@redwoodjs/agent-ci 0.8.0 → 0.8.1

package/README.md

@@ -64,13 +64,15 @@ When using a remote daemon (`DOCKER_HOST=ssh://...`), `host-gateway` resolves re
 
 Run GitHub Actions workflow jobs locally.
 
-| Flag                 | Short | Description                                                                       |
-| -------------------- | ----- | --------------------------------------------------------------------------------- |
-| `--workflow <path>`  | `-w`  | Path to the workflow file                                                         |
-| `--all`              | `-a`  | Discover and run all relevant workflows for the current branch                    |
-| `--pause-on-failure` | `-p`  | Pause on step failure for interactive debugging                                   |
-| `--quiet`            | `-q`  | Suppress animated rendering (also enabled by `AI_AGENT=1`)                        |
-| `--no-matrix`        |       | Collapse all matrix combinations into a single job (uses first value of each key) |
+| Flag                       | Short | Description                                                                                                                                                  |
+| -------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `--workflow <path>`        | `-w`  | Path to the workflow file                                                                                                                                    |
+| `--all`                    | `-a`  | Discover and run all relevant workflows for the current branch                                                                                               |
+| `--pause-on-failure`       | `-p`  | Pause on step failure for interactive debugging                                                                                                              |
+| `--quiet`                  | `-q`  | Suppress animated rendering (also enabled by `AI_AGENT=1`)                                                                                                   |
+| `--no-matrix`              |       | Collapse all matrix combinations into a single job (uses first value of each key)                                                                            |
+| `--github-token [<token>]` |       | GitHub token for fetching remote reusable workflows (auto-resolves via `gh auth token` if no value given). Also available as `AGENT_CI_GITHUB_TOKEN` env var |
+| `--commit-status`          |       | Post a GitHub commit status after the run (requires `--github-token`)                                                                                        |
 
 ### `agent-ci retry`
 

package/dist/cli.js

@@ -49,6 +49,8 @@ async function run() {
         let pauseOnFailure = false;
         let runAll = false;
         let noMatrix = false;
+        let githubToken;
+        let commitStatus = false;
         for (let i = 1; i < args.length; i++) {
             if ((args[i] === "--workflow" || args[i] === "-w") && args[i + 1]) {
                 workflow = args[i + 1];
@@ -66,10 +68,37 @@ async function run() {
             else if (args[i] === "--no-matrix") {
                 noMatrix = true;
             }
+            else if (args[i] === "--commit-status") {
+                commitStatus = true;
+            }
+            else if (args[i] === "--github-token") {
+                // If the next arg looks like a token value (not another flag), use it.
+                // Otherwise, auto-resolve via `gh auth token`.
+                if (args[i + 1] && !args[i + 1].startsWith("-")) {
+                    githubToken = args[i + 1];
+                    i++;
+                }
+                else {
+                    try {
+                        githubToken = execSync("gh auth token", {
+                            encoding: "utf-8",
+                            stdio: ["pipe", "pipe", "pipe"],
+                        }).trim();
+                    }
+                    catch {
+                        console.error("[Agent CI] Error: --github-token requires `gh` CLI to be installed and authenticated, or pass a token value: --github-token <value>");
+                        process.exit(1);
+                    }
+                }
+            }
             else if (!args[i].startsWith("-")) {
                 sha = args[i];
             }
         }
+        // Also accept AGENT_CI_GITHUB_TOKEN env var (CLI flag takes precedence)
+        if (!githubToken && process.env.AGENT_CI_GITHUB_TOKEN) {
+            githubToken = process.env.AGENT_CI_GITHUB_TOKEN;
+        }
         let workingDir = process.env.AGENT_CI_WORKING_DIR;
         if (workingDir) {
             if (!path.isAbsolute(workingDir)) {
@@ -131,11 +160,14 @@ async function run() {
                 sha,
                 pauseOnFailure,
                 noMatrix,
+                githubToken,
             });
             if (results.length > 0) {
                 printSummary(results);
             }
-            postCommitStatus(results, sha);
+            if (commitStatus) {
+                postCommitStatus(results, sha, githubToken);
+            }
             const anyFailed = results.length === 0 || results.some((r) => !r.succeeded);
             process.exit(anyFailed ? 1 : 0);
         }
@@ -166,11 +198,14 @@ async function run() {
             sha,
             pauseOnFailure,
             noMatrix,
+            githubToken,
         });
         if (results.length > 0) {
             printSummary(results);
         }
-        postCommitStatus(results, sha);
+        if (commitStatus) {
+            postCommitStatus(results, sha, githubToken);
+        }
         if (results.length === 0 || results.some((r) => !r.succeeded)) {
             process.exit(1);
         }
@@ -246,7 +281,7 @@ async function run() {
 // Single entry point for both `--workflow` and `--all`.
 // One workflow = --all with a single entry.
 async function runWorkflows(options) {
-    const { workflowPaths, sha, pauseOnFailure, noMatrix = false } = options;
+    const { workflowPaths, sha, pauseOnFailure, noMatrix = false, githubToken } = options;
     // Suppress EventEmitter MaxListenersExceeded warnings when running many
     // parallel jobs (each job adds SIGINT/SIGTERM listeners).
     process.setMaxListeners(0);
@@ -346,6 +381,7 @@ async function runWorkflows(options) {
                 pauseOnFailure,
                 noMatrix,
                 store,
+                githubToken,
             });
             allResults.push(...results);
         }
@@ -377,6 +413,7 @@ async function runWorkflows(options) {
                     noMatrix,
                     store,
                     baseRunNum: runNums[0],
+                    githubToken,
                 });
                 allResults.push(...firstResults);
                 const settled = await Promise.allSettled(workflowPaths.slice(1).map((wf, i) => handleWorkflow({
@@ -386,6 +423,7 @@ async function runWorkflows(options) {
                     noMatrix,
                     store,
                     baseRunNum: runNums[i + 1],
+                    githubToken,
                 })));
                 for (const s of settled) {
                     if (s.status === "fulfilled") {
@@ -404,6 +442,7 @@ async function runWorkflows(options) {
                     noMatrix,
                     store,
                     baseRunNum: runNums[i],
+                    githubToken,
                 })));
                 for (const s of settled) {
                     if (s.status === "fulfilled") {
@@ -438,7 +477,7 @@ async function runWorkflows(options) {
 // Processes a single workflow file: parses jobs, handles matrix expansion,
 // wave scheduling, warm-cache serialization, and concurrency limiting.
 async function handleWorkflow(options) {
-    const { sha, pauseOnFailure, noMatrix = false, store } = options;
+    const { sha, pauseOnFailure, noMatrix = false, store, githubToken } = options;
     let workflowPath = options.workflowPath;
     if (!fs.existsSync(workflowPath)) {
         throw new Error(`Workflow file not found: ${workflowPath}`);
@@ -458,7 +497,7 @@ async function handleWorkflow(options) {
     config.GITHUB_REPO = githubRepo;
     const [owner, name] = githubRepo.split("/");
     const remoteCacheDir = path.resolve(getWorkingDirectory(), "cache", "remote-workflows");
-    const remoteCache = await prefetchRemoteWorkflows(workflowPath, remoteCacheDir);
+    const remoteCache = await prefetchRemoteWorkflows(workflowPath, remoteCacheDir, githubToken);
     const expandedEntries = expandReusableJobs(workflowPath, repoRoot, remoteCache);
     if (expandedEntries.length === 0) {
         debugCli(`[Agent CI] No jobs found in workflow: ${path.basename(workflowPath)}`);
@@ -877,6 +916,10 @@ function printUsage() {
     console.log("  -p, --pause-on-failure         Pause on step failure for interactive debugging");
     console.log("  -q, --quiet                   Suppress animated rendering (also enabled by AI_AGENT=1)");
     console.log("      --no-matrix               Collapse all matrix combinations into a single job (uses first value of each key)");
+    console.log("      --github-token [<token>]  GitHub token for fetching remote reusable workflows");
+    console.log("                                (auto-resolves via `gh auth token` if no value given)");
+    console.log("                                Or set: AGENT_CI_GITHUB_TOKEN env var");
+    console.log("      --commit-status           Post a GitHub commit status after the run (requires --github-token)");
 }
 function resolveRepoRoot() {
     let repoRoot = process.cwd();

package/dist/commit-status.js

@@ -2,9 +2,13 @@ import { execSync } from "child_process";
 import { config } from "./config.js";
 /**
  * Post a GitHub commit status via the `gh` CLI.
- * Silently skips if `gh` is not available on PATH.
+ * Only called when --commit-status is passed. Requires a GitHub token.
  */
-export function postCommitStatus(results, sha) {
+export function postCommitStatus(results, sha, githubToken) {
+    if (!githubToken) {
+        console.warn("[Agent CI] --commit-status requires a GitHub token. Use --github-token or set AGENT_CI_GITHUB_TOKEN.");
+        return;
+    }
     // Check if gh CLI is available
     try {
         execSync("which gh", { stdio: "ignore" });

package/dist/workflow/remote-workflow-fetch.js

@@ -1,6 +1,5 @@
 import fs from "node:fs";
 import path from "node:path";
-import { execSync } from "node:child_process";
 import { parse as parseYaml } from "yaml";
 /**
  * Parse a remote reusable workflow ref string.
@@ -37,27 +36,6 @@ export function remoteCachePath(cacheDir, ref) {
     const sanitizedRef = ref.ref.replace(/[^a-zA-Z0-9._-]/g, "-");
     return path.join(cacheDir, `${ref.owner}__${ref.repo}@${sanitizedRef}`, ref.path);
 }
-/**
- * Resolve a GitHub token for API access.
- * Tries `gh auth token` first (real user credentials), then falls back to
- * GITHUB_TOKEN env var. This ordering matters because agent-ci injects a
- * fake token as GITHUB_TOKEN for the runner context.
- */
-function resolveGitHubToken() {
-    try {
-        const token = execSync("gh auth token", {
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"],
-        }).trim();
-        if (token) {
-            return token;
-        }
-    }
-    catch {
-        // gh not installed or not authenticated
-    }
-    return process.env.GITHUB_TOKEN || null;
-}
 /**
  * Scan a workflow YAML and prefetch all remote reusable workflow refs.
  * Downloaded files are written to cacheDir.
@@ -65,9 +43,11 @@ function resolveGitHubToken() {
  * - SHA refs: cached forever (immutable)
  * - Tag/branch refs: always re-fetched (mutable)
  *
- * Throws on fetch failures (404, auth errors, network errors).
+ * Authentication is opt-in via the `githubToken` parameter.
+ * Public repos may work without auth (within rate limits).
+ * On 401/403 responses, throws with instructions for how to authenticate.
  */
-export async function prefetchRemoteWorkflows(workflowPath, cacheDir) {
+export async function prefetchRemoteWorkflows(workflowPath, cacheDir, githubToken) {
     const resolved = new Map();
     const raw = parseYaml(fs.readFileSync(workflowPath, "utf-8"));
     const jobs = raw?.jobs ?? {};
@@ -84,7 +64,6 @@ export async function prefetchRemoteWorkflows(workflowPath, cacheDir) {
     if (remoteRefs.length === 0) {
         return resolved;
     }
-    const token = resolveGitHubToken();
     const errors = [];
     await Promise.all(remoteRefs.map(async (ref) => {
         const dest = remoteCachePath(cacheDir, ref);
@@ -99,13 +78,13 @@ export async function prefetchRemoteWorkflows(workflowPath, cacheDir) {
                 Accept: "application/vnd.github.v3+json",
                 "User-Agent": "agent-ci/1.0",
             };
-            if (token) {
-                headers["Authorization"] = `token ${token}`;
+            if (githubToken) {
+                headers["Authorization"] = `token ${githubToken}`;
             }
             const response = await fetch(url, { headers });
             if (!response.ok) {
                 const hint = response.status === 401 || response.status === 403
-                    ? " Ensure GITHUB_TOKEN is set or run `gh auth login`."
+                    ? ` Run with: agent-ci run --github-token\n  Or set: export AGENT_CI_GITHUB_TOKEN=$(gh auth token)`
                     : "";
                 errors.push(`Failed to fetch remote workflow ${ref.raw} (HTTP ${response.status}).${hint}`);
                 return;

package/dist/workflow/remote-workflow-fetch.test.js

@@ -196,7 +196,84 @@ jobs:
   lint:
     uses: org/private-repo/.github/workflows/lint.yml@v1
 `);
-        await expect(prefetchRemoteWorkflows(wf, cacheDir)).rejects.toThrow(/gh auth login/);
+        await expect(prefetchRemoteWorkflows(wf, cacheDir)).rejects.toThrow(/--github-token/);
+    });
+    it("sends Authorization header when githubToken is provided", async () => {
+        const remoteYaml = `
+on: workflow_call
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo lint
+`;
+        mockFetchSuccess(remoteYaml);
+        const wf = writeWorkflow(`
+jobs:
+  lint:
+    uses: org/repo/.github/workflows/lint.yml@v1
+`);
+        await prefetchRemoteWorkflows(wf, cacheDir, "ghp_test123");
+        const fetchCall = globalThis.fetch.mock.calls[0];
+        expect(fetchCall[1].headers["Authorization"]).toBe("token ghp_test123");
+    });
+    it("does not send Authorization header when no token provided", async () => {
+        const remoteYaml = `
+on: workflow_call
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo lint
+`;
+        mockFetchSuccess(remoteYaml);
+        const wf = writeWorkflow(`
+jobs:
+  lint:
+    uses: org/repo/.github/workflows/lint.yml@v1
+`);
+        await prefetchRemoteWorkflows(wf, cacheDir);
+        const fetchCall = globalThis.fetch.mock.calls[0];
+        expect(fetchCall[1].headers["Authorization"]).toBeUndefined();
+    });
+    it("throws on 403 with auth hint mentioning --github-token and AGENT_CI_GITHUB_TOKEN", async () => {
+        globalThis.fetch = vi.fn().mockResolvedValue({
+            ok: false,
+            status: 403,
+        });
+        const wf = writeWorkflow(`
+jobs:
+  lint:
+    uses: org/private-repo/.github/workflows/lint.yml@v1
+`);
+        await expect(prefetchRemoteWorkflows(wf, cacheDir)).rejects.toThrow(/--github-token/);
+        await expect(prefetchRemoteWorkflows(wf, cacheDir)).rejects.toThrow(/AGENT_CI_GITHUB_TOKEN/);
+    });
+    it("succeeds fetching a public remote workflow without auth", async () => {
+        const remoteYaml = `
+on: workflow_call
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo lint
+`;
+        mockFetchSuccess(remoteYaml);
+        const wf = writeWorkflow(`
+jobs:
+  lint:
+    uses: org/public-repo/.github/workflows/lint.yml@v1
+`);
+        // No githubToken passed — simulates public repo access without auth
+        const result = await prefetchRemoteWorkflows(wf, cacheDir);
+        expect(result.size).toBe(1);
+        // Verify no Authorization header was sent
+        const fetchCall = globalThis.fetch.mock.calls[0];
+        expect(fetchCall[1].headers["Authorization"]).toBeUndefined();
+        // Verify the cached file was written correctly
+        const cachedPath = result.get("org/public-repo/.github/workflows/lint.yml@v1");
+        expect(fs.existsSync(cachedPath)).toBe(true);
+        expect(fs.readFileSync(cachedPath, "utf-8")).toBe(remoteYaml);
     });
     it("fetches multiple remote refs in parallel", async () => {
         const remoteYaml = `

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redwoodjs/agent-ci",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Local GitHub Actions runner — pause on failure, ~0ms cache, official runner binary. Built for AI coding agents.",
   "keywords": [
     "act-alternative",
@@ -40,7 +40,7 @@
     "log-update": "^7.2.0",
     "minimatch": "^10.2.1",
     "yaml": "^2.8.2",
-    "dtu-github-actions": "0.8.0"
+    "dtu-github-actions": "0.8.1"
   },
   "devDependencies": {
     "@types/dockerode": "^3.3.34",