fix: align the base-URL test with this trunk, and stop Bandit failing on reporting

Two failures on the promote pull request, both caught by CI on the staged
commits rather than in production.

tests/test_client.py asserted the default base URL is http://localhost:5003.
This trunk's src/agentex/_client.py resolves https://agentex.sgp.scale.com,
which is what stainless.yml configures; production is the stale side of that
pair. The restore in 73ea73e took the whole tests/ tree from production and
so pulled the old assertion back with it -- the one file there where
production was behind rather than ahead. 1739 tests passed and only these two
failed, which is what confined the mistake to this assertion.

Bandit's "Send unified results to logging cluster" step is annotated
`shell: bash {0} # don't fail the job if the logging fails`, but that only
drops `-e`: a step still fails when its LAST command fails, and curl was the
last command. Neither this repo nor the production repo defines
N8N_PRODSEC_ACTIONS_ENDPOINT or _TOKEN, so curl exited 2 ("no URL specified")
and failed the Bandit job on every run. Now it skips with a visible warning
when the endpoint is unset and tolerates a failed POST, matching the intent
already stated in the step. The scan itself is unchanged and still runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: aringuyen3

.github/workflows/bandit-ci.yml

@@ -60,10 +60,23 @@ jobs:
           # directly, so size is irrelevant; it wraps the file's values in an array, hence [0].
           jq --slurpfile scanResults tmp.json '.results += $scanResults[0]' tmp-output.json > output.json
       - name: Send unified results to logging cluster
+        # `shell: bash {0}` drops `-e`, but a step still fails when its LAST command does,
+        # and curl was the last command -- so a repo without these secrets failed the whole
+        # Bandit job on a reporting problem, contradicting the intent stated right here.
+        # Neither this repo nor the production repo defines them, so this failed every run.
+        # Stay non-fatal, but say so rather than reporting nothing silently.
         shell: bash {0} # don't fail the job if the logging fails
+        env:
+          ENDPOINT: ${{ secrets.N8N_PRODSEC_ACTIONS_ENDPOINT }}
+          TOKEN: ${{ secrets.N8N_PRODSEC_ACTIONS_TOKEN }}
         run: |
-          curl -X POST \
-          -H "Content-Type: application/json" \
-          -H "Authorization: Bearer ${{ secrets.N8N_PRODSEC_ACTIONS_TOKEN }}" \
-          -d @./output.json \
-          ${{ secrets.N8N_PRODSEC_ACTIONS_ENDPOINT }}
+          if [ -z "${ENDPOINT:-}" ]; then
+            echo "::warning title=Bandit results not reported::N8N_PRODSEC_ACTIONS_ENDPOINT is not set on this repository, so the scan results were not sent to the logging cluster. The scan itself ran and its findings are in the job log."
+            exit 0
+          fi
+          curl -sS -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${TOKEN}" \
+            -d @./output.json \
+            "$ENDPOINT" \
+            || echo "::warning title=Bandit results not reported::the POST to the logging cluster failed; the scan itself still ran."

tests/test_client.py

@@ -719,7 +719,7 @@ def test_base_url_env(self) -> None:
                 Agentex(api_key=api_key, _strict_response_validation=True, environment="production")
 
             client = Agentex(base_url=None, api_key=api_key, _strict_response_validation=True, environment="production")
-            assert str(client.base_url).startswith("http://localhost:5003")
+            assert str(client.base_url).startswith("https://agentex.sgp.scale.com")
 
             client.close()
 
@@ -1652,7 +1652,7 @@ async def test_base_url_env(self) -> None:
             client = AsyncAgentex(
                 base_url=None, api_key=api_key, _strict_response_validation=True, environment="production"
             )
-            assert str(client.base_url).startswith("http://localhost:5003")
+            assert str(client.base_url).startswith("https://agentex.sgp.scale.com")
 
             await client.close()