openhands-automation 1.0.0__tar.gz

openhands_automation-1.0.0/.dockerignore

@@ -0,0 +1,32 @@
+# Version control
+.git
+.gitignore
+
+# CI/CD
+.github
+
+# Python
+.venv
+__pycache__
+*.pyc
+.pytest_cache
+.ruff_cache
+.mypy_cache
+
+# Frontend (built inside Docker via multi-stage)
+frontend/node_modules
+frontend/build
+frontend/coverage
+frontend/test-results
+frontend/playwright-report
+frontend/.react-router
+
+# IDE / editor
+.vscode
+.idea
+*.swp
+
+# Misc
+.pr
+.stakpak
+.pre-commit-config.yaml

openhands_automation-1.0.0/.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+---
+# .github/workflows/precommit.yml
+name: ci
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: ['**']
+
+jobs:
+    backend:
+        runs-on: ubuntu-24.04
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v5
+
+            - name: Set up Python
+              uses: actions/setup-python@v6
+              with:
+                  python-version: '3.12'
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v7
+
+            - name: Install dependencies
+              run: uv sync --frozen --group dev
+
+            - name: Run pre-commit (all files)
+              run: uv run pre-commit run --all-files --show-diff-on-failure
+
+    frontend:
+        runs-on: ubuntu-24.04
+        defaults:
+            run:
+                working-directory: frontend
+        steps:
+            - uses: actions/checkout@v5
+
+            - name: Setup Node
+              uses: actions/setup-node@v3
+              with:
+                  node-version: 24
+
+            - name: NPM dependencies
+              run: npm ci
+
+            - name: Lint
+              run: npm run lint
+
+            - name: Test
+              run: npm run test
+
+            - name: Build
+              run: npm run build

openhands_automation-1.0.0/.github/workflows/ghcr-build.yml

@@ -0,0 +1,102 @@
+---
+# Workflow that builds and pushes the automation docker image to ghcr.io
+name: Docker
+
+on:
+    push:
+        branches:
+            - main
+        tags:
+            - '*'
+    pull_request:
+    workflow_dispatch:
+        inputs:
+            reason:
+                description: Reason for manual trigger
+                required: true
+                default: ''
+
+# If triggered by a PR, it will be in the same group. However, each commit on main will be in its own unique group
+concurrency:
+    group: ${{ github.workflow }}-${{ (github.head_ref && github.ref) || github.run_id }}
+    cancel-in-progress: true
+
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: openhands/automation
+    RELEVANT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+    ghcr_build:
+        name: Build and Push Automation Image
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: read
+            packages: write
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+              with:
+                  driver-opts: network=host
+
+            - name: Login to GHCR
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Get short SHA
+              id: short_sha
+              run: echo "SHORT_SHA=$(echo ${{ env.RELEVANT_SHA }} | cut -c1-7)" >> $GITHUB_OUTPUT
+
+            - name: Extract metadata (tags, labels) for Docker
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  tags: |
+                      type=ref,event=branch
+                      type=ref,event=pr
+                      type=sha
+                      type=sha,format=long
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=semver,pattern={{major}}
+                  flavor: |
+                      latest=auto
+                      prefix=
+                      suffix=
+              env:
+                  DOCKER_METADATA_PR_HEAD_SHA: true
+
+            - name: Build and push Docker image
+              if: '!github.event.pull_request.head.repo.fork'
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  file: containers/Dockerfile
+                  push: true
+                  tags: ${{ steps.meta.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  platforms: linux/amd64
+                  cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+                  cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+                  provenance: true
+                  sbom: true
+
+      # Forked repos can't push to GHCR, so we just build to verify the image builds
+            - name: Build Docker image (fork)
+              if: github.event.pull_request.head.repo.fork
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  file: containers/Dockerfile
+                  push: false
+                  tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.RELEVANT_SHA }}
+                  platforms: linux/amd64

openhands_automation-1.0.0/.github/workflows/pr-artifacts.yml

@@ -0,0 +1,142 @@
+---
+name: PR Artifacts
+
+on:
+    workflow_dispatch: # Manual trigger for testing
+    pull_request:
+        types: [opened, synchronize, reopened]
+        branches: [main]
+    pull_request_review:
+        types: [submitted]
+
+jobs:
+  # Auto-remove .pr/ directory when a reviewer approves
+    cleanup-on-approval:
+        concurrency:
+            group: cleanup-pr-artifacts-${{ github.event.pull_request.number }}
+            cancel-in-progress: false
+        if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
+        runs-on: ubuntu-latest
+        permissions:
+            contents: write
+            pull-requests: write
+        steps:
+            - name: Check if fork PR
+              id: check-fork
+              env:
+                  PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+                  PR_BASE_REPO: ${{ github.event.pull_request.base.repo.full_name }}
+              run: |
+                  if [ "$PR_HEAD_REPO" != "$PR_BASE_REPO" ]; then
+                    echo "is_fork=true" >> $GITHUB_OUTPUT
+                    echo "::notice::Fork PR detected - skipping auto-cleanup (manual removal required)"
+                  else
+                    echo "is_fork=false" >> $GITHUB_OUTPUT
+                  fi
+
+            # Use PAT so the push triggers CI workflows that will complete and
+            # satisfy branch protection. We can't use [skip ci] because GitHub Apps
+            # can create stuck checks that block merging.
+            - uses: actions/checkout@v6
+              if: steps.check-fork.outputs.is_fork == 'false'
+              with:
+                  ref: ${{ github.event.pull_request.head.ref }}
+                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
+
+            - name: Remove .pr/ directory
+              id: remove
+              if: steps.check-fork.outputs.is_fork == 'false'
+              run: |
+                  if [ -d ".pr" ]; then
+                    git config user.name "allhands-bot"
+                    git config user.email "allhands-bot@users.noreply.github.com"
+                    git rm -rf .pr/
+                    git commit -m "chore: Remove PR-only artifacts [automated]"
+                    git push || {
+                      echo "::error::Failed to push cleanup commit. Check branch protection rules."
+                      exit 1
+                    }
+                    echo "removed=true" >> $GITHUB_OUTPUT
+                    echo "::notice::Removed .pr/ directory"
+                  else
+                    echo "removed=false" >> $GITHUB_OUTPUT
+                    echo "::notice::No .pr/ directory to remove"
+                  fi
+
+            - name: Update PR comment after cleanup
+              if: steps.check-fork.outputs.is_fork == 'false' && steps.remove.outputs.removed == 'true'
+              uses: actions/github-script@v9
+              with:
+                  script: |
+                      const marker = '<!-- pr-artifacts-notice -->';
+                      const body = `${marker}
+                      ✅ **PR Artifacts Cleaned Up**
+
+                      The \`.pr/\` directory has been automatically removed.
+                      `;
+
+                      const { data: comments } = await github.rest.issues.listComments({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: context.issue.number,
+                      });
+
+                      const existing = comments.find(c => c.body.includes(marker));
+                      if (existing) {
+                        await github.rest.issues.updateComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          comment_id: existing.id,
+                          body: body,
+                        });
+                      }
+
+  # Warn if .pr/ directory exists (will be auto-removed on approval)
+    check-pr-artifacts:
+        if: github.event_name == 'pull_request'
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            pull-requests: write
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Check for .pr/ directory
+              id: check
+              run: |
+                  if [ -d ".pr" ]; then
+                    echo "exists=true" >> $GITHUB_OUTPUT
+                    echo "::warning::the .pr/ directory is a temporary directory, intended by this repository policy to be used to show live tests artifacts for review. It will be automatically removed when the PR is approved. For fork PRs, manual removal is required before merging."
+                  else
+                    echo "exists=false" >> $GITHUB_OUTPUT
+                  fi
+
+            - name: Post or update PR comment
+              if: steps.check.outputs.exists == 'true'
+              uses: actions/github-script@v9
+              with:
+                  script: |
+                      const marker = '<!-- pr-artifacts-notice -->';
+                      const body = `${marker}
+                      📁 **PR Artifacts Notice**
+
+                      This PR contains a \`.pr/\` directory with PR-specific documents. This directory will be **automatically removed** when the PR is approved.
+
+                      > For fork PRs: Manual removal is required before merging.
+                      `;
+
+                      const { data: comments } = await github.rest.issues.listComments({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        issue_number: context.issue.number,
+                      });
+
+                      const existing = comments.find(c => c.body.includes(marker));
+                      if (!existing) {
+                        await github.rest.issues.createComment({
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          issue_number: context.issue.number,
+                          body: body,
+                        });
+                      }

openhands_automation-1.0.0/.github/workflows/prepare-release.yml

@@ -0,0 +1,135 @@
+---
+# Workflow that prepares a release by bumping the version and opening a PR.
+# Triggered manually via workflow_dispatch with a version input.
+# After the PR is merged, create and push a tag to trigger the actual release.
+name: Prepare Release
+
+on:
+    workflow_dispatch:
+        inputs:
+            version:
+                description: Version to release (e.g., 1.0.0, 1.0.0a3, 1.0.0b1)
+                required: true
+                type: string
+
+jobs:
+    prepare-release:
+        name: Prepare Release PR
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: write
+            pull-requests: write
+        steps:
+            - name: Validate version format
+              run: |
+                  VERSION="${{ inputs.version }}"
+                  # Basic PEP 440 validation (allows: X.Y.Z, X.Y.ZaN, X.Y.ZbN, X.Y.ZrcN)
+                  if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(a[0-9]+|b[0-9]+|rc[0-9]+)?$'; then
+                    echo "::error::Invalid version format: $VERSION"
+                    echo "Expected format: X.Y.Z, X.Y.ZaN (alpha), X.Y.ZbN (beta), or X.Y.ZrcN (release candidate)"
+                    exit 1
+                  fi
+
+            - name: Checkout
+              uses: actions/checkout@v4
+              with:
+                  token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
+                  fetch-depth: 0
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v7
+              with:
+                  version: latest
+
+            - name: Set up Python
+              run: uv python install 3.12
+
+            - name: Get current version
+              id: current
+              run: |
+                  CURRENT=$(grep -oP '^version = "\K[^"]+' pyproject.toml)
+                  echo "version=$CURRENT" >> $GITHUB_OUTPUT
+                  echo "Current version: $CURRENT"
+
+            - name: Bump version
+              run: |
+                  VERSION="${{ inputs.version }}"
+                  CURRENT="${{ steps.current.outputs.version }}"
+                  if [ "$CURRENT" = "$VERSION" ]; then
+                    echo "::error::Version $VERSION is already set in pyproject.toml"
+                    exit 1
+                  fi
+                  sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+                  if ! grep -q "^version = \"$VERSION\"" pyproject.toml; then
+                    echo "::error::Failed to update version in pyproject.toml"
+                    exit 1
+                  fi
+                  echo "Updated pyproject.toml to version $VERSION"
+                  grep '^version = ' pyproject.toml
+
+            - name: Update lockfile
+              run: |
+                  uv lock
+                  if ! git diff --quiet uv.lock; then
+                    echo "Lock file updated successfully"
+                  else
+                    echo "::warning::Lock file unchanged - verify dependencies are correct"
+                  fi
+
+            - name: Configure git
+              run: |
+                  git config user.name "all-hands-bot"
+                  git config user.email "all-hands-bot@all-hands.dev"
+
+            - name: Create branch and commit
+              id: commit
+              run: |
+                  VERSION="${{ inputs.version }}"
+                  BRANCH_NAME="release/v$VERSION"
+
+                  git checkout -b "$BRANCH_NAME" 2>/dev/null || {
+                    echo "::error::Branch $BRANCH_NAME already exists. Delete it or use a different version."
+                    exit 1
+                  }
+                  git add pyproject.toml uv.lock
+                  git commit -m "chore: bump version to $VERSION"
+                  git push -u origin "$BRANCH_NAME"
+
+                  echo "branch=$BRANCH_NAME" >> $GITHUB_OUTPUT
+
+            - name: Create Pull Request
+              env:
+                  GH_TOKEN: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC }}
+              run: |
+                  VERSION="${{ inputs.version }}"
+                  CURRENT="${{ steps.current.outputs.version }}"
+
+                  gh pr create \
+                    --title "chore: release v$VERSION" \
+                    --body "## Release v$VERSION
+
+                  This PR bumps the version from \`$CURRENT\` to \`$VERSION\`.
+
+                  ### Changes
+                  - Updated \`pyproject.toml\` version to \`$VERSION\`
+                  - Regenerated \`uv.lock\`
+
+                  ### After Merging
+
+                  Once this PR is merged, create and push the release tag:
+
+                  \`\`\`bash
+                  git checkout main
+                  git pull origin main
+                  git tag $VERSION
+                  git push origin $VERSION
+                  \`\`\`
+
+                  This will trigger:
+                  - \`pypi-release.yml\` — publishes \`openhands-automation\` to PyPI
+                  - \`tag-image.yml\` — tags the Docker image with \`$VERSION\`
+
+                  ---
+                  *This PR was automatically created by the Prepare Release workflow.*" \
+                    --base main \
+                    --head "${{ steps.commit.outputs.branch }}"

openhands_automation-1.0.0/.github/workflows/promote-to-development.yml

@@ -0,0 +1,90 @@
+---
+# Promotes each successful main build's automation image to the development
+# environment by dispatching to OpenHands/saas-deploy, which runs the bump.
+# Runs after the Docker workflow succeeds on main; can also be run manually
+# (from main) to re-promote a known-good image tag.
+
+name: Promote to development
+
+on:
+    workflow_dispatch:
+        inputs:
+            image-tag:
+                description: Image tag to promote (defaults to sha-<short SHA> for the selected ref)
+                required: false
+                type: string
+    workflow_run:
+        workflows: [Docker]
+        types: [completed]
+        branches: [main]
+
+# Queue promotions so an earlier main commit deploys before a later one.
+concurrency:
+    group: promote-to-development-automation
+    cancel-in-progress: false
+
+jobs:
+    promote:
+        # Only promote when the Docker build actually succeeded, or when run manually.
+        # The Docker workflow also runs on pull_request, and the workflow_run branches
+        # filter matches the *head* branch - a fork PR from a branch named "main"
+        # would slip through - so additionally require a push event.
+        if: >-
+            ${{ github.event_name == 'workflow_dispatch' ||
+            (github.event.workflow_run.conclusion == 'success' &&
+            github.event.workflow_run.event == 'push') }}
+        runs-on: ubuntu-24.04
+        timeout-minutes: 10
+        environment: dev-deploy
+        permissions:
+            contents: read
+        steps:
+            - name: Compute image tag
+              id: tag
+              # Matches docker/metadata-action type=sha (7-char short SHA) emitted by
+              # the Docker workflow.
+              env:
+                  DISPATCH_IMAGE_TAG: ${{ github.event.inputs['image-tag'] }}
+                  SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+              run: |
+                  if [ -n "$DISPATCH_IMAGE_TAG" ]; then
+                    echo "tag=$DISPATCH_IMAGE_TAG" >> "$GITHUB_OUTPUT"
+                  else
+                    echo "tag=sha-${SHA::7}" >> "$GITHUB_OUTPUT"
+                  fi
+
+            - name: Mint token
+              id: app-token
+              uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+              with:
+                  app-id: ${{ secrets.SAAS_DEPLOY_DISPATCHER_APP_ID }}
+                  private-key: ${{ secrets.SAAS_DEPLOY_DISPATCHER_APP_PRIVATE_KEY }}
+                  owner: OpenHands
+                  repositories: saas-deploy
+                  permission-contents: write
+
+            - name: Dispatch promotion to saas-deploy
+              env:
+                  GH_TOKEN: ${{ steps.app-token.outputs.token }}
+                  IMAGE_TAG: ${{ steps.tag.outputs.tag }}
+                  SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+              run: |
+                  gh api /repos/OpenHands/saas-deploy/dispatches \
+                    -f event_type=promote-to-development \
+                    -F client_payload[release]=automation \
+                    -F client_payload[tag-path]=.openhands.automation.image.tag \
+                    -F client_payload[image-tag]="$IMAGE_TAG" \
+                    -F client_payload[source-repo]="$GITHUB_REPOSITORY" \
+                    -F client_payload[source-sha]="$SOURCE_SHA"
+                  echo "Dispatched promote-to-development for automation ${IMAGE_TAG} (${SOURCE_SHA})."
+
+            - name: Annotate dispatch failure
+              if: ${{ failure() }}
+              env:
+                  IMAGE_TAG: ${{ steps.tag.outputs.tag }}
+                  HEAD_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+                  SOURCE_RUN_URL: ${{ github.event.workflow_run.html_url }}
+              run: |
+                  image_tag="${IMAGE_TAG:-sha-${HEAD_SHA::7}}"
+                  source="${SOURCE_RUN_URL:-manual workflow_dispatch run}"
+                  echo "::error title=Promote to development failed::Failed to dispatch promotion of automation ${image_tag} (${HEAD_SHA}) to development. Source: ${source}"

openhands_automation-1.0.0/.github/workflows/pypi-release.yml

@@ -0,0 +1,40 @@
+---
+# Publishes the openhands-automation PyPI package using trusted publishing (OIDC).
+# Triggered when a tag is pushed or manually via workflow_dispatch.
+# Requires trusted publishing to be configured in PyPI project settings.
+name: Publish PyPI Package
+
+on:
+    push:
+        tags:
+            - '*'
+    workflow_dispatch:
+        inputs:
+            reason:
+                description: Reason for manual trigger
+                required: true
+                default: ''
+
+jobs:
+    release:
+        runs-on: ubuntu-24.04
+        permissions:
+            id-token: write
+            contents: read
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v7
+              with:
+                  version: latest
+
+            - name: Set up Python
+              run: uv python install 3.12
+
+            - name: Build package
+              run: uv build
+
+            - name: Publish to PyPI
+              uses: pypa/gh-action-pypi-publish@release/v1

openhands_automation-1.0.0/.github/workflows/qa-changes-by-openhands.yml

@@ -0,0 +1,41 @@
+---
+# Automated QA validation of PR changes using OpenHands.
+#
+# This workflow runs only when the `qa-this` label is added to a same-repo PR.
+# Unlike code review, the QA agent executes the changed code and posts a
+# functional verification report.
+name: QA Changes by OpenHands
+
+on:
+    pull_request:
+        types: [labeled]
+
+permissions:
+    contents: read
+    pull-requests: write
+    issues: write
+
+jobs:
+    qa-changes:
+        # Only run for same-repo PRs (secrets are not available to forks), and
+        # only when explicitly triggered by the `qa-this` label.
+        if: |
+            github.event.pull_request.head.repo.full_name == github.repository &&
+            github.event.label.name == 'qa-this'
+        concurrency:
+            group: qa-changes-${{ github.event.pull_request.number }}
+            cancel-in-progress: true
+        runs-on: ubuntu-24.04
+        timeout-minutes: 30
+        steps:
+            - name: Run QA Changes
+              uses: OpenHands/extensions/plugins/qa-changes@main
+              with:
+                  llm-model: litellm_proxy/openai/gpt-5.5
+                  llm-base-url: https://llm-proxy.app.all-hands.dev
+                  max-budget: '10.0'
+                  timeout-minutes: '30'
+                  max-iterations: '500'
+                  llm-api-key: ${{ secrets.LLM_API_KEY }}
+                  github-token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC || github.token }}
+                  lmnr-api-key: ${{ secrets.LMNR_SKILLS_API_KEY }}