Repository navigation
Add a deploy compose E2E that runs an agent through the real images - #729
Merged
Merged
Conversation
Nothing previously verified the deployable ARTIFACTS — every agent-run E2E ran
in-process on the runner with the CLI installed on the runner, never through
the built worker image, and nothing exercised the API↔worker split as a
deployed system. This adds that.
backend/deploy/e2e/run.sh builds the real api + worker images and boots the
real production topology (Postgres + lean API with processing OFF + worker with
processing ON), then over HTTP: probes both pods' anonymous health endpoints,
asserts the API image carries zero agent-execution machinery, seeds a team +
user, launches a quick task, and asserts the WORKER drives the agent through
its own image to a terminal Success. The harness is pointed at a fake codex
(deploy/e2e/fake-codex), so NO model credential or network is needed; the test
is deterministic (proven stable 3/3 locally). A path-filtered CI lane runs it.
Building the real stack surfaced a real deploy requirement the in-process tests
never hit: CODESPACE_VARIABLE_MASTER_KEY (the AES-256 variable-encryption key)
is mandatory in non-Development. The compose documents the full required env:
the DB connection, Authentication__Jwt__SymmetricKey, and the master key.
Confinement is intentionally not exercised here (the container won't grant
unprivileged userns) — real bubblewrap confinement stays the Sandbox lane's job.
## Test plan
- [x] backend/deploy/e2e/run.sh green 3/3 locally: both images build, both pods
healthy, API lean, launch → run Enqueued → Success (the worker ran the agent)
- [x] New CI lane `Deploy · Compose E2E`, path-filtered to the deploy assets + the
boot wiring
Depends on the three deploy PRs (DataProtection #725, worker image #727, health +
queue #728); merge after those. The diff reduces to just deploy/** + the workflow
once they land on main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The capstone for the deploy work — the first verification of the deployable artifacts (not just their logic). Every prior agent-run E2E ran in-process on the runner with the CLI installed on the runner; nothing ran an agent through the built worker image, and nothing exercised the API↔worker split as a deployed system.
What it does
backend/deploy/e2e/run.shbuilds the realapi+workerimages and boots the real production topology (Postgres + lean APIprocessing=false+ workerprocessing=true), then over HTTP:/health/live+/health/readySuccessThe harness is pointed at a fake codex (
deploy/e2e/fake-codex), so it needs no model credential or network and is deterministic — proven stable 3/3 locally (run →Enqueued → Success, "Agent run created. Harness=codex-cli", "MCP tool fabric ready").A real deploy requirement it surfaced
Building the real stack hit a mandatory secret the in-process tests never did:
CODESPACE_VARIABLE_MASTER_KEY(AES-256 variable-encryption key, required in non-Development). The compose now documents the full required env for the k8s deploy: the DB connection,Authentication__Jwt__SymmetricKey, andCODESPACE_VARIABLE_MASTER_KEY.Confinement is intentionally not exercised here (the container won't grant unprivileged userns) — real bubblewrap confinement stays the
Sandbox · Isolationlane's job.This E2E needs the worker image (#727), the health endpoints (#728), and DataProtection persistence (#725). The
Deploy · Compose E2ECI lane will be RED on this PR until those three land onmain(it builds main's current images, which lack the baked CLIs + health endpoints). It is proven green on the integrated stack locally. Merge #725, #727, #728 first; this lane then goes green.Test plan
backend/deploy/e2e/run.shgreen 3/3 on the integrated stack: both images build, both pods healthy, API lean, launch →Enqueued → SuccessDeploy · Compose E2E