openclaw/.github/workflows/ci-check-testbox.yml

name: Blacksmith Testbox
on:
  workflow_dispatch:
    inputs:
      testbox_id:
        type: string
        description: "Testbox session ID"
        required: true
      timeout_minutes:
        type: number
        description: "Maximum GitHub job runtime for long Testbox commands"
        default: 120
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]
    paths:
      - ".github/workflows/**"

permissions:
  contents: read

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('{0}-pr-v1-{1}', github.workflow, github.event.pull_request.number) || format('{0}-manual-v1-{1}', github.workflow, github.run_id) }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: "false"

jobs:
  check:
    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.draft }}
    permissions:
      contents: read
    name: "check"
    # Pull requests only validate the hydration steps; real Testbox leases arrive via dispatch.
    runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'blacksmith-16vcpu-ubuntu-2404' }}
    timeout-minutes: ${{ fromJSON(inputs.timeout_minutes || '120') }}
    steps:
      # Testbox lifecycle actions require Blacksmith VM metadata; PRs validate our setup steps only.
      - name: Begin Testbox
        if: github.event_name == 'workflow_dispatch'
        uses: useblacksmith/begin-testbox@233448af4bfdc6fca509a7f0974411ac6d8a8043
        with:
          testbox_id: ${{ inputs.testbox_id }}
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          # Dispatch hydrates the pinned workflow ref; changed-gate sync later
          # reconstructs its exact base and final tree. PR validation keeps both commits.
          fetch-depth: ${{ github.event_name == 'pull_request' && '2' || '1' }}
          persist-credentials: false
      - name: Setup Node environment
        uses: ./.github/actions/setup-node-env
        with:
          install-bun: "false"
          install-trufflehog: "true"
          # Real Testbox hydration reuses the protected dependency snapshot.
          # Pull-request validation runs on GitHub-hosted runners instead.
          sticky-disk: ${{ github.event_name == 'workflow_dispatch' && 'true' || 'false' }}
          use-actions-cache: ${{ github.event_name == 'workflow_dispatch' && 'false' || 'true' }}
      - name: Ensure Testbox base commit
        if: github.event_name == 'pull_request'
        uses: ./.github/actions/ensure-base-commit
        with:
          base-sha: ${{ github.event.pull_request.base.sha }}
          fetch-ref: ${{ github.event.pull_request.base.ref }}
      - name: Prepare Testbox shell
        uses: ./.github/actions/prepare-testbox-shell
        with:
          base-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || 'HEAD' }}

      - name: Hydrate Testbox provider env helper
        shell: bash
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          ANTHROPIC_API_KEY_OLD: ${{ secrets.ANTHROPIC_API_KEY_OLD }}
          ANTHROPIC_API_TOKEN: ${{ secrets.ANTHROPIC_API_TOKEN }}
          BYTEPLUS_API_KEY: ${{ secrets.BYTEPLUS_API_KEY }}
          CEREBRAS_API_KEY: ${{ secrets.CEREBRAS_API_KEY }}
          DEEPINFRA_API_KEY: ${{ secrets.DEEPINFRA_API_KEY }}
          DASHSCOPE_API_KEY: ${{ secrets.DASHSCOPE_API_KEY }}
          FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
          FIREWORKS_API_KEY: ${{ secrets.FIREWORKS_API_KEY }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
          GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
          KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
          MINIMAX_API_KEY: ${{ secrets.MINIMAX_API_KEY }}
          MODELSTUDIO_API_KEY: ${{ secrets.MODELSTUDIO_API_KEY }}
          MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
          OPENCODE_ZEN_API_KEY: ${{ secrets.OPENCODE_ZEN_API_KEY }}
          OPENCLAW_LIVE_BROWSER_CDP_URL: ${{ secrets.OPENCLAW_LIVE_BROWSER_CDP_URL }}
          OPENCLAW_LIVE_SETUP_TOKEN: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN }}
          OPENCLAW_LIVE_SETUP_TOKEN_MODEL: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_MODEL }}
          OPENCLAW_LIVE_SETUP_TOKEN_PROFILE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_PROFILE }}
          OPENCLAW_LIVE_SETUP_TOKEN_VALUE: ${{ secrets.OPENCLAW_LIVE_SETUP_TOKEN_VALUE }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          OPENAI_BASE_URL: ${{ secrets.OPENAI_BASE_URL }}
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          QWEN_API_KEY: ${{ secrets.QWEN_API_KEY }}
          FAL_KEY: ${{ secrets.FAL_KEY }}
          RUNWAY_API_KEY: ${{ secrets.RUNWAY_API_KEY }}
          DEEPGRAM_API_KEY: ${{ secrets.DEEPGRAM_API_KEY }}
          TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }}
          VYDRA_API_KEY: ${{ secrets.VYDRA_API_KEY }}
          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
          ZAI_API_KEY: ${{ secrets.ZAI_API_KEY }}
          Z_AI_API_KEY: ${{ secrets.Z_AI_API_KEY }}
          BYTEPLUS_ACCESS_KEY_ID: ${{ secrets.BYTEPLUS_ACCESS_KEY_ID }}
          BYTEPLUS_SECRET_ACCESS_KEY: ${{ secrets.BYTEPLUS_SECRET_ACCESS_KEY }}
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          OPENCLAW_CODEX_AUTH_JSON: ${{ secrets.OPENCLAW_CODEX_AUTH_JSON }}
          OPENCLAW_CODEX_CONFIG_TOML: ${{ secrets.OPENCLAW_CODEX_CONFIG_TOML }}
          OPENCLAW_CLAUDE_JSON: ${{ secrets.OPENCLAW_CLAUDE_JSON }}
          OPENCLAW_CLAUDE_CREDENTIALS_JSON: ${{ secrets.OPENCLAW_CLAUDE_CREDENTIALS_JSON }}
          OPENCLAW_CLAUDE_SETTINGS_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_JSON }}
          OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON: ${{ secrets.OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON }}
          OPENCLAW_GEMINI_SETTINGS_JSON: ${{ secrets.OPENCLAW_GEMINI_SETTINGS_JSON }}
        run: bash scripts/ci-hydrate-testbox-env.sh

      - name: Run Testbox
        uses: useblacksmith/run-testbox@3f60ff9ceb2c10c3feefa87dc0c6490cffae059d
        if: github.event_name == 'workflow_dispatch' && always()
        env:
          FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

      - name: Close Testbox SSH sessions
        if: github.event_name == 'workflow_dispatch' && always()
        shell: bash
        run: |
          set -euo pipefail

          # Testbox state stores Blacksmith's external forwarded port. Resolve
          # sshd's VM-local listener because that is the sport visible to ss.
          runner_ssh_local_port="$(sudo sshd -T 2>/dev/null | awk '$1 == "port" { print $2; exit }')"
          if [[ ! "$runner_ssh_local_port" =~ ^[0-9]+$ ]] ||
            (( runner_ssh_local_port < 1 || runner_ssh_local_port > 65535 )); then
            echo "No valid local SSH listener port found; skipping session cleanup"
            exit 0
          fi

          # run-testbox has no post hook. Close only Testbox client sockets so
          # Blacksmith's runner teardown does not wait for its 290-second grace.
          timeout --signal=KILL 5s sudo ss -K state established \
            "( sport = :${runner_ssh_local_port} )" || true