oar-integration.yml

name: OAR live integration

"on":
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review, labeled, unlabeled]
    paths:
      - .github/workflows/oar-integration.yml
      - .github/actions/setup-review-gateway/**
      - projects/tools/openshell-agent-runner/src/**
      - projects/tools/openshell-agent-runner/pyproject.toml
      - projects/tools/openshell-agent-runner/uv.lock
      - projects/tools/openshell-agent-runner/tests/fixtures/pipeline-integration/**
  push:
    branches: [main]
    paths:
      - .github/workflows/oar-integration.yml
      - .github/actions/setup-review-gateway/**
      - projects/tools/openshell-agent-runner/src/**
      - projects/tools/openshell-agent-runner/pyproject.toml
      - projects/tools/openshell-agent-runner/uv.lock
      - projects/tools/openshell-agent-runner/tests/fixtures/pipeline-integration/**
  workflow_dispatch:

permissions: {}

concurrency:
  group: oar-integration-${{ github.ref }}
  cancel-in-progress: true

jobs:
  bypass:
    name: Report manual live OAR bypass
    if: >-
      vars.OAR_SKIP_LIVE == 'true' ||
      contains(github.event.pull_request.labels.*.name, 'skip-oar-live')
    runs-on: ubuntu-latest
    timeout-minutes: 1
    steps:
      - name: Explain bypass
        env:
          REPOSITORY_BYPASS: ${{ vars.OAR_SKIP_LIVE == 'true' }}
        run: |
          if [[ "$REPOSITORY_BYPASS" == 'true' ]]; then
            reason='Repository variable OAR_SKIP_LIVE=true.'
          else
            reason='PR label skip-oar-live.'
          fi
          echo "::warning::Live OAR integration manually bypassed. $reason"
          {
            echo '## Live OAR integration manually bypassed'
            echo
            echo "$reason"
            echo 'No live execution was verified. Offline functional, package, and runtime checks remain enabled.'
          } >> "$GITHUB_STEP_SUMMARY"

  integration:
    name: Run installed OAR through OpenShell
    # Candidate OAR code runs on the host: restrict secrets to trusted branches.
    if: >-
      vars.OAR_SKIP_LIVE != 'true' &&
      !contains(github.event.pull_request.labels.*.name, 'skip-oar-live') &&
      ((github.event_name == 'pull_request' &&
       !github.event.pull_request.draft &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.actor != 'dependabot[bot]') ||
      (github.event_name != 'pull_request' &&
       github.ref == format('refs/heads/{0}', github.event.repository.default_branch)))
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout tested revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false

      - name: Set up uv and Python
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.12.5"
          python-version: "3.12"
          enable-cache: true
          cache-dependency-glob: projects/tools/openshell-agent-runner/uv.lock

      - name: Install the wheel and prepare the contract input
        working-directory: projects/tools/openshell-agent-runner
        env:
          REVIEW_MODEL: ${{ secrets.MODEL_ID_TOP }}
        run: |
          uv build --no-sources --out-dir "$RUNNER_TEMP/wheels"
          uv venv "$RUNNER_TEMP/oar-venv"
          wheel=("$RUNNER_TEMP"/wheels/*.whl)
          test "${#wheel[@]}" -eq 1
          uv pip install --python "$RUNNER_TEMP/oar-venv/bin/python" "${wheel[0]}"
          oar="$RUNNER_TEMP/oar-venv/bin/oar"
          "$oar" init "$RUNNER_TEMP/profiles" --profile code-reviewer \
            --model "$REVIEW_MODEL" --thinking off
          cp tests/fixtures/pipeline-integration/* "$RUNNER_TEMP/profiles/code-reviewer/"
          "$oar" validate "$RUNNER_TEMP/profiles/code-reviewer"
          mkdir -p "$RUNNER_TEMP/oar-integration"
          printf 'Input for workflow run %s, attempt %s.\n' "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" \
            > "$RUNNER_TEMP/oar-integration/input.txt"

      - name: Start ephemeral gateway
        id: gateway
        uses: ./.github/actions/setup-review-gateway
        with:
          api-key: ${{ secrets.INFERENCE_API_KEY }}
          base-url: ${{ secrets.INFERENCE_BASE_URL }}
          model: ${{ secrets.MODEL_ID_TOP }}

      - name: Exercise the installed CLI
        run: |
          "$RUNNER_TEMP/oar-venv/bin/oar" run "$RUNNER_TEMP/profiles/code-reviewer" \
            --task echo-input --input "$RUNNER_TEMP/oar-integration/input.txt" \
            --prompt-var "marker=$GITHUB_RUN_ID" --gateway openshell \
            --timeout-seconds 300 --output "$RUNNER_TEMP/oar-integration/result.json" \
            > "$RUNNER_TEMP/oar-integration/run.log" 2>&1

      - name: Verify transfer, prompt substitution, and structured output
        run: |
          python3 - <<'PY'
          import json
          import os
          from pathlib import Path

          results = Path(os.environ["RUNNER_TEMP"]) / "oar-integration"
          result = json.loads((results / "result.json").read_text())
          assert result["content"] == (results / "input.txt").read_text().strip(), result
          assert result["marker"] == os.environ["GITHUB_RUN_ID"], result
          PY

      - name: Verify sandbox cleanup
        if: ${{ !cancelled() && steps.gateway.outcome == 'success' }}
        run: |
          openshell sandbox list --gateway openshell --names \
            > "$RUNNER_TEMP/oar-integration/remaining-sandboxes.txt"
          test ! -s "$RUNNER_TEMP/oar-integration/remaining-sandboxes.txt"

      - name: Capture safe diagnostics
        if: always() && steps.gateway.outcome != 'skipped'
        run: |
          openshell --version > "$RUNNER_TEMP/oar-integration/openshell-version.txt" 2>&1 || true
          openshell status > "$RUNNER_TEMP/oar-integration/gateway-status.txt" 2>&1 || true

      - name: Stop gateway
        if: always() && steps.gateway.outcome != 'skipped'
        run: systemctl --user stop openshell-gateway.service

      - name: Upload integration evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: oar-live-integration
          path: ${{ runner.temp }}/oar-integration
          if-no-files-found: warn
          retention-days: 14

      - name: Summarize integration check
        if: always()
        env:
          OUTCOME: ${{ job.status }}
        run: |
          {
            echo '## OAR live integration'
            echo
            echo "Outcome: **$OUTCOME**"
            echo
            echo 'An installed wheel ran through a real OpenShell gateway and inference route.'
            echo 'The check verifies input transfer, prompt substitution, schema-validated output, and sandbox cleanup.'
            echo 'It verifies execution contracts, not reviewer judgment or PR content.'
          } >> "$GITHUB_STEP_SUMMARY"