openhands-automation 1.0.0a1__tar.gz

openhands_automation-1.0.0a1/.dockerignore

@@ -0,0 +1,32 @@
+# Version control
+.git
+.gitignore
+
+# CI/CD
+.github
+
+# Python
+.venv
+__pycache__
+*.pyc
+.pytest_cache
+.ruff_cache
+.mypy_cache
+
+# Frontend (built inside Docker via multi-stage)
+frontend/node_modules
+frontend/build
+frontend/coverage
+frontend/test-results
+frontend/playwright-report
+frontend/.react-router
+
+# IDE / editor
+.vscode
+.idea
+*.swp
+
+# Misc
+.pr
+.stakpak
+.pre-commit-config.yaml

openhands_automation-1.0.0a1/.github/workflows/ci.yml

@@ -0,0 +1,56 @@
+---
+# .github/workflows/precommit.yml
+name: ci
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: ['**']
+
+jobs:
+    backend:
+        runs-on: ubuntu-24.04
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v5
+
+            - name: Set up Python
+              uses: actions/setup-python@v6
+              with:
+                  python-version: '3.12'
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v7
+
+            - name: Install dependencies
+              run: uv sync --frozen --group dev
+
+            - name: Run pre-commit (all files)
+              run: uv run pre-commit run --all-files --show-diff-on-failure
+
+    frontend:
+        runs-on: ubuntu-24.04
+        defaults:
+            run:
+                working-directory: frontend
+        steps:
+            - uses: actions/checkout@v5
+
+            - name: Setup Node
+              uses: actions/setup-node@v3
+              with:
+                  node-version: 24
+
+            - name: NPM dependencies
+              run: npm ci
+
+            - name: Lint
+              run: npm run lint
+
+            - name: Test
+              run: npm run test
+
+            - name: Build
+              run: npm run build

openhands_automation-1.0.0a1/.github/workflows/ghcr-build.yml

@@ -0,0 +1,115 @@
+---
+# Workflow that builds and pushes the automation docker image to ghcr.io
+name: Docker
+
+on:
+    push:
+        branches:
+            - main
+        tags:
+            - '*'
+    pull_request:
+    workflow_dispatch:
+        inputs:
+            reason:
+                description: Reason for manual trigger
+                required: true
+                default: ''
+
+# If triggered by a PR, it will be in the same group. However, each commit on main will be in its own unique group
+concurrency:
+    group: ${{ github.workflow }}-${{ (github.head_ref && github.ref) || github.run_id }}
+    cancel-in-progress: true
+
+env:
+    REGISTRY: ghcr.io
+    IMAGE_NAME: openhands/automation
+    RELEVANT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+    ghcr_build:
+        name: Build and Push Automation Image
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: read
+            packages: write
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+              with:
+                  driver-opts: network=host
+
+            - name: Login to GHCR
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Get short SHA
+              id: short_sha
+              run: echo "SHORT_SHA=$(echo ${{ env.RELEVANT_SHA }} | cut -c1-7)" >> $GITHUB_OUTPUT
+
+            - name: Extract metadata (tags, labels) for Docker
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+                  tags: |
+                      type=ref,event=branch
+                      type=ref,event=pr
+                      type=sha
+                      type=sha,format=long
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=semver,pattern={{major}}
+                  flavor: |
+                      latest=auto
+                      prefix=
+                      suffix=
+              env:
+                  DOCKER_METADATA_PR_HEAD_SHA: true
+
+            - name: Build and push Docker image
+              if: '!github.event.pull_request.head.repo.fork'
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  file: containers/Dockerfile
+                  push: true
+                  tags: ${{ steps.meta.outputs.tags }}
+                  labels: ${{ steps.meta.outputs.labels }}
+                  platforms: linux/amd64
+                  cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+                  cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache,mode=max
+                  provenance: true
+                  sbom: true
+
+      # Forked repos can't push to GHCR, so we just build to verify the image builds
+            - name: Build Docker image (fork)
+              if: github.event.pull_request.head.repo.fork
+              uses: docker/build-push-action@v5
+              with:
+                  context: .
+                  file: containers/Dockerfile
+                  push: false
+                  tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.RELEVANT_SHA }}
+                  platforms: linux/amd64
+
+    trigger-deploy-preview:
+        name: Trigger Deploy Preview
+        needs: ghcr_build
+        # Only trigger for PRs from non-fork repos (fork check mirrors the push condition in ghcr_build)
+        if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
+        uses: ./.github/workflows/trigger-deploy-preview.yml
+        with:
+            pr_number: ${{ github.event.pull_request.number }}
+            head_sha: ${{ github.event.pull_request.head.sha }}
+            pr_title: ${{ github.event.pull_request.title }}
+        secrets:
+            ALLHANDS_BOT_GITHUB_PAT: ${{ secrets.ALLHANDS_BOT_GITHUB_PAT }}

openhands_automation-1.0.0a1/.github/workflows/pr-review-by-openhands.yml

@@ -0,0 +1,48 @@
+---
+name: PR Review by OpenHands
+
+on:
+    # TEMPORARY MITIGATION (Clinejection hardening)
+    #
+    # We temporarily avoid `pull_request_target` here. We'll restore it after the PR review
+    # workflow is fully hardened for untrusted execution.
+    pull_request:
+        types: [opened, ready_for_review, labeled, review_requested]
+
+permissions:
+    contents: read
+    pull-requests: write
+    issues: write
+
+jobs:
+    pr-review:
+        # Note: fork PRs will not have access to repository secrets under `pull_request`.
+        # Skip forks to avoid noisy failures until we restore a hardened `pull_request_target` flow.
+        if: |
+            github.event.pull_request.head.repo.full_name == github.repository &&
+            (
+                (github.event.action == 'opened' && github.event.pull_request.draft == false) ||
+                github.event.action == 'ready_for_review' ||
+                (github.event.action == 'labeled' && github.event.label.name == 'review-this') ||
+                (
+                    github.event.action == 'review_requested' &&
+                    (
+                        github.event.requested_reviewer.login == 'openhands-agent' ||
+                        github.event.requested_reviewer.login == 'all-hands-bot'
+                    )
+                )
+            )
+        concurrency:
+            group: pr-review-${{ github.event.pull_request.number }}
+            cancel-in-progress: true
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Run PR Review
+              uses: OpenHands/extensions/plugins/pr-review@main
+              with:
+                  llm-model: litellm_proxy/claude-sonnet-4-5-20250929
+                  llm-base-url: https://llm-proxy.app.all-hands.dev
+                  review-style: roasted
+                  llm-api-key: ${{ secrets.LLM_API_KEY }}
+                  github-token: ${{ secrets.ALLHANDS_BOT_GITHUB_PAT }}
+                  lmnr-api-key: ${{ secrets.LMNR_SKILLS_API_KEY }}

openhands_automation-1.0.0a1/.github/workflows/pypi-release.yml

@@ -0,0 +1,40 @@
+---
+# Publishes the openhands-automation PyPI package using trusted publishing (OIDC).
+# Triggered when a tag is pushed or manually via workflow_dispatch.
+# Requires trusted publishing to be configured in PyPI project settings.
+name: Publish PyPI Package
+
+on:
+    push:
+        tags:
+            - '*'
+    workflow_dispatch:
+        inputs:
+            reason:
+                description: Reason for manual trigger
+                required: true
+                default: ''
+
+jobs:
+    release:
+        runs-on: ubuntu-24.04
+        permissions:
+            id-token: write
+            contents: read
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v7
+              with:
+                  version: latest
+
+            - name: Set up Python
+              run: uv python install 3.12
+
+            - name: Build package
+              run: uv build
+
+            - name: Publish to PyPI
+              uses: pypa/gh-action-pypi-publish@release/v1

openhands_automation-1.0.0a1/.github/workflows/tag-image.yml

@@ -0,0 +1,58 @@
+---
+# Adds a git-tag name to existing Docker images.
+# Triggered when a tag is pushed: finds the images built at the tag's commit
+# (tagged `sha-<full>`) and adds the tag name as an alias for the same manifest.
+# Semver tags (X.Y.Z) also get X.Y, X, and latest aliases.
+# No rebuild — pure registry-side retag via `docker buildx imagetools create`.
+name: Tag Docker images
+
+on:
+    push:
+        tags:
+            - '*'
+
+jobs:
+    retag:
+        runs-on: ubuntu-24.04
+        permissions:
+            packages: write
+        steps:
+            - name: Login to GHCR
+              uses: docker/login-action@v3
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.repository_owner }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v3
+
+            - name: Compute tags
+              id: meta
+              uses: docker/metadata-action@v5
+              with:
+                  images: ghcr.io/openhands/automation
+                  flavor: latest=auto
+                  tags: |
+                      type=ref,event=tag
+                      type=semver,pattern={{version}}
+                      type=semver,pattern={{major}}.{{minor}}
+                      type=semver,pattern={{major}}
+
+            - name: Add tags to existing image
+              env:
+                  SRC: ghcr.io/openhands/automation:sha-${{ github.sha }}
+                  TAGS: ${{ steps.meta.outputs.tags }}
+              shell: bash
+              run: |
+                  set -euo pipefail
+                  if ! docker buildx imagetools inspect "$SRC" > /dev/null 2>&1; then
+                    echo "::error::Source image $SRC does not exist. The Docker workflow for commit ${{ github.sha }} may not have completed successfully. Re-run this workflow once the build finishes."
+                    exit 1
+                  fi
+                  args=()
+                  while IFS= read -r tag; do
+                    [[ -z "$tag" ]] && continue
+                    args+=(-t "$tag")
+                  done <<< "$TAGS"
+                  docker buildx imagetools create "${args[@]}" "$SRC"

openhands_automation-1.0.0a1/.github/workflows/tests.yml

@@ -0,0 +1,49 @@
+---
+name: Run tests
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: ['**']
+
+permissions:
+    contents: write
+    pull-requests: write
+
+jobs:
+    unit-tests:
+        runs-on: ubuntu-24.04
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v5
+
+            - name: Install uv
+              uses: astral-sh/setup-uv@v7
+              with:
+                  enable-cache: true
+                  python-version: '3.12'
+
+            - name: Install deps
+              run: uv sync --frozen --group dev
+
+            - name: Run unit tests with coverage
+              run: |
+                  rm -f .coverage
+                  CI=true uv run python -m pytest -vvs \
+                    --cov=openhands/automation \
+                    --cov-report=term-missing \
+                    --cov-report=xml:coverage.xml \
+                    --cov-fail-under=0 \
+                    tests/
+
+            - name: Pytest coverage PR comment
+              if: always() && github.event_name == 'pull_request'
+              continue-on-error: true
+              uses: MishaKav/pytest-coverage-comment@v1
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  pytest-xml-coverage-path: coverage.xml
+                  title: Coverage Report
+                  create-new-comment: false
+                  hide-report: false

openhands_automation-1.0.0a1/.github/workflows/trigger-deploy-preview.yml

@@ -0,0 +1,235 @@
+---
+# Workflow that creates/updates a deploy repo PR for automation PRs
+# Called by ghcr-build.yml after Docker build completes successfully
+name: Trigger Deploy Preview
+
+on:
+    workflow_call:
+        inputs:
+            pr_number:
+                description: The automation PR number
+                required: true
+                type: number
+            head_sha:
+                description: The commit SHA to deploy
+                required: true
+                type: string
+            pr_title:
+                description: The PR title
+                required: true
+                type: string
+        secrets:
+            ALLHANDS_BOT_GITHUB_PAT:
+                required: true
+
+concurrency:
+    group: deploy-preview-${{ inputs.pr_number }}
+    cancel-in-progress: false
+
+env:
+    DEPLOY_REPO: OpenHands/deploy
+    BASE_BRANCH: main
+
+jobs:
+    trigger-deploy:
+        name: Create Deploy Preview PR
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: read
+            pull-requests: write
+        steps:
+            - name: Checkout deploy repo
+              uses: actions/checkout@v4
+              with:
+                  repository: ${{ env.DEPLOY_REPO }}
+                  ref: ${{ env.BASE_BRANCH }}
+                  token: ${{ secrets.ALLHANDS_BOT_GITHUB_PAT }}
+                  fetch-depth: 0
+                  path: deploy-repo
+
+            - name: Install yq
+              run: |
+                  YQ_VERSION="v4.52.4"
+                  YQ_CHECKSUM="0c4d965ea944b64b8fddaf7f27779ee3034e5693263786506ccd1c120f184e8c"
+                  wget -qO /tmp/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
+                  echo "${YQ_CHECKSUM}  /tmp/yq" | sha256sum -c -
+                  sudo mv /tmp/yq /usr/local/bin/yq
+                  sudo chmod +x /usr/local/bin/yq
+
+            - name: Update AUTOMATION_SHA and push
+              id: deploy-pr
+              run: |
+                  cd deploy-repo
+                  BRANCH_NAME="au-pr-${{ inputs.pr_number }}"
+                  BASE_BRANCH="${{ env.BASE_BRANCH }}"
+
+                  # Configure git
+                  git config user.name "all-hands-bot"
+                  git config user.email "all-hands-bot@all-hands.dev"
+
+                  # Fetch all branches
+                  git fetch origin "$BASE_BRANCH"
+                  git fetch origin "$BRANCH_NAME" 2>/dev/null || true
+
+                  # Check if branch already exists remotely
+                  if git rev-parse --verify "origin/$BRANCH_NAME" >/dev/null 2>&1; then
+                    echo "Branch $BRANCH_NAME exists remotely, checking out and rebasing"
+                    git checkout -B "$BRANCH_NAME" "origin/$BRANCH_NAME"
+                    # Rebase onto latest base branch to pick up any upstream changes
+                    git rebase "origin/$BASE_BRANCH" || {
+                      echo "Rebase failed, aborting and resetting to base"
+                      git rebase --abort
+                      git reset --hard "origin/$BASE_BRANCH"
+                    }
+                  else
+                    echo "Branch $BRANCH_NAME does not exist, creating from $BASE_BRANCH"
+                    git checkout -B "$BRANCH_NAME" "origin/$BASE_BRANCH"
+                  fi
+
+                  # Verify deploy.yaml exists
+                  if [ ! -f .github/workflows/deploy.yaml ]; then
+                    echo "Error: .github/workflows/deploy.yaml not found" >&2
+                    exit 1
+                  fi
+
+                  # Update AUTOMATION_SHA in deploy.yaml
+                  HEAD_SHA="${{ inputs.head_sha }}"
+                  echo "Updating AUTOMATION_SHA to $HEAD_SHA"
+                  if ! yq e -i ".env.AUTOMATION_SHA = \"${HEAD_SHA}\"" .github/workflows/deploy.yaml; then
+                    echo "Error: Failed to update deploy.yaml with yq" >&2
+                    exit 1
+                  fi
+
+                  # Check if there are changes to commit
+                  if git diff --quiet; then
+                    echo "No changes to commit - SHA already up to date"
+                    echo "has_changes=false" >> $GITHUB_OUTPUT
+                  else
+                    echo "Changes detected, committing"
+                    git add .github/workflows/deploy.yaml
+                    git commit -m "Update AUTOMATION_SHA to $HEAD_SHA
+
+                  Automation PR: https://github.com/${{ github.repository }}/pull/${{ inputs.pr_number }}
+                  Commit: $HEAD_SHA"
+                    echo "has_changes=true" >> $GITHUB_OUTPUT
+                  fi
+
+                  # Push the branch (force-with-lease is safer than force for rebased branches)
+                  git push --force-with-lease origin "$BRANCH_NAME"
+
+                  echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+
+            - name: Create or get deploy PR
+              id: manage-pr
+              env:
+                  GH_TOKEN: ${{ secrets.ALLHANDS_BOT_GITHUB_PAT }}
+                  BRANCH_NAME: ${{ steps.deploy-pr.outputs.branch_name }}
+                  PR_TITLE: ${{ inputs.pr_title }}
+              run: |
+                  cd deploy-repo
+
+                  # Check if PR already exists for this branch
+                  if ! EXISTING_PR=$(gh pr list --head "$BRANCH_NAME" --base "${{ env.BASE_BRANCH }}" --json number,url --jq '.[0]'); then
+                    echo "Error: Failed to query existing PRs" >&2
+                    exit 1
+                  fi
+
+                  if [ -n "$EXISTING_PR" ] && [ "$EXISTING_PR" != "null" ]; then
+                    PR_URL=$(echo "$EXISTING_PR" | jq -r '.url')
+                    echo "PR already exists: $PR_URL"
+                    echo "deploy_pr_url=$PR_URL" >> $GITHUB_OUTPUT
+                  else
+                    # Create PR body using heredoc to avoid shell injection from PR title
+                    PR_BODY=$(cat <<EOF
+                  **Preview branch for Automation PR #${{ inputs.pr_number }}**
+
+                  This PR was automatically created to test automation changes.
+
+                  **Changes:**
+                  - \`AUTOMATION_SHA\` → \`${{ inputs.head_sha }}\`
+
+                  **Source PR:** https://github.com/${{ github.repository }}/pull/${{ inputs.pr_number }}
+                  **Source PR Title:** ${PR_TITLE}
+                  EOF
+                  )
+
+                    # Create new PR against automations-project branch
+                    if ! PR_URL=$(gh pr create \
+                      --title "Preview: Automation PR #${{ inputs.pr_number }}" \
+                      --body "$PR_BODY" \
+                      --base "${{ env.BASE_BRANCH }}" \
+                      --head "$BRANCH_NAME"); then
+                      echo "Error: Failed to create PR" >&2
+                      exit 1
+                    fi
+
+                    echo "Created new PR: $PR_URL"
+                    echo "deploy_pr_url=$PR_URL" >> $GITHUB_OUTPUT
+                  fi
+
+            - name: Comment on automation PR
+              uses: actions/github-script@v7
+              env:
+                  DEPLOY_PR_URL: ${{ steps.manage-pr.outputs.deploy_pr_url }}
+                  HAS_CHANGES: ${{ steps.deploy-pr.outputs.has_changes }}
+              with:
+                  script: |
+                      const prNumber = ${{ inputs.pr_number }};
+                      const deployPrUrl = process.env.DEPLOY_PR_URL;
+                      const headSha = '${{ inputs.head_sha }}';
+                      const hasChanges = process.env.HAS_CHANGES === 'true';
+
+                      const etTime = new Intl.DateTimeFormat('en-US', {
+                        timeZone: 'America/New_York',
+                        year: 'numeric',
+                        month: 'short',
+                        day: '2-digit',
+                        hour: '2-digit',
+                        minute: '2-digit',
+                        second: '2-digit',
+                        hour12: true
+                      }).format(new Date());
+
+                      const statusMessage = hasChanges 
+                        ? 'A deploy preview has been created/updated for this PR.'
+                        : 'No changes needed - deploy preview is already up to date.';
+
+                      const commentBody = `🚀 **Deploy Preview PR Created/Updated**
+
+                      ${statusMessage}
+
+                      **Deploy PR:** ${deployPrUrl}
+                      **Automation SHA:** \`${headSha}\`
+                      **Last updated:** ${etTime} ET
+
+                      Once the deploy PR's CI passes, the automation service will be deployed to the feature environment.`;
+
+                      // Find existing bot comment
+                      const { data: comments } = await github.rest.issues.listComments({
+                        issue_number: prNumber,
+                        owner: context.repo.owner,
+                        repo: context.repo.repo
+                      });
+
+                      const botComment = comments.find(comment =>
+                        comment.user.login === 'github-actions[bot]' &&
+                        comment.body.includes('Deploy Preview PR Created/Updated')
+                      );
+
+                      if (botComment) {
+                        await github.rest.issues.updateComment({
+                          comment_id: botComment.id,
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          body: commentBody
+                        });
+                        console.log('Updated existing comment');
+                      } else {
+                        await github.rest.issues.createComment({
+                          issue_number: prNumber,
+                          owner: context.repo.owner,
+                          repo: context.repo.repo,
+                          body: commentBody
+                        });
+                        console.log('Created new comment');
+                      }