (LogHelper -> LogPublisher), platform-service test_auth_middleware.py (platform_service.main removed; also made live Postgres calls). unit-platform-service is green via its hermetic memory-leak test; unit-core has no valid tests left and skips as a placeholder. New self-tests cover the in-scope/out-of-scope split at both evaluate() and cmd_run(). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XJqp7xMdd1kjLUKbvrJsq4
…kend tests
Follow-up cleanup on the rig manifests (UN-3636):
- Park unit-runner and unit-prompt-service (commented out, not run by
default) with a TODO to delete when those services are removed — both are
being decommissioned; no value testing components on their way out.
- Drop the unit-tool-registry NOTE block entirely.
- Prune 6 unit-backend paths that collect zero tests (account_v2,
api_deployment_v2, connector_v2, file_management, project,
tenant_account_v2 — dirs missing or empty); optional skip-if-missing was
hiding them and implying coverage that was never written.
- Wire two real backend tests into unit-backend:
* middleware/test_exception.py — 5 hermetic tests, pass now.
* prompt_studio/prompt_studio_core_v2/tests — pins the executor
_handle_ide_index async path (no prompt-service coupling); runs once
unit-backend is un-gated, skips safely until then.
- Comment out the tool-sandbox-exec critical path (TODO: remove with
tool-registry/runner) — its covering group unit-runner is now parked.
`python -m tests.rig validate` → OK (13 groups, 9 critical paths).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
…jango setting unit-core ran 0 tests / 2 collection errors (ModuleNotFoundError: No module named 'unstract'). Root cause: _prepare_group_env did `uv pip install -e .` for install_editable groups, but _pytest_command runs `uv run`, which re-syncs the venv every call and wipes that install before pytest imports the package — the same hazard the code already flagged for plugins. Inject the package via `uv run --with-editable <workdir>` (survives the re-sync, same mechanism as the RIG_PYTEST_PLUGINS `--with` specs) and drop the wiped `uv pip install -e .`. unit-core now 27 passed, 0 errors. Also remove DJANGO_SETTINGS_MODULE from the repo-root [tool.pytest.ini_options]: it's a pytest-django option that warns "Unknown config option" for every non-Django group, points at a non-existent module (backend.settings.test_cases), and Django settings don't belong at the polyglot repo root. The rig injects it per-group via groups.yaml env for unit-backend only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
The unit-backend group pointed at a non-existent settings module
(backend.settings.test_cases) and ran without pytest-django, so the
DB-backed tests errored at collection (Django uninitialised) and the
django_db tests had no test-DB lifecycle. Make the group actually runnable:
- Add pytest-django to the backend test group (bootstraps Django before
collection; provides the test-DB + django_db fixtures).
- Point DJANGO_SETTINGS_MODULE at the existing backend.settings.test and
inject the import-time-required settings via the group env — base.py reads
them before any dotenv load, so they must exist in the process env, not a
settings module. ENCRYPTION_KEY is an all-zero (valid, zero-entropy) Fernet
placeholder, not a real secret.
- Set DB_SCHEMA=public: the app's fixed schema doesn't exist in the fresh
test DB and tenancy is row-level, so migrations run in public.
- Drop workflow_manager/endpoint_v2/tests from the wired paths: its
destination-connector tests import the enterprise `plugins` package,
absent in OSS.
- Add the missing utils/file_storage{,/helpers}/__init__.py so those
modules import as a package under pytest.
- Stop test_build_index_payload's sys.modules stubs from leaking into
sibling collection: record + restore the originals once the helper is
imported (a stubbed account_v2.models was breaking other modules'
real imports).
unit-backend now collects clean; 126 passed, 4 skipped. The remaining 6
failures (usage_v2 helper stubs, dashboard_metrics cleanup tasks) are
pre-existing test bugs tracked separately.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
dashboard_metrics: organization FK targets Organization's int PK, but the tests passed a UUID string as organization_id, and verified rows through the org-scoped default manager (empty without a UserContext). Create a real Organization and read via _base_manager. usage_v2: drop the fragile "stub usage_v2.models into sys.modules before import" trick — under pytest-django Django imports the real module first, so the stub never took and the helper hit the DB. Rebind the Usage symbol the helper resolved instead. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
The connector suite had 12 reds that needed real external services or
per-developer credentials no one has by default. Two were genuine bugs;
the rest are integration tests masquerading as unit tests.
Fixes (not credential-related):
- mariadb: assertion text drifted from the connector's actual message
("SSL SETTINGS", not "ssl-settings").
- sharepoint: skip test_json_schema_has_is_personal — is_personal is read
from settings in code but was never exposed in json_schema.json (personal
vs site is inferred from an empty site_url). Whether the schema should
expose it is a product decision; tracked under UN-3414.
Gating (skipUnless, mirrors the existing SharePoint integration tests):
- filesystems (box, gdrive, minio, pcs, dropbox) already read creds from
env; add the missing skip guard so they SKIP instead of failing.
- databases (mssql, mysql, postgresql, redshift, snowflake) had hardcoded
personal creds (incl. a live-looking neon.tech URL and a Snowflake
account) querying bespoke tables. Move creds to *_TEST_* env vars and
skip unless provided, removing the secrets from the repo.
CI can run these by injecting the corresponding secrets as env vars in a
dedicated integration job; by default they skip cleanly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
Both now run green and standalone (no external services; integration tests skip cleanly when credentials are absent), so drop optional: true to make them blocking merge gates per UN-3635. unit-backend stays optional until the rig provisions a reachable DB_HOST for it (UN-3636 follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
for more information, see https://pre-commit.ci
- in_scope defaults False on CriticalPathStatus so a future evaluate() regression that forgets it under-gates (warning) rather than over-gates (spurious build block). [greptile] - widen connector integration skip guards (redshift, snowflake, gdrive, minio, pcs) to require every env var the test hard-references, so a partially configured env skips cleanly instead of failing. [coderabbit] - usage_v2 test_helper: swap Usage via an autouse monkeypatch fixture instead of a module-level rebind that leaks FakeUsage into later tests. - build_index_payload test: evict the helper module from sys.modules after binding it, so later importers in the same process get a real copy. - drop dead tox `runner` alias (its unit-runner group was removed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
chandrasekharan-zipstack
force-pushed
the
fix/test-rig-green-v2
branch
from
June 30, 2026 10:16
d55768c to
9e04f44
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tox.ini`:
- Line 12: Update the stale alias comment in tox config so it no longer mentions
the removed runner env. Adjust the comment near the existing service envs to
reflect only the envs that still exist, using the same nearby tox env names as
the reference point so the documentation matches the current configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: dfe7f820-870a-4a7a-b39f-ba9b196dc4cf
⛔ Files ignored due to path filters (1)
backend/uv.lockis excluded by!**/*.lock
📒 Files selected for processing (30)
backend/dashboard_metrics/tests/test_tasks.pybackend/prompt_studio/prompt_studio_core_v2/tests/test_build_index_payload.pybackend/pyproject.tomlbackend/usage_v2/tests/test_helper.pybackend/utils/file_storage/__init__.pybackend/utils/file_storage/helpers/__init__.pybackend/utils/file_storage/helpers/prompt_studio_file_helper.pyplatform-service/tests/test_auth_middleware.pypyproject.tomltests/critical_paths.yamltests/groups.yamltests/rig/cli.pytests/rig/critical_paths.pytests/rig/tests/test_cli.pytests/rig/tests/test_critical_paths.pytox.iniunstract/connectors/tests/databases/test_mariadb.pyunstract/connectors/tests/databases/test_mssql_db.pyunstract/connectors/tests/databases/test_mysql_db.pyunstract/connectors/tests/databases/test_postgresql_db.pyunstract/connectors/tests/databases/test_redshift_db.pyunstract/connectors/tests/databases/test_snowflake_db.pyunstract/connectors/tests/filesystems/test_box_fs.pyunstract/connectors/tests/filesystems/test_google_drive_fs.pyunstract/connectors/tests/filesystems/test_miniofs.pyunstract/connectors/tests/filesystems/test_pcs.pyunstract/connectors/tests/filesystems/test_sharepoint_fs.pyunstract/connectors/tests/filesystems/test_zs_dropbox_fs.pyunstract/core/tests/account_services/test_pandora_account.pyunstract/core/tests/test_pubsub_helper.py
💤 Files with no reviewable changes (4)
- unstract/core/tests/account_services/test_pandora_account.py
- platform-service/tests/test_auth_middleware.py
- unstract/core/tests/test_pubsub_helper.py
- pyproject.toml
✅ Files skipped from review due to trivial changes (3)
- backend/utils/file_storage/helpers/prompt_studio_file_helper.py
- unstract/connectors/tests/filesystems/test_google_drive_fs.py
- unstract/connectors/tests/filesystems/test_box_fs.py
🚧 Files skipped from review as they are similar to previous changes (15)
- unstract/connectors/tests/databases/test_mariadb.py
- unstract/connectors/tests/databases/test_mysql_db.py
- unstract/connectors/tests/filesystems/test_miniofs.py
- unstract/connectors/tests/databases/test_postgresql_db.py
- unstract/connectors/tests/filesystems/test_sharepoint_fs.py
- unstract/connectors/tests/databases/test_snowflake_db.py
- tests/rig/tests/test_critical_paths.py
- unstract/connectors/tests/databases/test_mssql_db.py
- tests/rig/tests/test_cli.py
- backend/prompt_studio/prompt_studio_core_v2/tests/test_build_index_payload.py
- unstract/connectors/tests/databases/test_redshift_db.py
- tests/critical_paths.yaml
- unstract/connectors/tests/filesystems/test_zs_dropbox_fs.py
- backend/usage_v2/tests/test_helper.py
- backend/dashboard_metrics/tests/test_tasks.py
Contributor
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tox.ini`:
- Line 12: Update the stale alias comment in tox config so it no longer mentions
the removed runner env. Adjust the comment near the existing service envs to
reflect only the envs that still exist, using the same nearby tox env names as
the reference point so the documentation matches the current configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: dfe7f820-870a-4a7a-b39f-ba9b196dc4cf
⛔ Files ignored due to path filters (1)
backend/uv.lockis excluded by!**/*.lock
📒 Files selected for processing (30)
backend/dashboard_metrics/tests/test_tasks.pybackend/prompt_studio/prompt_studio_core_v2/tests/test_build_index_payload.pybackend/pyproject.tomlbackend/usage_v2/tests/test_helper.pybackend/utils/file_storage/__init__.pybackend/utils/file_storage/helpers/__init__.pybackend/utils/file_storage/helpers/prompt_studio_file_helper.pyplatform-service/tests/test_auth_middleware.pypyproject.tomltests/critical_paths.yamltests/groups.yamltests/rig/cli.pytests/rig/critical_paths.pytests/rig/tests/test_cli.pytests/rig/tests/test_critical_paths.pytox.iniunstract/connectors/tests/databases/test_mariadb.pyunstract/connectors/tests/databases/test_mssql_db.pyunstract/connectors/tests/databases/test_mysql_db.pyunstract/connectors/tests/databases/test_postgresql_db.pyunstract/connectors/tests/databases/test_redshift_db.pyunstract/connectors/tests/databases/test_snowflake_db.pyunstract/connectors/tests/filesystems/test_box_fs.pyunstract/connectors/tests/filesystems/test_google_drive_fs.pyunstract/connectors/tests/filesystems/test_miniofs.pyunstract/connectors/tests/filesystems/test_pcs.pyunstract/connectors/tests/filesystems/test_sharepoint_fs.pyunstract/connectors/tests/filesystems/test_zs_dropbox_fs.pyunstract/core/tests/account_services/test_pandora_account.pyunstract/core/tests/test_pubsub_helper.py
💤 Files with no reviewable changes (4)
- unstract/core/tests/account_services/test_pandora_account.py
- platform-service/tests/test_auth_middleware.py
- unstract/core/tests/test_pubsub_helper.py
- pyproject.toml
✅ Files skipped from review due to trivial changes (3)
- backend/utils/file_storage/helpers/prompt_studio_file_helper.py
- unstract/connectors/tests/filesystems/test_google_drive_fs.py
- unstract/connectors/tests/filesystems/test_box_fs.py
🚧 Files skipped from review as they are similar to previous changes (15)
- unstract/connectors/tests/databases/test_mariadb.py
- unstract/connectors/tests/databases/test_mysql_db.py
- unstract/connectors/tests/filesystems/test_miniofs.py
- unstract/connectors/tests/databases/test_postgresql_db.py
- unstract/connectors/tests/filesystems/test_sharepoint_fs.py
- unstract/connectors/tests/databases/test_snowflake_db.py
- tests/rig/tests/test_critical_paths.py
- unstract/connectors/tests/databases/test_mssql_db.py
- tests/rig/tests/test_cli.py
- backend/prompt_studio/prompt_studio_core_v2/tests/test_build_index_payload.py
- unstract/connectors/tests/databases/test_redshift_db.py
- tests/critical_paths.yaml
- unstract/connectors/tests/filesystems/test_zs_dropbox_fs.py
- backend/usage_v2/tests/test_helper.py
- backend/dashboard_metrics/tests/test_tasks.py
🛑 Comments failed to post (1)
tox.ini (1)
12-12: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Update the stale alias comment.
runnerwas removed in this change, so this comment now documents a tox env that no longer exists.Suggested diff
-# Pre-existing service envs (runner, sdk1) remain as thin +# Pre-existing service envs (sdk1) remain as thin📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.# Pre-existing service envs (sdk1) remain as thin🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tox.ini` at line 12, Update the stale alias comment in tox config so it no longer mentions the removed runner env. Adjust the comment near the existing service envs to reflect only the envs that still exist, using the same nearby tox env names as the reference point so the documentation matches the current configuration.
… out of unit Make `requires_services` actually provision instead of being cosmetic. The rig now brings up testcontainers infra (Postgres/MinIO) for any runnable group that declares `requires_services`, and injects connection env into the group's pytest subprocess (Postgres URL -> discrete DB_* vars; MinIO endpoint/creds). Previously django_db tests fell back to the compose hostname `backend-db-1`, unreachable from host-side pytest, so unit-backend had to be `optional`. Reclassify infra-dependent tests by the rig's own tier taxonomy (unit = no external services, integration = real infra but not the full platform): - backend: split unit-backend into pure `unit-backend` (gates unit tier, no infra) and `integration-backend` (django_db tests: dashboard_metrics + prompt_studio_registry_v2; provisioned Postgres; gates integration tier). - connectors: marker-based split (tests are interleaved within files). Credential + MinIO tests marked `@pytest.mark.integration`; `unit-connectors` runs `-m "not integration"`, new `integration-connectors` runs `-m "integration"`. test_minio actually runs against provisioned MinIO; external-credential tests skip. Skip-guard test_http_fs (was hitting a live URL unguarded in CI). Both groups are non-optional and gate their tiers. Unit tier stays infra-free. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/rig/cli.py`:
- Around line 611-631: The backend env override logic in cli.py only applies
Postgres and MinIO, so Redis-backed groups still use the default localhost Redis
and miss the provisioned endpoint. Update the same env-building block that
handles endpoints.infra.postgres_url and endpoints.infra.minio_endpoint to also
check for the Redis service requirement and, when present, rewrite the Redis
connection env from the provisioned Redis endpoint instead of leaving the
tests/groups.yaml default in place. Use the existing endpoint pattern and the
group.requires_services check so integration-backend and other Redis-backed
groups pick up the testcontainer Redis consistently.
In `@unstract/connectors/tests/filesystems/test_http_fs.py`:
- Around line 1-15: Mark the HttpFS test module as integration-tier so it is
selected by the integration test job and excluded from unit runs. Update the
TestHttpFS module/class in the HTTP filesystem test file to use the integration
marker already used elsewhere in the test suite, while keeping the existing
HTTP_FS_TEST_URL skip guard for the live-server dependency.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bac488a0-d4b9-4736-96ba-2a98e93b06c7
📒 Files selected for processing (17)
tests/groups.yamltests/rig/cli.pytests/rig/runtime.pytests/rig/tests/test_cli.pyunstract/connectors/pyproject.tomlunstract/connectors/tests/databases/test_mssql_db.pyunstract/connectors/tests/databases/test_mysql_db.pyunstract/connectors/tests/databases/test_postgresql_db.pyunstract/connectors/tests/databases/test_redshift_db.pyunstract/connectors/tests/databases/test_snowflake_db.pyunstract/connectors/tests/filesystems/test_box_fs.pyunstract/connectors/tests/filesystems/test_google_drive_fs.pyunstract/connectors/tests/filesystems/test_http_fs.pyunstract/connectors/tests/filesystems/test_miniofs.pyunstract/connectors/tests/filesystems/test_pcs.pyunstract/connectors/tests/filesystems/test_sharepoint_fs.pyunstract/connectors/tests/filesystems/test_zs_dropbox_fs.py
🚧 Files skipped from review as they are similar to previous changes (10)
- unstract/connectors/tests/filesystems/test_miniofs.py
- unstract/connectors/tests/filesystems/test_sharepoint_fs.py
- unstract/connectors/tests/filesystems/test_box_fs.py
- unstract/connectors/tests/filesystems/test_google_drive_fs.py
- unstract/connectors/tests/databases/test_mysql_db.py
- unstract/connectors/tests/databases/test_mssql_db.py
- unstract/connectors/tests/databases/test_snowflake_db.py
- unstract/connectors/tests/databases/test_postgresql_db.py
- unstract/connectors/tests/filesystems/test_zs_dropbox_fs.py
- unstract/connectors/tests/databases/test_redshift_db.py
…ation, cut rig complexity - integration-backend declares requires_services: [postgres, redis] but the rig only injected Postgres/MinIO env, so Redis-backed tests bypassed the testcontainer and hit localhost:6379. Inject REDIS_HOST/PORT + CELERY_BROKER_BASE_URL from the provisioned endpoint (CodeRabbit). - test_http_fs was skip-guarded but unmarked, so the connector marker split (-m "not integration") could still run it in the unit tier. Mark the module integration (CodeRabbit). - Extract _inject_infra_env and _pytest_base_cmd to bring both functions under SonarCloud's cognitive-complexity threshold. NOSONAR the test's DB_PASSWORD placeholder (not a real credential). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
The MinIO endpoint is a throwaway testcontainer with no TLS, so http is expected. Suppress the SonarCloud insecure-protocol hotspot that otherwise blocks the quality gate on new code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
The module stubs adapter_processor_v2.models to import PromptStudioHelper without the full Django app, but only provided AdapterInstance. The helper also imports UserDefaultAdapter, so the import failed and all 4 tests in the module self-skipped via the _IMPORT_ERROR guard. Add the missing stub so the tests actually execute. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
Removed from the e2e test overlay; the platform brought up for e2e no longer provisions a standalone prompt-service. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
…r tests - test_miniofs: drop the permanently-skipped test_s3 (hardcoded AWS S3 smoke). MinIO/S3 is covered by test_minio (integration), the TestAccessFilteredS3 unit tests, and the connectorkit registry check. - database + filesystem tests: replace print()-in-loop debug with assertions (or drop redundant prints) so integration runs don't spam the logs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt
…connector_v2 tests - groups.yaml: integration-backend now selects paths ["."] with -m integration — the exact complement of unit-backend over the same tree. New backend DB tests auto-join the group with no manifest edit. Verified equivalent: collect-only shows the same 50/166 tests (116 deselected); full run against testcontainers Postgres/Redis gives the same 24 passed / 26 skipped as the hand-listed paths on CI. - Delete backend/connector_v2/tests (connector_tests.py, conftest.py, fixture): written for the pre-v2 schema — the fixture loads removed models (account.org, account.user, project) so loaddata errors immediately, and the filename never matched pytest's test_*.py pattern, so these tests have not been collected anywhere. Same dead-test cleanup as the rest of this branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
…backend-marker-paths
The previous version stubbed cross-app imports in sys.modules (only when absent) — written for a bare no-Django env. Under the rig, pytest-django boots Django and the real modules are already imported, so the stubs were skipped and the tests called reset_mock() on real classes (AttributeError). Same control-flow assertions, now via mock.patch.multiple on the imported module: no sys.modules mutation, no import-order dependence, safe in a shared pytest session. Stays in the unit tier (no DB touched). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
…ss flask check - test_build_index_payload.py: import the real prompt_studio_helper (Django is loaded by the rig env) instead of installing ~30 stub modules in sys.modules and restoring them post-import. The clobber/restore dance was import-order dependent and silently skipped all tests when the stub surface drifted. Tests and assertions unchanged; patches now managed via ExitStack. - test_legacy_executor_scaffold.py: test_no_flask_import now runs the check in a fresh subprocess. The in-place importlib.reload swapped class identities under sibling tests, and scanning sys.modules in-process fails if any other test imported flask. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
…compat Trigger-level paths-ignore means docs/frontend/docker-only PRs never start the workflow, so no check run is created and a required 'test' status check would block those PRs forever. A 'changes' job now always runs and gates 'test' via needs + if; a skipped job still reports a check run (skipped = passing for required checks), while any executed test failure still fails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGcZHkM4jbUmrx4YNYewZK
…guard test - python_files = [test_*.py, *_test.py, *_tests.py] in backend, workers, sdk1, connectors — one superset everywhere instead of three different configs. sdk1 loses the unused bare tests.py pattern (no such files). No currently existing file changes collection status (verified: zero *_tests.py in repo). - Remove test_no_flask_import: flask is not a workers dependency, so a flask import in the exceptions module would already fail every test that imports it; the Flask source it guarded against (prompt-service) is decommissioned. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
Accepting the bare `tests.py` Django convention surfaces two real backend suites (tenant_account_v2, account_v2 — 28 tests) that were written but never collected. All pass in integration-backend (24→52 passed, skips unchanged); unit-backend collection is untouched. Bare `test.py` is deliberately NOT accepted: backend/backend/settings/test.py is a Django settings module and would be imported as a test module. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
The tiers share no state (separate runners, disjoint groups), so they run as matrix legs; wall clock drops from tier-sum to max(tiers). Everything needing both tiers' results moves to a new `report` job fed by per-tier artifacts: report aggregation, coverage union (tier .coverage files are suffixed so `coverage combine` can merge them), PR comment, and the main-branch baseline. Baseline writes were the one real conflict: parallel per-tier `run --update-baseline` would race the cache save (first save wins, the other tier's coverage is lost). Tier jobs now restore-only; the rig's `report combine` gains `--update-baseline` as the single writer, refusing the merge when any non-optional group is red or the baseline is corrupt. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
Lets `report` serve as the single required branch-protection check: a matrix job's result is success only when every leg passes, so either tier failing turns report red too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
Trim verbose comments and drop PR-narrative phrasing that would go stale. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
Critical-path regressions already gate PRs; the gap check was main-only to avoid failing unrelated PRs on pre-existing debt. With main enforced gap-free and PR CI running the merge ref, a gap failure on a PR can only be one the PR introduces — so catch it before merge, not after. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
`branches: [main]` filters by base branch, so stacked PRs (targeting a feature branch) got no test runs at all until the stack reached main. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
ritwik-g
reviewed
Jul 7, 2026
ritwik-g
left a comment
ritwik-g
left a comment
Contributor
There was a problem hiding this comment.
Focused review of the rig/CI changes. All items below were verified against the branch; I've skipped everything the bots already resolved. Nothing here blocks the core approach (which is sound) — one is an operational merge step, one is a latent gate hole this PR widens, and two are coverage-loss judgment calls on deletions.
ritwik-g
approved these changes
Jul 7, 2026
ritwik-g
left a comment
ritwik-g
left a comment
Contributor
There was a problem hiding this comment.
Approving. This touches no production runtime code, and the core approach — gate scoping to in-tier coverage, marker-based unit/integration split via the central conftest auto-marker, testcontainers provisioning for the integration tier, and the parallel matrix CI + single-writer baseline — is sound and verified green.
One merge-time step (not a code change): the required status check must be repointed when this lands. test becomes a matrix, so the old test context stops reporting — require the report job (or both test (unit) / test (integration)) or PRs will hang on a missing check. Handled at merge.
Non-blocking follow-ups from the inline comments:
- Restore the two mock-only connector tests (
test_bigquery_db.py,test_mariadb.py) — they aren't actually superseded by the Postgres-only backend tests. - Track the
empty-counts-as-coverage-green gate hole (latent) and thedata=None→'None'jsonb error-path bug that the removed Postgres test covered.
None of these block the merge; they can be handled as fast-follows.
… coverage
Review feedback on the rig's coverage attestation: a covering group that
collected zero tests (pytest exit 5) counted as green for critical-path
coverage, so marker drift in a marker-only group like integration-backend
could bake false coverage into the baseline. Two changes close this:
- Coverage attestation now requires status == "pass"; "empty" stays
non-failing for the build but proves nothing.
- New `proof: marker` per path in critical_paths.yaml: on top of a green
covering group, the path needs >=1 passing test carrying
@pytest.mark.critical_path("<id>") in that build. A rig-injected pytest
plugin (PYTHONPATH + -p, junit_family=legacy) copies marker args into
junit testcase properties; the rig reads back only passing testcases.
Tests may stack multiple markers. Unknown marker ids fail the run so a
typo can't silently attest nothing.
adapter-register-llm is flipped to proof: marker and its API test marked —
deleting that test now drops the path to regression instead of hiding
behind the rest of integration-backend staying green. Other paths stay
proof: group until their tests are backfilled and marked.
Verified: rig self-tests 64 passed; integration-backend via testcontainers
52 passed / 26 skipped / 1 xfailed with adapter-register-llm reported
covered via the junit marker property (under xdist).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
…t on broken changes job Address remaining PR review findings: - Restore test_bigquery_db.py and test_mariadb.py: unlike the five live-DB smoke tests deleted alongside them, these are pure mock-based unit tests that ran green in CI and were the only coverage of BigQuery's Forbidden/NotFound exception mapping and MariaDB's SSL-param build + 1045/2003 message mapping. They rejoin unit-connectors (unmarked). - Restore test_insert_into_db_with_error_postgresql as strict xfail: it exercises a real shipping bug (get_sql_values_for_query serializes data=None as the literal string 'None', invalid JSON for the jsonb column) that deleting the test papered over. The xfail keeps the error path exercised in CI and flips loudly when the bug is fixed. - ci-test.yaml: the report job now also needs `changes` and runs whenever changes did not succeed. Previously a failed changes job (checkout or paths-filter flake) skipped test -> skipped report -> the required check passed green with zero tests run. Skip remains only for a legitimate skip decided by a successful changes job (irrelevant paths / draft). Verified: integration-backend via testcontainers reports the restored error test as xfailed; unit-connectors 63 passed (+10 from the restored files). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
- Extract per-path classification out of evaluate() to cut cognitive complexity (S3776) - Drop unused config param from pytest_collection_modifyitems; pytest matches hook args by name (S1172) - Use a real GroupManifest in the marker-proof validation test instead of a duck-typed stub (S5655) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
|
Contributor
Unstract test resultsPer-group results
Critical paths
|
chandrasekharan-zipstack
added a commit
that referenced
this pull request
Jul 8, 2026
test_no_flask_import, the test_miniofs comment, and the groups.yaml Fernet comment were intentionally dropped or shortened in #2115; keep main's version rather than the e2e branch's re-additions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU
chandrasekharan-zipstack
added a commit
that referenced
this pull request
Jul 10, 2026
* UN-3632 [FIX] Scope rig --fail-on-critical-gap to in-tier coverage so main runs green The rig's unit/integration CI job had never passed on main. `--fail-on-critical-gap` (passed only on the main push) failed the build on EVERY uncovered critical path, including e2e-only paths run during the unit/integration tier and paths with no test anywhere. Every group-level failure was already non-gating (optional groups, or exit 5 = no tests collected), so the gap gate was the sole cause of redness. - Split critical-path gaps into in-scope vs out-of-scope (add `in_scope` to CriticalPathStatus; evaluate() already computed it). --fail-on-critical-gap now gates only on in-scope gaps — a declared in-tier covering group that didn't run green (real coverage regressed). Out-of-scope gaps (covered only by an unrun tier, or no declared coverage) are reported + logged but never gate that tier. - Wire honest coverage that exists today: adapter-register-llm -> unit-sdk1. Gives the path teeth: if sdk1 regresses, it flips to an in-scope gap and fails. - Drop unit-tool-registry group (component slated for removal; can't even collect). - Delete 3 dead tests referencing removed code: core test_pandora_account.py (account_services removed), core test_pubsub_helper.py (LogHelper -> LogPublisher), platform-service test_auth_middleware.py (platform_service.main removed; also made live Postgres calls). unit-platform-service is green via its hermetic memory-leak test; unit-core has no valid tests left and skips as a placeholder. New self-tests cover the in-scope/out-of-scope split at both evaluate() and cmd_run(). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XJqp7xMdd1kjLUKbvrJsq4 * test: prune dead rig groups/paths, park deprecated services, wire backend tests Follow-up cleanup on the rig manifests (UN-3636): - Park unit-runner and unit-prompt-service (commented out, not run by default) with a TODO to delete when those services are removed — both are being decommissioned; no value testing components on their way out. - Drop the unit-tool-registry NOTE block entirely. - Prune 6 unit-backend paths that collect zero tests (account_v2, api_deployment_v2, connector_v2, file_management, project, tenant_account_v2 — dirs missing or empty); optional skip-if-missing was hiding them and implying coverage that was never written. - Wire two real backend tests into unit-backend: * middleware/test_exception.py — 5 hermetic tests, pass now. * prompt_studio/prompt_studio_core_v2/tests — pins the executor _handle_ide_index async path (no prompt-service coupling); runs once unit-backend is un-gated, skips safely until then. - Comment out the tool-sandbox-exec critical path (TODO: remove with tool-registry/runner) — its covering group unit-runner is now parked. `python -m tests.rig validate` → OK (13 groups, 9 critical paths). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * fix: make rig editable-install survive uv run re-sync; drop phantom Django setting unit-core ran 0 tests / 2 collection errors (ModuleNotFoundError: No module named 'unstract'). Root cause: _prepare_group_env did `uv pip install -e .` for install_editable groups, but _pytest_command runs `uv run`, which re-syncs the venv every call and wipes that install before pytest imports the package — the same hazard the code already flagged for plugins. Inject the package via `uv run --with-editable <workdir>` (survives the re-sync, same mechanism as the RIG_PYTEST_PLUGINS `--with` specs) and drop the wiped `uv pip install -e .`. unit-core now 27 passed, 0 errors. Also remove DJANGO_SETTINGS_MODULE from the repo-root [tool.pytest.ini_options]: it's a pytest-django option that warns "Unknown config option" for every non-Django group, points at a non-existent module (backend.settings.test_cases), and Django settings don't belong at the polyglot repo root. The rig injects it per-group via groups.yaml env for unit-backend only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: make unit-backend collect + run django_db tests in the rig The unit-backend group pointed at a non-existent settings module (backend.settings.test_cases) and ran without pytest-django, so the DB-backed tests errored at collection (Django uninitialised) and the django_db tests had no test-DB lifecycle. Make the group actually runnable: - Add pytest-django to the backend test group (bootstraps Django before collection; provides the test-DB + django_db fixtures). - Point DJANGO_SETTINGS_MODULE at the existing backend.settings.test and inject the import-time-required settings via the group env — base.py reads them before any dotenv load, so they must exist in the process env, not a settings module. ENCRYPTION_KEY is an all-zero (valid, zero-entropy) Fernet placeholder, not a real secret. - Set DB_SCHEMA=public: the app's fixed schema doesn't exist in the fresh test DB and tenancy is row-level, so migrations run in public. - Drop workflow_manager/endpoint_v2/tests from the wired paths: its destination-connector tests import the enterprise `plugins` package, absent in OSS. - Add the missing utils/file_storage{,/helpers}/__init__.py so those modules import as a package under pytest. - Stop test_build_index_payload's sys.modules stubs from leaking into sibling collection: record + restore the originals once the helper is imported (a stubbed account_v2.models was breaking other modules' real imports). unit-backend now collects clean; 126 passed, 4 skipped. The remaining 6 failures (usage_v2 helper stubs, dashboard_metrics cleanup tasks) are pre-existing test bugs tracked separately. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: fix two pre-existing backend test bugs exposed by the rig dashboard_metrics: organization FK targets Organization's int PK, but the tests passed a UUID string as organization_id, and verified rows through the org-scoped default manager (empty without a UserContext). Create a real Organization and read via _base_manager. usage_v2: drop the fragile "stub usage_v2.models into sys.modules before import" trick — under pytest-django Django imports the real module first, so the stub never took and the helper hit the DB. Rebind the Usage symbol the helper resolved instead. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: gate live connector integration tests behind credential env vars The connector suite had 12 reds that needed real external services or per-developer credentials no one has by default. Two were genuine bugs; the rest are integration tests masquerading as unit tests. Fixes (not credential-related): - mariadb: assertion text drifted from the connector's actual message ("SSL SETTINGS", not "ssl-settings"). - sharepoint: skip test_json_schema_has_is_personal — is_personal is read from settings in code but was never exposed in json_schema.json (personal vs site is inferred from an empty site_url). Whether the schema should expose it is a product decision; tracked under UN-3414. Gating (skipUnless, mirrors the existing SharePoint integration tests): - filesystems (box, gdrive, minio, pcs, dropbox) already read creds from env; add the missing skip guard so they SKIP instead of failing. - databases (mssql, mysql, postgresql, redshift, snowflake) had hardcoded personal creds (incl. a live-looking neon.tech URL and a Snowflake account) querying bespoke tables. Move creds to *_TEST_* env vars and skip unless provided, removing the secrets from the repo. CI can run these by injecting the corresponding secrets as env vars in a dedicated integration job; by default they skip cleanly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: make unit-core and unit-connectors required rig groups Both now run green and standalone (no external services; integration tests skip cleanly when credentials are absent), so drop optional: true to make them blocking merge gates per UN-3635. unit-backend stays optional until the rig provisions a reachable DB_HOST for it (UN-3636 follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * test: address PR review feedback on rig + connector test guards - in_scope defaults False on CriticalPathStatus so a future evaluate() regression that forgets it under-gates (warning) rather than over-gates (spurious build block). [greptile] - widen connector integration skip guards (redshift, snowflake, gdrive, minio, pcs) to require every env var the test hard-references, so a partially configured env skips cleanly instead of failing. [coderabbit] - usage_v2 test_helper: swap Usage via an autouse monkeypatch fixture instead of a module-level rebind that leaks FakeUsage into later tests. - build_index_payload test: evict the helper module from sys.modules after binding it, so later importers in the same process get a real copy. - drop dead tox `runner` alias (its unit-runner group was removed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: provision infra for integration tier; split DB/credential tests out of unit Make `requires_services` actually provision instead of being cosmetic. The rig now brings up testcontainers infra (Postgres/MinIO) for any runnable group that declares `requires_services`, and injects connection env into the group's pytest subprocess (Postgres URL -> discrete DB_* vars; MinIO endpoint/creds). Previously django_db tests fell back to the compose hostname `backend-db-1`, unreachable from host-side pytest, so unit-backend had to be `optional`. Reclassify infra-dependent tests by the rig's own tier taxonomy (unit = no external services, integration = real infra but not the full platform): - backend: split unit-backend into pure `unit-backend` (gates unit tier, no infra) and `integration-backend` (django_db tests: dashboard_metrics + prompt_studio_registry_v2; provisioned Postgres; gates integration tier). - connectors: marker-based split (tests are interleaved within files). Credential + MinIO tests marked `@pytest.mark.integration`; `unit-connectors` runs `-m "not integration"`, new `integration-connectors` runs `-m "integration"`. test_minio actually runs against provisioned MinIO; external-credential tests skip. Skip-guard test_http_fs (was hitting a live URL unguarded in CI). Both groups are non-optional and gate their tiers. Unit tier stays infra-free. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: address PR review — wire provisioned Redis, mark http_fs integration, cut rig complexity - integration-backend declares requires_services: [postgres, redis] but the rig only injected Postgres/MinIO env, so Redis-backed tests bypassed the testcontainer and hit localhost:6379. Inject REDIS_HOST/PORT + CELERY_BROKER_BASE_URL from the provisioned endpoint (CodeRabbit). - test_http_fs was skip-guarded but unmarked, so the connector marker split (-m "not integration") could still run it in the unit tier. Mark the module integration (CodeRabbit). - Extract _inject_infra_env and _pytest_base_cmd to bring both functions under SonarCloud's cognitive-complexity threshold. NOSONAR the test's DB_PASSWORD placeholder (not a real credential). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: use hostname not literal IP in redis-wiring test (Sonar hotspot) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: mark local testcontainers MinIO http endpoint NOSONAR The MinIO endpoint is a throwaway testcontainer with no TLS, so http is expected. Suppress the SonarCloud insecure-protocol hotspot that otherwise blocks the quality gate on new code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: stub UserDefaultAdapter so prompt-studio build-index tests run The module stubs adapter_processor_v2.models to import PromptStudioHelper without the full Django app, but only provided AdapterInstance. The helper also imports UserDefaultAdapter, so the import failed and all 4 tests in the module self-skipped via the _IMPORT_ERROR guard. Add the missing stub so the tests actually execute. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: drop prompt-service from test compose overlay Removed from the e2e test overlay; the platform brought up for e2e no longer provisions a standalone prompt-service. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: remove dead S3 smoke test and strip print() debug from connector tests - test_miniofs: drop the permanently-skipped test_s3 (hardcoded AWS S3 smoke). MinIO/S3 is covered by test_minio (integration), the TestAccessFilteredS3 unit tests, and the connectorkit registry check. - database + filesystem tests: replace print()-in-loop debug with assertions (or drop redundant prints) so integration runs don't spam the logs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: switch unit-backend to marker-based selection; classify integration tests unit-backend was a hand-kept file allowlist that had to grow with every new test dir. Collect the whole backend tree instead and let markers decide: tests needing live infra carry `@pytest.mark.integration` and are excluded from the unit tier via `-m "not integration"`. - register the `integration` marker in backend/pyproject.toml - mark the two DB-bound suites (dashboard_metrics, prompt_studio_registry_v2) that were previously grouped by path only - add a conftest marking the endpoint_v2 destination-connector subtree integration (uses django.test.TestCase -> needs Postgres). Kept out of the gating integration-backend group for now: 3 postgres destination tests are pre-existing failures and need a skip-guard/fix before they can gate. - remove the dead SharePoint `test_json_schema_has_is_personal` skip: the schema never exposes `is_personal`, so the test only ever asserted-then- skipped; drop it rather than carry a permanent skip. Verified: unit tier 116 passed / 50 deselected; integration-backend collects its marked suites; rig self-tests 54 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: centralize DB-test marking; cover adapter-register-llm via integration API test Replace the scattered integration-marking (per-file pytestmark, per-app endpoint_v2 conftest) with a single backend/conftest.py hook that auto-marks any Django TestCase/TransactionTestCase or django_db item as integration — tests declare their DB need by how they're written, not a hand-kept marker. Cover the adapter-register-llm critical path honestly: unit-sdk1 only exercises the SDK provider classes, not the HTTP endpoint, so map it to a new integration-backend APITestCase that POSTs /adapter/ (SDK context-window call mocked, everything else real). Trim comments that would go stale. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test: complete DB-test centralization; move DB-writer tests to integration tier Follow-up completing 6d61a56, which staged only the adapter API test and the deleted per-dir conftest, leaving the rest of the batch uncommitted. - backend/conftest.py: central pytest_collection_modifyitems hook auto-marks every Django TestCase/TransactionTestCase/django_db test as `integration`, so unit-backend (-m "not integration") and integration-backend (-m integration) are exact complements. Drops now-redundant per-app pytestmark in dashboard_metrics and prompt_studio_registry_v2. - critical_paths.yaml: adapter-register-llm now covered_by integration-backend (real API test), reverting the earlier unit-sdk1 placeholder mapping. - groups.yaml: integration-backend gains the adapter API test and the destination-connectors DB-writer tests (BE orchestration over the connector lib — superset of the connector-lib DB tests). Adds WORKFLOW_EXECUTION_DIR_PREFIX to the shared backend test env (ExecutionFileHandler builds paths from it). - destination-connector postgres test: read DB_SCHEMA (was hardcoded "test"), use a lowercase table name (connector lowercases on read-back), drop the error-record case (hits a latent product edge: data=None serialized as the string 'None' into a jsonb column). - Delete 7 connector-lib DB tests (databases/test_*_db.py) — superseded by the backend DB-writer tests; keep test_sql_safety.py, filesystems, connectorkit. - rig cli.py / critical_paths.py: comment + docstring cleanups. Verified (testcontainers Postgres/Redis): unit-backend 116 passed, integration-backend 24 passed / 26 skipped (external-DB engines skip w/o creds), unit-connectors 53 passed, rig validate OK (15 groups, 9 paths). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test: switch integration-backend to marker-only selection; drop dead connector_v2 tests - groups.yaml: integration-backend now selects paths ["."] with -m integration — the exact complement of unit-backend over the same tree. New backend DB tests auto-join the group with no manifest edit. Verified equivalent: collect-only shows the same 50/166 tests (116 deselected); full run against testcontainers Postgres/Redis gives the same 24 passed / 26 skipped as the hand-listed paths on CI. - Delete backend/connector_v2/tests (connector_tests.py, conftest.py, fixture): written for the pre-v2 schema — the fixture loads removed models (account.org, account.user, project) so loaddata errors immediately, and the filename never matched pytest's test_*.py pattern, so these tests have not been collected anywhere. Same dead-test cleanup as the rest of this branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * docs: concise backend test-contribution steps in tests/README.md Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * test: rewrite deployment_helper staging tests with patch.object The previous version stubbed cross-app imports in sys.modules (only when absent) — written for a bare no-Django env. Under the rig, pytest-django boots Django and the real modules are already imported, so the stubs were skipped and the tests called reset_mock() on real classes (AttributeError). Same control-flow assertions, now via mock.patch.multiple on the imported module: no sys.modules mutation, no import-order dependence, safe in a shared pytest session. Stays in the unit tier (no DB touched). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * test: drop sys.modules stub ceremony from build-index tests; subprocess flask check - test_build_index_payload.py: import the real prompt_studio_helper (Django is loaded by the rig env) instead of installing ~30 stub modules in sys.modules and restoring them post-import. The clobber/restore dance was import-order dependent and silently skipped all tests when the stub surface drifted. Tests and assertions unchanged; patches now managed via ExitStack. - test_legacy_executor_scaffold.py: test_no_flask_import now runs the check in a fresh subprocess. The in-place importlib.reload swapped class identities under sibling tests, and scanning sys.modules in-process fails if any other test imported flask. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * ci: move path filtering from trigger to job level for required-check compat Trigger-level paths-ignore means docs/frontend/docker-only PRs never start the workflow, so no check run is created and a required 'test' status check would block those PRs forever. A 'changes' job now always runs and gates 'test' via needs + if; a skipped job still reports a check run (skipped = passing for required checks), while any executed test failure still fails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGcZHkM4jbUmrx4YNYewZK * ci: fold e2e tier into the image-build workflow (e2e-build-test.yaml) ci-container-build.yaml built + booted the stack, checked nothing exited, and threw it all away; ci-test-e2e.yaml had e2e plumbing but no images to run against (VERSION never exported), so it never executed. Merge them: build once, then let the rig boot its compose project against the just- built SHA-tagged images and run the e2e tier. up -d --wait plus endpoint readiness subsumes the old exited-container check. VERSION joins tox passenv so the rig's compose subprocess can resolve the ${VERSION} image tags of the base compose file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGcZHkM4jbUmrx4YNYewZK * ci: rename workflow to ci-e2e-build-test.yaml for ci-* consistency Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGcZHkM4jbUmrx4YNYewZK * ci: pin external actions to commit SHAs in ci-e2e-build-test.yaml Sonar/GHAS flag mutable tag refs — a moved tag can silently swap the action code. Pinned to the newest release within each currently-used major, so no behavior change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TGcZHkM4jbUmrx4YNYewZK * revert: align three files to main after merge test_no_flask_import, the test_miniofs comment, and the groups.yaml Fernet comment were intentionally dropped or shortened in #2115; keep main's version rather than the e2e branch's re-additions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [DEV] cover auth-login critical path with an e2e test Add the first real e2e critical-path test: OSS mock-login over real HTTP. - tests/e2e/auth/test_login.py: POST form creds to /api/v1/login, assert 302 + sessionid cookie, confirm the session is usable via /api/v1/session; a negative test asserts bad creds don't redirect. Marked @pytest.mark.critical_path("auth-login"). - New non-optional e2e-login group (gates on failure) covering auth-login with proof: marker. Fix the path's stale entry (/api/v1/auth/login -> /api/v1/login). - Shared authed_session fixture (login + org handshake, session-scoped) so future e2e tests don't re-implement auth. - Extend the smoke gate to health-check every service, and fix _wait_ready: it probed the removed prompt-service (connection refused -> guaranteed 300s TimeoutError) and used wrong paths for runner/x2text. Both now use a single health_targets() source of truth. - Run --fail-on-critical-gap on e2e PRs too (out-of-scope gaps stay warn-only); --update-baseline remains main-only. Matches the unit/integration lane. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [FIX] install requests in the rig's per-group pytest env The e2e groups run pytest via `uv run --with ...`, whose ephemeral venv only carries the specs the rig injects — it does not sync the root project's `test-rig` dependency group where `requests` lives. So the e2e conftest's `import requests` failed with ModuleNotFoundError, killing both e2e groups at conftest load (pytest exit 4, no tests). Inject requests alongside the pytest plugins so it survives the per-call venv re-sync. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [FIX] guard empty organizations list in authed_session A fresh DB without seed data would make organizations[0] raise a bare IndexError as a fixture error across every consumer. Assert first so the failure names the cause. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [MISC] disable checkout credential persistence; tighten comments - ci-e2e-build-test.yaml: persist-credentials: false on checkout (reports/ is uploaded as an artifact; nothing after checkout needs the token). - Trim verbose comments in the workflow header, RIG_PYTEST_PLUGINS, and _wait_ready to concise WHY-only form. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [DEV] merge unit/integration/e2e into one workflow + report Collapse ci-test.yaml (unit+integration matrix + report job) and ci-e2e-build-test.yaml into a single `test` job that builds the service images and runs every tier in one `rig run all` invocation. Because all tiers are evaluated together, e2e coverage (auth-login) now shows in the same PR comment as unit/integration instead of being invisible to it. - One shared baseline cache (unstract-test-baseline-main-*); drops the ut/e2e namespacing that kept e2e coverage out of the posted report. - Single sticky `test-results` comment, rendered by `rig run all` itself (write_summary emits combined-test-report.md). Tradeoff (accepted for now): tiers run serially in one job, no path-filter skip — a docs-only PR still builds images + runs e2e (as the old e2e workflow already did). Revisit if wall-time bites. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [DEV] rewrite ci-test.yaml as the single merged test job Companion to the previous commit's workflow deletion: the merged single-job workflow content (build images + rig run all + one sticky report) belongs in ci-test.yaml. The prior commit only staged the ci-e2e-build-test.yaml removal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [FIX] run tiers separately in the merged job, not rig run all `rig run all` picks one infra mode per invocation ("platform wins"), so with e2e (compose) and integration (testcontainers) groups in one call it skips the testcontainers Postgres integration-backend needs — the backend then resolves the compose DB hostname, unreachable from host-side pytest (78 DNS errors → integration-backend red → adapter-register-llm gap → build fails). Run one rig invocation per tier instead (unit/integration on testcontainers, e2e on compose; compose up only for e2e), then `report combine` unifies every tier's junit into a single evaluation + PR comment. Both auth-login (e2e) and adapter-register-llm (integration) now show covered in one report. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [DEV] split merged test job into parallel tiers + report job Revert the single-job merge. unit/integration run as parallel matrix legs on testcontainers; e2e builds images and boots compose on its own runner. A report job needs all three, merges every tier's junit into one critical-path evaluation, and posts a single sticky PR comment. Restores unit+integration parallelism and per-tier resource isolation the merged job lost, while keeping the unified report. One baseline (report is sole reader+writer) replaces the old per-lane baselines, killing the cross-lane regression false-positive. e2e is not gated by the path filter — docker/** changes must be e2e-tested. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * UN-3636 [MISC] fix stale workflow reference in compose test overlay ci-e2e-build-test.yaml was folded into the e2e job of ci-test.yaml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
muhammad-ali-e
added a commit
that referenced
this pull request
Jul 15, 2026
…N-3735 .value fix (#2181) * UN-3185: Fix squished route-loading spinner in the content area (#2118) GenericLoader's .center uses width/height: inherit, which collapsed to a narrow column when used as LazyOutlet's content-area Suspense fallback (the loader text wrapped one word per line beside the sidebar). Wrap the fallback in a full-width, flex-centered .lazyOutletFallback box and pin .center to width:100% so it renders centered at its natural size. The top-level loader in Router.jsx is unaffected (it doesn't use this wrapper). * UN-3185: Pin LLM profile form submit button as a sticky footer (#2119) * UN-3185: Pin LLM profile form submit button as a sticky footer In the prompt-studio Settings modal, the LLM-profile Add/Edit form put its submit button (Update/Add) as the last element in normal flow inside a fixed 800px scroll column. When the form is tall — e.g. Advanced Settings expanded — the button flowed past the modal's visible area and appeared to overflow. - Make the button a sticky footer (position: sticky; bottom: 0) with a solid themed background so it stays pinned at the bottom of the scroll column and fields scroll beneath it. - The form root's .settings-body-pad-top declared overflow-y: auto with no bounded height — a dead nested scroll context that would stop the sticky footer from pinning to the real scroller (.conn-modal-col). Override it back to visible for this form (scoped via .add-llm-profile-scroll-root). Verified the sticky pinning against the real CSS rules; build green, biome clean. * Apply suggestion from @greptile-apps[bot] Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Signed-off-by: Jaseem Jas <89440144+jaseemjaskp@users.noreply.github.com> --------- Signed-off-by: Jaseem Jas <89440144+jaseemjaskp@users.noreply.github.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * [MISC] Decommission prompt-service, old tools, SDK1 prompt module (#1978) * [MISC] Decommission prompt-service, old tools, and SDK1 prompt module (Phase 5) Remove prompt-service source, Dockerfiles, and docker-compose entries. Remove tools/classifier, tools/structure, tools/text_extractor directories. Remove SDK1 prompt.py module and its tests. Clean up PROMPT_HOST/PROMPT_PORT from backend settings, sample envs, docker configs, and CI workflows. Remove prompt-service from uv-lock scripts and production build workflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * [MISC] Remove prompt-service from tox.ini env_list The prompt-service directory was deleted in the prior commit but tox.ini still referenced it, which would break CI test runs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * UN-2888 [FIX] Add hook for setting default triad for invited users (#1877) * [FIX] Add hook for setting default adapters for invited users Add setup_default_adapters_for_user() hook to AuthenticationService and call it from set_user_organization() when an invited user joins an existing organization. This allows the cloud plugin to set up default triad adapters (LLM, embedding, vector DB, x2text) for invited users, fixing silent failures in API deployment creation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update backend/account_v2/authentication_controller.py Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Signed-off-by: Praveen Kumar <praveen@zipstack.com> * [FIX] Improve log message for setup_default_adapters_for_user Address review comment: log user email and explain that default adapters will not be set when the method is not implemented. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * [MISC] Rename Default Triad to Default LLM Profile in UI Update display label from "Default Triad" to "Default LLM Profile" in the page heading and side navigation menu. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Signed-off-by: Praveen Kumar <praveen@zipstack.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Deepak K <89829542+Deepak-Kesavan@users.noreply.github.com> * UN-3465 [FIX] Wrap set_user_organization in transaction.atomic (#1954) * [FIX] Wrap set_user_organization in transaction.atomic The new-org branch creates the org row, then calls frictionless onboarding and the initial platform key. Failures mid-flow leave an orphan org with no adapters or key, and subsequent logins skip onboarding entirely (gated on new_organization). Atomic ensures the org rolls back on any failure so retries get a clean fresh-org path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [MISC] Worktree skill — use --no-track to prevent accidental main pushes Without --no-track, a later `git push -u origin <branch>` can be reported by the server as also fast-forwarding main, landing commits on main. * [FIX] Use logger.exception in authorization_callback Preserves the traceback when the OAuth callback hits the safety-net catch. Behaviour unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Athul <89829560+athul-rs@users.noreply.github.com> Co-authored-by: vishnuszipstack <117254672+vishnuszipstack@users.noreply.github.com> * UN-3386 [FEAT] Add Prompt Studio HITL change indicator plugin slot (#1930) * UN-3386 [FEAT] Add Prompt Studio HITL change indicator plugin slot Wires up the host-side hooks for the prompt-change-indicator plugin (implementation lives in unstract-cloud): a dynamic-import slot in the prompt card Header for the indicator button, and a route at :orgName/review/readonly/:documentId for the read-only audit view. Both gates fall through gracefully when the plugin is absent (OSS). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * UN-3386 [FIX] Warn when ReadOnlyReviewPage loads without ReviewLayout Addresses review feedback: the readonly route nests inside ReviewLayout (manual-review plugin), so a deployment that ships prompt-change-indicator without manual-review would silently fail to register the route. Log a console.warn in that case to make the misconfiguration discoverable. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * UN-3386 [FIX] Surface real plugin import errors in route loader Bare catch in the prompt-change-indicator dynamic import was swallowing syntax/runtime errors in the plugin file alongside the expected "plugin missing in OSS" case. Detect the missing-module messages explicitly and console.error anything else so a broken cloud plugin no longer disables the readonly route silently. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add a dedicated OpenAI-compatible LLM adapter (#1895) * Add OpenAI-compatible LLM adapter * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Address review feedback for custom OpenAI adapter * Fix import formatting after rebase * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Address follow-up review comments for OpenAI-compatible adapter * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Refine OpenAI compatible adapter schema naming * Reject empty model string in OpenAICompatibleLLMParameters validate_model previously produced "custom_openai/" for an empty model, surfacing as a confusing LiteLLM error at call time. Match the existing GeminiLLMParameters.validate_model pattern: strip whitespace, raise ValueError on empty input. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Revert SCHEMA_PATH plumbing; rename schema to custom_openai.json Addresses Ritwik's review feedback. The new BaseAdapter.SCHEMA_PATH class variable and the conditional branch in get_json_schema() are unnecessary: OpenAICompatibleLLMAdapter.get_provider() returns "custom_openai", and the default path resolution already builds …/llm1/static/{get_provider()}.json. Renaming the schema file lets the default lookup find it and keeps the base class untouched, which is the convention every other adapter follows. - Rename openai_compatible.json -> custom_openai.json - Drop SCHEMA_PATH class var and the if-None branch from BaseAdapter - Drop SCHEMA_PATH override (and unused os/ClassVar imports) from OpenAICompatibleLLMAdapter - Update test_openai_compatible_schema_is_loadable to read schema via get_json_schema() instead of touching SCHEMA_PATH directly --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Hari John Kuriakose <hari@zipstack.com> Co-authored-by: Chandrasekharan M <chandrasekharan@zipstack.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Athul <athul@zipstack.com> Co-authored-by: Athul <89829560+athul-rs@users.noreply.github.com> Co-authored-by: vishnuszipstack <117254672+vishnuszipstack@users.noreply.github.com> * ReverseMerge: V0.163.4 hotfix (#1980) * [HOTFIX] Use importlib.util.find_spec for pluggable worker discovery (#1918) * [FIX] Use importlib.util.find_spec for pluggable worker discovery _verify_pluggable_worker_exists() previously checked for the literal file `pluggable_worker/<name>/worker.py` on disk, which breaks when the plugin has been compiled to a .so (Nuitka, Cython, or any C extension) — the module is perfectly importable but the pre-check rejects it because only the .py extension is considered. Replace the filesystem check with importlib.util.find_spec(), which is Python's standard way to ask "is this module resolvable by the import system?". It honors every registered finder — source .py, compiled .so, bytecode .pyc, namespace packages, zipimports — so the function now matches what its docstring claims: verifying the module can be loaded, not that a specific file extension is present. Behavior is preserved for existing deployments: - Images with no `pluggable_worker/<name>/` subpackage → find_spec raises ModuleNotFoundError (ImportError subclass) → returns False. - Images with source .py → find_spec resolves the .py → returns True. - Images with compiled .so → find_spec resolves the .so → returns True. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [FIX] Handle ValueError from find_spec in pluggable worker verification Greptile-flagged edge case: importlib.util.find_spec() can raise ValueError (not just ImportError) when sys.modules has a partially initialised module entry with __spec__ = None from a prior failed import. Broaden the except to catch both. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [FIX] Resolve api-deployment worker directory from enum import path worker.py:452 did worker_type.value.replace("-", "_") to derive the on-disk dir name. All WorkerType enum values already use underscores, so the replace was a no-op; for API_DEPLOYMENT whose dir is "api-deployment" (hyphen), it resolved to "api_deployment" and the os.path.exists() check failed. Boot then logged a spurious "❌ Worker directory not found: /app/api_deployment" at ERROR level. The task registration path (builder + celery autodiscover via to_import_path) is unaffected, so this was purely log noise — but noise at ERROR level that masks real failures in log scans. Fix: derive the directory from the authoritative to_import_path() which already handles the hyphen case (api_deployment -> api-deployment). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [HOTFIX] Add IAM Role / Instance Profile auth mode to AWS Bedrock adapter (#1944) * [FEAT] Allow Bedrock to fall through to boto3's default credential chain Match the S3/MinIO connector pattern: when AWS access keys are left blank on the Bedrock LLM and embedding adapter forms, drop them from the kwargs dict so boto3's default credential chain handles authentication. This unlocks IAM role / instance profile / IRSA / AWS Profile scenarios on hosts that already have ambient AWS credentials (e.g. EKS workers with IRSA, EC2 with an instance profile). - llm1/static/bedrock.json: clarify access-key descriptions to mention IRSA and instance profile (already non-required at v0.163.2 base). - embedding1/static/bedrock.json: drop aws_access_key_id and aws_secret_access_key from top-level required; same description fix; expose aws_profile_name for parity with the LLM form. - base1.py: AWSBedrockLLMParameters and AWSBedrockEmbeddingParameters now strip empty access-key values from the validated kwargs before returning, so empty strings don't override boto3's default chain. AWSBedrockEmbeddingParameters fields gain explicit None defaults and an aws_profile_name field. Backward-compatible: existing adapters with access keys filled in continue to work unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [FEAT] Add Authentication Type selector to Bedrock adapter form Add an explicit `auth_type` selector with two options, making the auth choice clear to users: - "Access Keys" (default): existing flow, keys required - "IAM Role / Instance Profile (on-prem AWS only)": no fields; relies on boto3's default credential chain (IRSA on EKS, task role on ECS, instance profile on EC2). Description on the selector explicitly notes this option is only for AWS-hosted Unstract deployments. The form-only auth_type field is stripped before LiteLLM validation in both AWSBedrockLLMParameters.validate() and AWSBedrockEmbeddingParameters. validate(). Empty access keys continue to be stripped so boto3 falls through to the default chain even when the access_keys arm is selected without values (matches the S3/MinIO connector pattern). Backward-compatible: legacy adapters without auth_type behave as "Access Keys" mode (the default), and existing keys are forwarded unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [REVIEW] Address Bedrock auth_type review feedback Fixes the P0/P1 issues raised by greptile-apps and jaseemjaskp on PR #1944. Behaviour fixes: - Stale-key leak in IAM Role mode: switching an existing adapter from Access Keys to IAM Role would carry truthy stored access keys through the strip-empty-only loop, so boto3 silently authenticated with the old long-lived credentials instead of falling through to the host's IRSA / instance-profile identity. Both LLM and embedding paths were affected. - Silent acceptance of unknown auth_type: a typo (e.g. "access_key") or a malformed payload from a non-UI client passed through the dict comprehension untouched, with no enum guard. - Cross-field validation gap: explicit Access Keys mode with blank or whitespace-only values silently fell through to the default credential chain instead of surfacing the misconfiguration. Implementation: - Add a module-level _resolve_bedrock_aws_credentials helper used by both AWSBedrockLLMParameters.validate() and AWSBedrock EmbeddingParameters.validate(), so the auth-type contract is expressed once. - Validates auth_type against an allowlist (None | "access_keys" | "iam_role"); raises ValueError on anything else. - iam_role: unconditionally drops aws_access_key_id and aws_secret_access_key. - access_keys (explicit): requires non-blank values; raises ValueError if either is empty or whitespace-only. - Legacy (auth_type absent): retains the lenient strip behaviour so pre-PR adapter configurations continue to deserialise unchanged. - Restore aws_region_name as required (no `= None` default) on AWSBedrockEmbeddingParameters; only credentials may legitimately be absent. - Drop the orphan aws_profile_name field from embedding1/static/bedrock.json: it was added for parity with the LLM form but lives outside the auth_type oneOf and contradicts the selector's "no further input" semantics. The LLM form already had aws_profile_name pre-PR and is left alone for backwards compatibility. Tests: - New tests/test_bedrock_adapter.py covers 15 cases across LLM and embedding adapters: legacy-no-auth-type, explicit access_keys with valid/blank/whitespace keys, iam_role with stale/no keys, unknown auth_type rejection, cross-field validation, and preservation of unrelated params (model_id, aws_profile_name, region, thinking). Skipped (P2 nice-to-have): - Comment-scope clarification, MinIO reference rewording, validate-mutates-caller'\''s-dict, and the LLM form description nit about aws_profile_name visibility. These don'\''t change behaviour and can be addressed in a follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> * [HOTFIX] Bump litellm to 1.83.10 from PyPI to clear CVE-2026-42208 (#1976) Hotfix for cloud v0.159.3 (OSS v0.163.4). Customer scanner flagged litellm 1.82.3 for CVE-2026-42208 (SQL injection in litellm proxy auth path, affects 1.81.16-1.83.6). We do not use litellm.proxy, but vulnerability scanners flag the installed package regardless of which code path is reachable. Bump to 1.83.10 — the exact version recommended by the upstream advisory (v1.83.10-stable) and the smallest jump that clears the CVE range while keeping python-dotenv==1.0.1 compatible (1.83.14 would force bumping python-dotenv across 7+ pyproject.toml files). Only tiktoken needed to move 0.9 -> 0.12 to satisfy litellm's pin. Switch source back to PyPI now that the PyPI quarantine is over, reversing the temporary fork in #1873. Cohere embed timeout patch: verified that litellm/llms/cohere/embed/handler.py is byte-identical between v1.82.3, v1.83.10-stable, and v1.83.14-stable (the timeout-not-forwarded bug fixed in #1848 is still present upstream — BerriAI/litellm#14635 remains OPEN). Version guard bumped 1.82.3 -> 1.83.10; 6/6 patch tests pass on the new version, confirming the monkey-patch still binds correctly. Other cleanup from #1873: - Drop git apt-install from worker-unified and tool Dockerfiles (no git-sourced deps remain in any uv.lock) - Bump tool versions: structure 0.0.100 -> 0.0.101, classifier 0.0.79 -> 0.0.80, text_extractor 0.0.75 -> 0.0.76 Note on root uv.lock churn: the v0.163.4 root uv.lock had a pre-existing corruption (banks v2.4.1 entry pointing at banks-2.2.0 wheel) that blocked incremental resolution. Regenerated from scratch. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [FIX] Align cohere patch docstring with version-guard semantics Reviewer flagged that the docstring claimed the patch is "confirmed in every release between 1.82.3 and 1.83.14-stable", but the guard at _PATCHED_LITELLM_VERSION activates only on the exact pinned version. A future maintainer reading the old text could reasonably expect bumping to e.g. 1.83.11 to keep the fix active; in reality it silently turns off. Rewritten to reference _PATCHED_LITELLM_VERSION as the single source of truth and to drop the rot-prone "as of 2026-05-20" calendar date. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Chandrasekharan M <117059509+chandrasekharan-zipstack@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> * UN-3476 [FIX] Revert atomic wrap on set_user_organization (#1977) The atomic wrap from #1954 uncommits the new org row when frictionless_onboarding HTTP-calls the LLMW portal mid-transaction. The portal runs on a separate DB session and under READ COMMITTED cannot see the uncommitted row, so the call returns 400 and the caller silently persists an adapter with an empty unstract_key. Every new signup since 2026-05-19 09:47 UTC ships a broken free-trial X2Text adapter (401 on first OCR). Hotfix only — Phase 2 (UN-3476) restructures the function so the atomic guarantee is reapplied around just the pure-DB writes, with HTTP and non-DB side effects moved outside the transaction. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Restore text_extractor tool removed in Phase 5 decommission The Phase 5 decommission commit removed classifier, structure, text_extractor, and prompt-service. However, text_extractor is still in active use by customers. This surgically restores only the text_extractor tool while keeping the other decommissions in place. - Restore tools/text_extractor/ directory (14 files from origin/main) - Add tool-text_extractor back to docker-compose.build.yaml - Add tool-text-extractor back to docker-tools-build-push.yaml workflow Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Restore classifier tool removed in Phase 5 decommission Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove unit-prompt-service group from test rig manifest The prompt-service directory was deleted in the decommission PR, but the test rig groups.yaml still referenced it, causing CI to fail with "workdir does not exist" during validate and integration steps. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove deleted prompt-service and structure tool refs from bump script prompt-service/ and tools/structure/ are deleted by this PR, so remove their variables, reset_file calls, and the entire update_structure_tool_version function from bump_sdk_v0_version.sh. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix stale references from decommissioned components - Fix tool-text_extractor image name to tool-text-extractor in docker-compose.build.yaml to match CI, registry, and cloud naming - Remove stale tool-structure from run-platform.sh ignore list - Drop prompt-service from is_retryable_error docstring in retry_utils.py Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Trigger CI re-run Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Signed-off-by: Praveen Kumar <praveen@zipstack.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Praveen Kumar <praveen@zipstack.com> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> Co-authored-by: Deepak K <89829542+Deepak-Kesavan@users.noreply.github.com> Co-authored-by: Chandrasekharan M <117059509+chandrasekharan-zipstack@users.noreply.github.com> Co-authored-by: Athul <89829560+athul-rs@users.noreply.github.com> Co-authored-by: vishnuszipstack <117254672+vishnuszipstack@users.noreply.github.com> Co-authored-by: jimmy <ziming_zhu2002@163.com> Co-authored-by: Hari John Kuriakose <hari@zipstack.com> Co-authored-by: Chandrasekharan M <chandrasekharan@zipstack.com> Co-authored-by: Athul <athul@zipstack.com> * UN-3185 [FIX] Deterministic CSS cascade (single bundle) + asset gzip + Edit LLM Profile modal layout (#2128) * fix(frontend): bundle all CSS into one file to fix lazy-load cascade order Code-splitting (#2114) injects per-route CSS at navigation time, so equal-specificity rules across components resolve in load order — breaking the Edit LLM Profile form and Execution Logs header layout (UN-3185). cssCodeSplit:false restores a single deterministic stylesheet; JS splitting is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * perf(frontend): gzip static assets (css/js/fonts), not just html nginx `gzip on` only compresses text/html by default, so JS/CSS shipped uncompressed. Add gzip_types so the single CSS bundle (~341KB -> ~57KB) and all JS chunks compress on the wire — offsets the cssCodeSplit:false upfront cost and speeds every asset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * fix(frontend): clean up Edit LLM Profile modal padding & drop dead scroll classes Remove settings-body-pad-top + add-llm-profile-scroll-root from the form root (the shared overflow-y:auto added a nested scroll context that #2119 only patched over). The sticky footer now pins directly to .conn-modal-col. Replace the dead override with a :has()-scoped padding so .conn-modal-form-pad-left is adjusted for this panel alone — sibling settings panels and the connector dialog are untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * perf(frontend): gzip_proxied any so assets compress behind the LB nginx skips gzip for proxied requests by default (gzip_proxied off); the GKE load balancer adds a Via header to every request, so static assets shipped uncompressed despite gzip_types. Verified gzip works direct-to-pod. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * fix(frontend): remove inner scrollbar on Edit LLM Profile modal The settings row is hard-fixed at 800px, forcing the form's column (.conn-modal-col) to scroll once Advanced Settings expands. Let the row size to the form so the modal grows instead. Scoped via :has to the LLM profile panel — the other settings panels and the connector dialog share .conn-modal-row/-col and are untouched (so the shared class stays; it is not unused). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * docs: tighten code comments in CSS/vite/nginx changes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * style: drop comments from AddLlmProfile.css changes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg * fix: drop pre-compressed font types from gzip_types WOFF2 (Brotli) and WOFF (zlib) are already compressed; re-gzipping wastes CPU for no size gain. application/font-woff also never matches nginx's mime.types (.woff -> font/woff), so it was a no-op. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015DsoHbMN7kTTWwcVC6NNkg --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * UN-3185 [FIX] Restore global Prism for prismjs add-ons (Prompt Studio detail + HITL blank page) (#2135) * UN-3185 [FIX] Restore global Prism for prismjs add-ons (Prompt Studio detail + HITL blank page) The Vite production build tree-shakes the bare `import "prismjs"` in CombinedOutput.jsx (a side-effect-only import with no used bindings), so nothing installs the global `Prism` that `prismjs/components/prism-json` and the line-numbers plugin reference. Those add-ons then throw `ReferenceError: Prism is not defined` at module evaluation, crashing the Combined Output viewer shared by the Prompt Studio detail page and the HITL / manual-review page (both render blank). The old CRA/webpack build did not tree-shake it, so the regression only surfaces on the Vite build. Add a dedicated prismSetup module that imports Prism core with a *used* binding (survives tree-shaking) and pins it on globalThis, and import it before the add-ons in CombinedOutput so the global is guaranteed present by the time the add-on modules evaluate. Verified against a production `vite build`: the emitted chunk now runs `globalThis.Prism = <core>` immediately before `Prism.languages.json = ...`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * UN-3185 [FIX] Simplify globalThis guard in prismSetup (review) Drop the always-true `typeof globalThis !== "undefined"` check — globalThis is universally available in any ESM/Vite target. Addresses Greptile review. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * UN-3185 [FIX] Install global Prism unconditionally + correct rationale (review) Address PR review: - silent-failure-hunter: a `!globalThis.Prism` guard could leave a different, pre-existing Prism in place, so the add-ons extend one instance while JsonView's highlightAll() reads another -> JSON silently unhighlighted. Assign unconditionally so the global is provably our core instance. - comment-analyzer: the prior comment blamed evaluation order yet relied on it to justify the fix. Rewrite: relying on prismjs core's self-install is unreliable under code-splitting; the explicit globalThis assignment (from first-party code imported before the add-ons) is the deterministic fix. Rebuilt: emitted chunk runs `globalThis.Prism = <core>` immediately before `Prism.languages.json = ...`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * UN-3185 [FIX] Install global Prism eagerly at app entry (fixes HITL too) Verified against the actual on-prem image (built with the manual-review plugin): the per-component prismSetup import did NOT fix it. Because manual-review's ResultEditor also imports `prismjs/components/prism-json`, Rollup hoists that add-on into a SHARED lazy chunk (PdfViewer), separate from CombinedOutput's chunk where prismSetup ran — with no ordering guarantee between two lazy chunks, so the add-on still evaluated before the global was installed. My local OSS build masked this: with no manual-review plugin, prism-json wasn't shared and stayed in CombinedOutput's chunk. Fix: import prismSetup EAGERLY from index.jsx so `globalThis.Prism` is installed at bootstrap, before any lazy chunk (including the shared add-on chunk) can load. Robust regardless of how Rollup hoists prism-json. Reproduced the shared-chunk hoist locally (two independent lazy prism-json importers) and confirmed: prism-json lands in its own lazy chunk while globalThis.Prism stays in the eager entry <script type=module>, so the global is always installed first. Fixes both the Prompt Studio detail page and the HITL review page. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * UN-2265 [FEAT] Show the running platform version on the profile page (#2034) * UN-2265 Display platform version in the frontend profile page Bake the build VERSION into the frontend image as UNSTRACT_APPS_VERSION (same pattern as backend.Dockerfile), surface it through the runtime config injected at container start, and show it as a 'Platform Version' field on the profile page. Production CI already passes *.args.VERSION to all images via docker bake, so published images carry the real version on every deployment target; the field is hidden when no version is available (e.g. local npm start). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * UN-2265 Address review: empty VERSION default, escape value in runtime config - ARG VERSION defaults to empty so images built without a version hide the field instead of showing 'dev' - Escape backslashes/quotes before embedding the version in the generated JS * UN-2265 [FIX] Source platform version from runtime env, not baked image RC->stable promotion re-tags images (it does not rebuild), so a version baked into the frontend image at build time would stay frozen at the rc tag after promotion. Drop the frontend.Dockerfile ARG/ENV baking and instead supply UNSTRACT_APPS_VERSION from docker-compose using ${VERSION} -- the same value that already tags the image, so the displayed version always matches what runs. Addresses review from @ritwik-g / @ejhari (version must come dynamically from compose in OSS and the Helm chart in Enterprise). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * [MISC] Add 'auto' version bump to OSS create-release (#2136) * [MISC] Add 'auto' version bump to OSS create-release Adds an 'auto' choice (now the default) to create-release.yaml that picks the OSS version bump from merged PR titles: a [FEAT]/[GATED-FEAT] PR merged since the last release -> minor, otherwise patch. These are the only feature PR types in the contribution guide, so this matches the documented SemVer intent without any new labeling. Details: - 'auto' resolves in a new "Resolve auto bump" step (main mode only; hotfix lines stay patch-only). Fail-safe is always patch, so a compare/PR query hiccup never over-bumps the public version. - Hotfix-mode input validation now accepts 'auto' (maps to patch). - compute-version consumes the resolved bump; dry-run/final summaries show "auto -> minor/patch" for an explicit audit trail. - 'auto' never selects major — that stays behind the confirm_major gate. Validated by replaying the classifier over the last 13 real releases: 12/13 matched the human bump; the lone diff was a discretionary minor with no FEAT PR (recoverable via manual minor override, which the notice points to). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [MISC] Address review: PR-read perms, patch fallback, truncation warning - Add `pull-requests: read` to the job (the permissions block sets unlisted scopes to none, so `gh pr list` would 403 and 'auto' would silently always fall back to patch). [CodeRabbit] - BUMP_TYPE falls back to 'patch' instead of 'auto' when resolved is empty, avoiding a latent "Unknown bump type: 'auto'" job failure. [Greptile] - Surface a warning when the merged-PR query hits the 200-result cap instead of silently under-counting FEAT PRs. [Greptile] Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * [MISC] Harden auto-bump resolve step (review follow-ups) From a multi-agent review of the auto-bump step: - Guard the jq parses: malformed/non-array stdout now degrades to patch instead of crashing the job under set -e/pipefail (upholds the "never fail the release outright" invariant). Also validates TOTAL/FEAT_COUNT are numeric before arithmetic. - Detect gh failure by exit status (if ! PR_JSON=$(...)) and surface captured stderr, so a permanent 403 (e.g. dropped pull-requests scope) is diagnosable rather than a cause-free warning that silently patches forever. - Add '// empty' to the published_at lookup for consistency with get-latest, so a JSON null can't leak through as the literal "null". - Only emit the truncation warning when no FEAT was found within the cap (the only case where truncation could change the outcome). - Fix an inaccurate comment ("silently" -> "with a warning") and reword the self-referential permissions comment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * UN-3648: Mark API deployment execution ERROR on synchronous staging failure (#2120) * UN-3648: Mark API deployment execution ERROR on synchronous staging failure When an API-deployment run failed synchronously at the "Staging files in API storage" step (add_input_file_to_api_storage, before async dispatch), the PENDING WorkflowExecution row was never marked ERROR, so the UI showed the run as stuck/running forever and the real error wasn't surfaced. Root cause: in api_v2/deployment_helper.py -> execute_workflow(), the staging call sat outside the try/except. Only execute_workflow_async failures were handled, and the DB row is marked ERROR by execute_workflow_async internally -- a path a staging failure never reaches. Fix: - Move staging inside the try so synchronous failures are handled. - In the except, explicitly call update_execution_err() to mark the row ERROR with the surfaced reason (the existing handler only did cleanup + built an error response, it never marked the DB row). Add a regression test (sys.modules-stub style, no Django/DB) asserting a staging exception marks the execution ERROR, releases the rate-limit slot, and never reaches async dispatch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * UN-3648: scope staging error-handling to pre-dispatch failures (review) Address Greptile P1 + CodeRabbit Major on PR #2120: - Give the synchronous staging call its own try/except instead of sharing the try with execute_workflow_async + post-dispatch processing. Error-marking (update_execution_err) now applies only to genuine pre-dispatch failures and can no longer overwrite an already-dispatched/completed execution's status. - Isolate the update_execution_err call in its own try/except so a transient DB error while marking ERROR no longer skips slot release and storage cleanup (which were unconditional before this PR). - Restore the dispatch/post-processing except to its original behaviour (slot release + storage cleanup only); dispatch failures are already marked ERROR internally by execute_workflow_async. Add a regression test asserting cleanup still runs when update_execution_err itself raises. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Drop ticket/incident references from in-code comments Keep code comments focused on explaining the code; ticket and incident context lives in the commit/PR history instead. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * UN-3584 [FEAT] Restrict LLM adapter creation to org admins (controlled mode) (#2132) * UN-3584 [FEAT] Restrict LLM adapter creation to org admins (controlled mode) Add a per-org 'restrict_llm_adapter_creation' setting (default off). When an org admin enables it, only organization admins may create LLM adapters: non-admin create requests are rejected with 403 and a contact-admin message. Other adapter types and the default-off behavior are unchanged. - account_v2: new BooleanField on Organization + migration - tenant_account_v2: admin-only GET/PATCH organization/settings endpoint - adapter_processor_v2: enforce the gate in AdapterInstanceViewSet.create - frontend: admin-only toggle in Platform Settings * UN-3584 [FIX] Gate LLM-restriction toggle to enterprise builds (hide in OSS) Org admin roles / user management don't exist in OSS, so the controlled-mode toggle must not render there. Probe for an enterprise-only plugin (absent in OSS) and show the toggle only on enterprise/cloud builds, mirroring the plugin-gating idiom in SideNavBar. Backend is already OSS-safe: the flag defaults off and the create gate never fires. * UN-3584 [FIX] Address PR review: service-account bypass, modified_by audit, extract gate - Bypass the LLM-creation gate for service accounts (platform API-key sessions), consistent with how the rest of the permission layer treats them (Greptile P1). - Set Organization.modified_by on the settings PATCH so the audit field isn't left stale (Greptile P2). - Extract the controlled-mode check into _enforce_llm_creation_restriction to bring AdapterInstanceViewSet.create back under the cognitive-complexity limit (SonarQube). * UN-3584 [FIX] Bind adapter creation to request org (prevent payload org override) AdapterInstanceSerializer exposes organization via fields=__all__, and DefaultOrganizationMixin.save only fills it when None — so a payload-supplied organization would persist. Pass organization=UserContext.get_organization() to serializer.save() so the row is bound to the same request-scoped org the controlled-mode check evaluates, closing a per-org restriction bypass (CodeRabbit security finding). * UN-3585 [FEAT] Restrict connector creation to org admins (controlled mode) (#2145) * UN-3584 [FEAT] Restrict LLM adapter creation to org admins (controlled mode) Add a per-org 'restrict_llm_adapter_creation' setting (default off). When an org admin enables it, only organization admins may create LLM adapters: non-admin create requests are rejected with 403 and a contact-admin message. Other adapter types and the default-off behavior are unchanged. - account_v2: new BooleanField on Organization + migration - tenant_account_v2: admin-only GET/PATCH organization/settings endpoint - adapter_processor_v2: enforce the gate in AdapterInstanceViewSet.create - frontend: admin-only toggle in Platform Settings * UN-3584 [FIX] Gate LLM-restriction toggle to enterprise builds (hide in OSS) Org admin roles / user management don't exist in OSS, so the controlled-mode toggle must not render there. Probe for an enterprise-only plugin (absent in OSS) and show the toggle only on enterprise/cloud builds, mirroring the plugin-gating idiom in SideNavBar. Backend is already OSS-safe: the flag defaults off and the create gate never fires. * UN-3584 [FIX] Address PR review: service-account bypass, modified_by audit, extract gate - Bypass the LLM-creation gate for service accounts (platform API-key sessions), consistent with how the rest of the permission layer treats them (Greptile P1). - Set Organization.modified_by on the settings PATCH so the audit field isn't left stale (Greptile P2). - Extract the controlled-mode check into _enforce_llm_creation_restriction to bring AdapterInstanceViewSet.create back under the cognitive-complexity limit (SonarQube). * UN-3584 [FIX] Bind adapter creation to request org (prevent payload org override) AdapterInstanceSerializer exposes organization via fields=__all__, and DefaultOrganizationMixin.save only fills it when None — so a payload-supplied organization would persist. Pass organization=UserContext.get_organization() to serializer.save() so the row is bound to the same request-scoped org the controlled-mode check evaluates, closing a per-org restriction bypass (CodeRabbit security finding). * UN-3585 [FEAT] Restrict connector creation to org admins (controlled mode) * UN-3585 [FIX] Address PR review: split settings validation from mutation; correct org-binding comment * UN-3585 [FIX] Hoist connector admin check before payload validation (fail-fast) * UN-3586 [FEAT] Allow platform API key rotation via API (#2133) * UN-3586 [FEAT] Allow platform API key self-rotation via API Operational automation (RLDatix) needs credential rotation through the API, but the rotate endpoint was gated by IsOrganizationAdmin, which rejects service accounts — so a platform API key could not rotate itself. Add CanRotatePlatformApiKey for the rotate action: session callers still must be org admins (may rotate any key in the org), while a platform API key (bearer) may rotate ONLY its own key (pk == request.platform_api_key.id). Cross-org access remains impossible (auth middleware + org-scoped queryset); this only relaxes the intra-org gate to self-rotation. read keys still can't POST (middleware), so only read_write/full_access keys reach rotate. rotate returns the new key once via PlatformApiKeyDetailSerializer. No model or migration change. * UN-3586 [FIX] Move rotate self-check to has_object_permission (PR review) Relocate the 'key may rotate only its own key' constraint from has_permission (view-level, via view.kwargs[pk]) to has_object_permission, the idiomatic DRF location for per-object access control — it receives the already-fetched obj. has_permission stays as the coarse session-vs-key gate. Behavior is unchanged (self-rotate 200, cross-key 403): this permission is only used by the rotate detail action, which calls get_object() and so always triggers the object-level check. (Greptile) * UN-3586 [FIX] Allow key-based callers to rotate any key (drop self-only) Empirically confirmed on staging that rotating a platform API key via the API (bearer token) is blocked (403 'Only organization admins...') — the automation path UN-3586 asks for. Enable it: a platform API key caller may rotate, same as a session org admin. Drop the earlier self-only restriction (not a ticket requirement) and the now-unneeded has_object_permission. Org scoping (auth middleware + org-scoped queryset) still confines a key to its own org; read keys still can't POST (middleware). rotate already returns the new key. * UN-3586 [FIX] Require full_access key to rotate (close privilege escalation) Greptile caught a real privilege escalation: after dropping self-only, a read_write bearer key could rotate a full_access key and read its new secret from the rotate response (rotate returns the new key), escalating read_write -> full_access. Fix: key-based callers must present a full_access key to rotate. read_write keys can no longer rotate; a full_access caller rotating any key gains no privilege (already top tier) and matches what a session admin can do. Session-admin rotate and org scoping unchanged. * UN-3636 [MISC] Make the rig unit/integration CI job green on main (#2115) * UN-3632 [FIX] Scope rig --fail-on-critical-gap to in-tier coverage so main runs green The rig's unit/integration CI job had never passed on main. `--fail-on-critical-gap` (passed only on the main push) failed the build on EVERY uncovered critical path, including e2e-only paths run during the unit/integration tier and paths with no test anywhere. Every group-level failure was already non-gating (optional groups, or exit 5 = no tests collected), so the gap gate was the sole cause of redness. - Split critical-path gaps into in-scope vs out-of-scope (add `in_scope` to CriticalPathStatus; evaluate() already computed it). --fail-on-critical-gap now gates only on in-scope gaps — a declared in-tier covering group that didn't run green (real coverage regressed). Out-of-scope gaps (covered only by an unrun tier, or no declared coverage) are reported + logged but never gate that tier. - Wire honest coverage that exists today: adapter-register-llm -> unit-sdk1. Gives the path teeth: if sdk1 regresses, it flips to an in-scope gap and fails. - Drop unit-tool-registry group (component slated for removal; can't even collect). - Delete 3 dead tests referencing removed code: core test_pandora_account.py (account_services removed), core test_pubsub_helper.py (LogHelper -> LogPublisher), platform-service test_auth_middleware.py (platform_service.main removed; also made live Postgres calls). unit-platform-service is green via its hermetic memory-leak test; unit-core has no valid tests left and skips as a placeholder. New self-tests cover the in-scope/out-of-scope split at both evaluate() and cmd_run(). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XJqp7xMdd1kjLUKbvrJsq4 * test: prune dead rig groups/paths, park deprecated services, wire backend tests Follow-up cleanup on the rig manifests (UN-3636): - Park unit-runner and unit-prompt-service (commented out, not run by default) with a TODO to delete when those services are removed — both are being decommissioned; no value testing components on their way out. - Drop the unit-tool-registry NOTE block entirely. - Prune 6 unit-backend paths that collect zero tests (account_v2, api_deployment_v2, connector_v2, file_management, project, tenant_account_v2 — dirs missing or empty); optional skip-if-missing was hiding them and implying coverage that was never written. - Wire two real backend tests into unit-backend: * middleware/test_exception.py — 5 hermetic tests, pass now. * prompt_studio/prompt_studio_core_v2/tests — pins the executor _handle_ide_index async path (no prompt-service coupling); runs once unit-backend is un-gated, skips safely until then. - Comment out the tool-sandbox-exec critical path (TODO: remove with tool-registry/runner) — its covering group unit-runner is now parked. `python -m tests.rig validate` → OK (13 groups, 9 critical paths). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * fix: make rig editable-install survive uv run re-sync; drop phantom Django setting unit-core ran 0 tests / 2 collection errors (ModuleNotFoundError: No module named 'unstract'). Root cause: _prepare_group_env did `uv pip install -e .` for install_editable groups, but _pytest_command runs `uv run`, which re-syncs the venv every call and wipes that install before pytest imports the package — the same hazard the code already flagged for plugins. Inject the package via `uv run --with-editable <workdir>` (survives the re-sync, same mechanism as the RIG_PYTEST_PLUGINS `--with` specs) and drop the wiped `uv pip install -e .`. unit-core now 27 passed, 0 errors. Also remove DJANGO_SETTINGS_MODULE from the repo-root [tool.pytest.ini_options]: it's a pytest-django option that warns "Unknown config option" for every non-Django group, points at a non-existent module (backend.settings.test_cases), and Django settings don't belong at the polyglot repo root. The rig injects it per-group via groups.yaml env for unit-backend only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: make unit-backend collect + run django_db tests in the rig The unit-backend group pointed at a non-existent settings module (backend.settings.test_cases) and ran without pytest-django, so the DB-backed tests errored at collection (Django uninitialised) and the django_db tests had no test-DB lifecycle. Make the group actually runnable: - Add pytest-django to the backend test group (bootstraps Django before collection; provides the test-DB + django_db fixtures). - Point DJANGO_SETTINGS_MODULE at the existing backend.settings.test and inject the import-time-required settings via the group env — base.py reads them before any dotenv load, so they must exist in the process env, not a settings module. ENCRYPTION_KEY is an all-zero (valid, zero-entropy) Fernet placeholder, not a real secret. - Set DB_SCHEMA=public: the app's fixed schema doesn't exist in the fresh test DB and tenancy is row-level, so migrations run in public. - Drop workflow_manager/endpoint_v2/tests from the wired paths: its destination-connector tests import the enterprise `plugins` package, absent in OSS. - Add the missing utils/file_storage{,/helpers}/__init__.py so those modules import as a package under pytest. - Stop test_build_index_payload's sys.modules stubs from leaking into sibling collection: record + restore the originals once the helper is imported (a stubbed account_v2.models was breaking other modules' real imports). unit-backend now collects clean; 126 passed, 4 skipped. The remaining 6 failures (usage_v2 helper stubs, dashboard_metrics cleanup tasks) are pre-existing test bugs tracked separately. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: fix two pre-existing backend test bugs exposed by the rig dashboard_metrics: organization FK targets Organization's int PK, but the tests passed a UUID string as organization_id, and verified rows through the org-scoped default manager (empty without a UserContext). Create a real Organization and read via _base_manager. usage_v2: drop the fragile "stub usage_v2.models into sys.modules before import" trick — under pytest-django Django imports the real module first, so the stub never took and the helper hit the DB. Rebind the Usage symbol the helper resolved instead. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: gate live connector integration tests behind credential env vars The connector suite had 12 reds that needed real external services or per-developer credentials no one has by default. Two were genuine bugs; the rest are integration tests masquerading as unit tests. Fixes (not credential-related): - mariadb: assertion text drifted from the connector's actual message ("SSL SETTINGS", not "ssl-settings"). - sharepoint: skip test_json_schema_has_is_personal — is_personal is read from settings in code but was never exposed in json_schema.json (personal vs site is inferred from an empty site_url). Whether the schema should expose it is a product decision; tracked under UN-3414. Gating (skipUnless, mirrors the existing SharePoint integration tests): - filesystems (box, gdrive, minio, pcs, dropbox) already read creds from env; add the missing skip guard so they SKIP instead of failing. - databases (mssql, mysql, postgresql, redshift, snowflake) had hardcoded personal creds (incl. a live-looking neon.tech URL and a Snowflake account) querying bespoke tables. Move creds to *_TEST_* env vars and skip unless provided, removing the secrets from the repo. CI can run these by injecting the corresponding secrets as env vars in a dedicated integration job; by default they skip cleanly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: make unit-core and unit-connectors required rig groups Both now run green and standalone (no external services; integration tests skip cleanly when credentials are absent), so drop optional: true to make them blocking merge gates per UN-3635. unit-backend stays optional until the rig provisions a reachable DB_HOST for it (UN-3636 follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * test: address PR review feedback on rig + connector test guards - in_scope defaults False on CriticalPathStatus so a future evaluate() regression that forgets it under-gates (warning) rather than over-gates (spurious build block). [greptile] - widen connector integration skip guards (redshift, snowflake, gdrive, minio, pcs) to require every env var the test hard-references, so a partially configured env skips cleanly instead of failing. [coderabbit] - usage_v2 test_helper: swap Usage via an autouse monkeypatch fixture instead of a module-level rebind that leaks FakeUsage into later tests. - build_index_payload test: evict the helper module from sys.modules after binding it, so later importers in the same process get a real copy. - drop dead tox `runner` alias (its unit-runner group was removed). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: provision infra for integration tier; split DB/credential tests out of unit Make `requires_services` actually provision instead of being cosmetic. The rig now brings up testcontainers infra (Postgres/MinIO) for any runnable group that declares `requires_services`, and injects connection env into the group's pytest subprocess (Postgres URL -> discrete DB_* vars; MinIO endpoint/creds). Previously django_db tests fell back to the compose hostname `backend-db-1`, unreachable from host-side pytest, so unit-backend had to be `optional`. Reclassify infra-dependent tests by the rig's own tier taxonomy (unit = no external services, integration = real infra but not the full platform): - backend: split unit-backend into pure `unit-backend` (gates unit tier, no infra) and `integration-backend` (django_db tests: dashboard_metrics + prompt_studio_registry_v2; provisioned Postgres; gates integration tier). - connectors: marker-based split (tests are interleaved within files). Credential + MinIO tests marked `@pytest.mark.integration`; `unit-connectors` runs `-m "not integration"`, new `integration-connectors` runs `-m "integration"`. test_minio actually runs against provisioned MinIO; external-credential tests skip. Skip-guard test_http_fs (was hitting a live URL unguarded in CI). Both groups are non-optional and gate their tiers. Unit tier stays infra-free. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: address PR review — wire provisioned Redis, mark http_fs integration, cut rig complexity - integration-backend declares requires_services: [postgres, redis] but the rig only injected Postgres/MinIO env, so Redis-backed tests bypassed the testcontainer and hit localhost:6379. Inject REDIS_HOST/PORT + CELERY_BROKER_BASE_URL from the provisioned endpoint (CodeRabbit). - test_http_fs was skip-guarded but unmarked, so the connector marker split (-m "not integration") could still run it in the unit tier. Mark the module integration (CodeRabbit). - Extract _inject_infra_env and _pytest_base_cmd to bring both functions under SonarCloud's cognitive-complexity threshold. NOSONAR the test's DB_PASSWORD placeholder (not a real credential). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: use hostname not literal IP in redis-wiring test (Sonar hotspot) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: mark local testcontainers MinIO http endpoint NOSONAR The MinIO endpoint is a throwaway testcontainer with no TLS, so http is expected. Suppress the SonarCloud insecure-protocol hotspot that otherwise blocks the quality gate on new code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: stub UserDefaultAdapter so prompt-studio build-index tests run The module stubs adapter_processor_v2.models to import PromptStudioHelper without the full Django app, but only provided AdapterInstance. The helper also imports UserDefaultAdapter, so the import failed and all 4 tests in the module self-skipped via the _IMPORT_ERROR guard. Add the missing stub so the tests actually execute. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: drop prompt-service from test compose overlay Removed from the e2e test overlay; the platform brought up for e2e no longer provisions a standalone prompt-service. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: remove dead S3 smoke test and strip print() debug from connector tests - test_miniofs: drop the permanently-skipped test_s3 (hardcoded AWS S3 smoke). MinIO/S3 is covered by test_minio (integration), the TestAccessFilteredS3 unit tests, and the connectorkit registry check. - database + filesystem tests: replace print()-in-loop debug with assertions (or drop redundant prints) so integration runs don't spam the logs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: switch unit-backend to marker-based selection; classify integration tests unit-backend was a hand-kept file allowlist that had to grow with every new test dir. Collect the whole backend tree instead and let markers decide: tests needing live infra carry `@pytest.mark.integration` and are excluded from the unit tier via `-m "not integration"`. - register the `integration` marker in backend/pyproject.toml - mark the two DB-bound suites (dashboard_metrics, prompt_studio_registry_v2) that were previously grouped by path only - add a conftest marking the endpoint_v2 destination-connector subtree integration (uses django.test.TestCase -> needs Postgres). Kept out of the gating integration-backend group for now: 3 postgres destination tests are pre-existing failures and need a skip-guard/fix before they can gate. - remove the dead SharePoint `test_json_schema_has_is_personal` skip: the schema never exposes `is_personal`, so the test only ever asserted-then- skipped; drop it rather than carry a permanent skip. Verified: unit tier 116 passed / 50 deselected; integration-backend collects its marked suites; rig self-tests 54 passed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01C5HQX5CSoMR6RzHtXcfwJt * test: centralize DB-test marking; cover adapter-register-llm via integration API test Replace the scattered integration-marking (per-file pytestmark, per-app endpoint_v2 conftest) with a single backend/conftest.py hook that auto-marks any Django TestCase/TransactionTestCase or django_db item as integration — tests declare their DB need by how they're written, not a hand-kept marker. Cover the adapter-register-llm critical path honestly: unit-sdk1 only exercises the SDK provider classes, not the HTTP endpoint, so map it to a new integration-backend APITestCase that POSTs /adapter/ (SDK context-window call mocked, everything else real). Trim comments that would go stale. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test: complete DB-test centralization; move DB-writer tests to integration tier Follow-up completing 6d61a566, which staged only the adapter API test and the deleted per-dir conftest, leaving the rest of the batch uncommitted. - backend/conftest.py: central pytest_collection_modifyitems hook auto-marks every Django TestCase/TransactionTestCase/django_db test as `integration`, so unit-backend (-m "not integration") and integration-backend (-m integration) are exact complements. Drops now-redundant per-app pytestmark in dashboard_metrics and prompt_studio_registry_v2. - critical_paths.yaml: adapter-register-llm now covered_by integration-backend (real API test), reverting the earlier unit-sdk1 placeholder mapping. - groups.yaml: integration-backend gains the adapter API test and the destination-connectors DB-writer tests (BE orchestration over the connector lib — superset of the connector-lib DB tests). Adds WORKFLOW_EXECUTION_DIR_PREFIX to the shared backend test env (ExecutionFileHandler builds paths from it). - destination-connector postgres test: read DB_SCHEMA (was hardcoded "test"), use a lowercase table name (connector lowercases on read-back), drop the error-record case (hits a latent product edge: data=None serialized as the string 'None' into a jsonb column). - Delete 7 connector-lib DB tests (databases/test_*_db.py) — superseded by the backend DB-writer tests; keep test_sql_safety.py, filesystems, connectorkit. - rig cli.py / critical_paths.py: comment + docstring cleanups. Verified (testcontainers Postgres/Redis): unit-backend 116 passed, integration-backend 24 passed / 26 skipped (external-DB engines skip w/o creds), unit-connectors 53 passed, rig validate OK (15 groups, 9 paths). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test: switch integration-backend to marker-only selection; drop dead connector_v2 tests - groups.yaml: integration-backend now selects paths ["."] with -m integration — the exact complement of unit-backend over the same tree. New backend DB tests auto-join the group with no manifest edit. Verified equivalent: collect-only shows the same 50/166 tests (116 deselected); full run against testcontainers Postgres/Redis gives the same 24 passed / 26 skipped as the hand-listed paths on CI. - Delete backend/connector_v2/tests (connector_tests.py, conftest.py, fixture): written for the pre-v2 schema — the fixture loads removed models (account.org, account.user, project) so loaddata errors immediately, and the filename never matched pytest's test_*.py pattern, so these tests have not been collected anywhere. Same dead-test cleanup as the rest of this branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * docs: concise backend test-contribution steps in tests/README.md Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * test: rewrite deployment_helper staging tests with patch.object The previous version stubbed cross-app imports in sys.modules (only when absent) — written for a bare no-Django env. Under the rig, pytest-django boots Django and the real modules are already imported, so the stubs were skipped and the tests called reset_mock() on real classes (AttributeError). Same control-flow assertions, now via mock.patch.multiple on the imported module: no sys.modules mutation, no import-order dependence, safe in a shared pytest session. Stays in the unit tier (no DB touched). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017UVfw7aAocC3KCJaEyZ5GU * test: drop sys.modules stub ceremony from build-index tests; subprocess flask check - test_bui…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Make the rig's unit/integration CI job (
.github/workflows/ci-test.yaml) a reliable, green, parallel check — the groundwork for making it a required PR merge gate (UN-3635). Checklist item #1 of UN-3636.Why
The job had never passed on
main:--fail-on-critical-gapfailed the build on every uncovered critical path, including paths only coverable by tiers that didn't run. Beyond that, backend test selection was hand-listed, several test files were dead or never collected, and the two tiers ran serially.How
Gating
--fail-on-critical-gapnow runs on PRs and main: main is gap-free and PRs test the merge ref, so a PR gap failure can only be self-introduced.status == "pass"— a group that collected zero tests ("empty", pytest exit 5) stays non-failing but no longer proves coverage.proof: markerintests/critical_paths.yaml: on top of a green covering group, the path needs ≥1 passing test carrying@pytest.mark.critical_path("<id>")in that build (tests may stack several markers). A rig-injected pytest plugin copies marker args into junit testcase properties; the rig reads back only passing testcases, and unknown marker ids fail the run.adapter-register-llmis flipped toproof: marker; the rest stayproof: groupuntil their tests are backfilled and marked.Test selection & hygiene
backend/conftest.pyauto-marks DB-bound tests (TestCase/TransactionTestCase/django_db) asintegration;unit-backendandintegration-backendare exact complements overpaths: ["."]— no hand-kept lists.python_filesstandardized across backend/workers/sdk1/connectors:test_*.py,*_test.py,*_tests.py, plus Django's per-apptests.py— which surfaced 28 real, passing tests (tenant_account_v2,account_v2) that were never being collected.sys.modules(broke under whole-tree collection with Django loaded) tomock.patchon real modules:api_v2/tests/test_deployment_helper.py,prompt_studio_core_v2/tests/test_build_index_payload.py.adapter-register-llm(adapter_processor_v2/tests/test_adapter_api.py) — drivesPOST /api/v1/adapter/end-to-end, marked@pytest.mark.critical_path("adapter-register-llm").test_pandora_account.py+test_pubsub_helper.py, platform-servicetest_auth_middleware.py,connector_v2tests (v1-era fixtures, never collected), the redundant no-flask guard test, and the uncollectableunit-tool-registrygroup. Live-DB connector smoke tests (skip-without-creds) were deleted as superseded by the backend DB-writer tests; per review, the two mock-only ones (test_bigquery_db.py,test_mariadb.py) are restored — they were the only coverage of those connectors' error mapping.test_insert_into_db_with_error_postgresqlrestored as strict xfail: it exercises a real latent bug (data=Noneserialized as the literal string'None', invalid for the jsonb column) — kept red-but-expected in CI instead of deleted, flips loudly when the bug is fixed.tests/README.md: contributor guide — filename patterns, tier inference, seeding/mocking rules, local run commands.CI workflow
changesjob now turnsreportred instead of green-skipping the whole chain.reportjob aggregates reports, unions coverage, posts the PR comment, and propagates tier failures — making it suitable as the single required check.report combine --update-baseline(new rig flag) is the sole writer, on green main builds only.Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)
No. Changes are confined to the test rig, CI workflow, and test files — no production/runtime code. Gate changes only relax out-of-tier failure conditions; real in-tier coverage regressions still fail.
Database Migrations
Env Config
Relevant Docs
tests/README.md,tests/rig/Related Issues or PRs
Dependencies Versions
Notes on Testing
test (unit)+test (integration)in parallel,reportaggregating.unit-backend118 passed;integration-backend52 passed, 26 skipped, 1 xfailed (skips = destination-connector engine tests gated on external credentials) withadapter-register-llmattested via the junit marker property;unit-connectors63 passed; rig self-tests 64 passed;rig validateOK (15 groups, 9 critical paths).Deferred (separate PRs under UN-3636):
endpoint_v2/tests/destination-connectors/engine suites (skip-without-creds today).unit-workersmarker fix (collects 0 tests).Screenshots
Checklist
I have read and understood the Contribution Guidelines.