Skip to content

ci: reduce PR feedback loop with targeted caching #1294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeremyeder wants to merge 6 commits into
base: main
Choose a base branch
from
Open

ci: reduce PR feedback loop with targeted caching #1294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e60ea3a
docs: add CI improvements design spec
Apr 11, 2026
9a34ca9
docs: add CI improvements implementation plan
Apr 11, 2026
1cacc1d
ci(unit-tests): use pipx for junit2html instead of pip install
Apr 11, 2026
c4ff934
ci(lint): consolidate golangci-lint to single pass with test tags
Apr 11, 2026
fc16590
ci(e2e): add Docker BuildKit layer caching to image builds
Apr 11, 2026
bcdfbc7
ci(e2e): cache kind binary between runs
Apr 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
146 changes: 90 additions & 56 deletions .github/workflows/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ on:
push:
branches: [ main ]

env:
KIND_VERSION: "v0.27.0"

concurrency:
group: e2e-tests-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: true
Comment on lines +12 to 17
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add explicit least-privilege permissions for this workflow.

The workflow introduces cache writes and multiple third-party actions but does not scope GITHUB_TOKEN permissions explicitly.

Suggested hardening baseline 
 env:
   KIND_VERSION: "v0.27.0"
 
+permissions:
+  contents: read
+  actions: write
+
 concurrency:
   group: e2e-tests-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true

As per coding guidelines, .github/workflows/**/*.{yml,yaml}: - Pin action versions to SHA. Verify secrets are not exposed and permissions are scoped.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
env:
KIND_VERSION: "v0.27.0"
concurrency:
group: e2e-tests-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: true
env:
KIND_VERSION: "v0.27.0"
permissions:
contents: read
actions: write
concurrency:
group: e2e-tests-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: true
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e.yml around lines 12 - 17, Add an explicit permissions
block at the top-level of this workflow (near the existing env/KIND_VERSION and
concurrency keys) that scopes GITHUB_TOKEN to only the least-privilege scopes
required for the job (do NOT rely on default write); for example set only the
specific permissions you need such as contents: read, actions: read, id-token:
write, or packages: write as appropriate for your cache/action usage, and remove
any broader write defaults. Also pin every third-party action used in the
workflow to an exact commit SHA (instead of floating tags) so the run is
hermetic and auditable.

Expand Down Expand Up @@ -87,71 +90,102 @@ jobs:
with:
driver-opts: network=host

- name: Build component images from PR code
- name: Build or pull frontend image
if: needs.detect-changes.outputs.frontend == 'true'
uses: docker/build-push-action@v7
with:
Comment on lines +95 to +96
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Apr 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# List tag-pinned actions in the changed workflow.
rg -nP '^\s*uses:\s*[^@\s]+@v[0-9]+' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 551

🏁 Script executed:

head -20 .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 405

🏁 Script executed:

sed -n '90,100p' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 422

🏁 Script executed:

sed -n '110,120p' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 500

🏁 Script executed:

sed -n '1,40p' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 1194

🏁 Script executed:

sed -n '170,180p' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 335

🏁 Script executed:

sed -n '230,245p' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 584

🏁 Script executed:

grep -n 'permissions:' .github/workflows/e2e.yml

Repository: ambient-code/platform

Length of output: 47

Workflow actions must be pinned to commit SHAs and permissions scoped.

All action usages rely on mutable version tags (@v6, @v7, @v4, @v3) instead of immutable commit SHAs. This affects 12 action instances: lines 32, 37, 60, 78, 89, 95, 114, 133, 152, 173, 232, and 241.

Additionally, the workflow lacks an explicit top-level permissions: block to scope token access.

Replace version tags with full commit SHAs (e.g., uses: docker/build-push-action@<full-sha>) and add a top-level permissions: block specifying minimal required scopes per the guideline: .github/workflows/**/*.{yml,yaml} must pin action versions to SHA and scope permissions.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e.yml around lines 95 - 96, Replace all mutable action
tags with immutable commit SHAs for each action usage (e.g., replace
docker/build-push-action@v7 and the other `@v6/`@v4/@v3 occurrences with their
corresponding full commit SHAs) so every "uses:" entry is pinned; update the 12
action instances referenced (including docker/build-push-action and the other
actions in the file) to their exact SHA values. Also add a top-level
permissions: block to the workflow that scopes the GITHUB_TOKEN to the minimal
required permissions for this workflow (declare only the specific permission
keys needed, e.g., read/write for specific resources used), ensuring the token
is not granted broad defaults. Ensure changes touch the workflow root
(top-level) and every "uses:" line that currently has a version tag.

context: components/frontend
file: components/frontend/Dockerfile
load: true
tags: quay.io/ambient_code/vteam_frontend:e2e-test
cache-from: |
type=gha,scope=frontend-amd64
type=gha,scope=e2e-frontend
cache-to: type=gha,mode=max,scope=e2e-frontend

- name: Pull frontend latest (unchanged)
if: needs.detect-changes.outputs.frontend != 'true'
run: |
echo "======================================"
echo "Building images from PR code..."
echo "PR #${{ github.event.pull_request.number }}"
echo "SHA: ${{ github.event.pull_request.head.sha }}"
echo "======================================"
docker pull quay.io/ambient_code/vteam_frontend:latest
docker tag quay.io/ambient_code/vteam_frontend:latest quay.io/ambient_code/vteam_frontend:e2e-test

# Build frontend image (if changed or use latest)
if [ "${{ needs.detect-changes.outputs.frontend }}" == "true" ]; then
echo "Building frontend (changed)..."
docker build -t quay.io/ambient_code/vteam_frontend:e2e-test \
-f components/frontend/Dockerfile \
components/frontend
else
echo "Frontend unchanged, pulling latest..."
docker pull quay.io/ambient_code/vteam_frontend:latest
docker tag quay.io/ambient_code/vteam_frontend:latest quay.io/ambient_code/vteam_frontend:e2e-test
fi
- name: Build or pull backend image
if: needs.detect-changes.outputs.backend == 'true'
uses: docker/build-push-action@v7
with:
context: components/backend
file: components/backend/Dockerfile
load: true
tags: quay.io/ambient_code/vteam_backend:e2e-test
cache-from: |
type=gha,scope=backend-amd64
type=gha,scope=e2e-backend
cache-to: type=gha,mode=max,scope=e2e-backend

# Build backend image (if changed or use latest)
if [ "${{ needs.detect-changes.outputs.backend }}" == "true" ]; then
echo "Building backend (changed)..."
docker build -t quay.io/ambient_code/vteam_backend:e2e-test \
-f components/backend/Dockerfile \
components/backend
else
echo "Backend unchanged, pulling latest..."
docker pull quay.io/ambient_code/vteam_backend:latest
docker tag quay.io/ambient_code/vteam_backend:latest quay.io/ambient_code/vteam_backend:e2e-test
fi
- name: Pull backend latest (unchanged)
if: needs.detect-changes.outputs.backend != 'true'
run: |
docker pull quay.io/ambient_code/vteam_backend:latest
docker tag quay.io/ambient_code/vteam_backend:latest quay.io/ambient_code/vteam_backend:e2e-test

# Build operator image (if changed or use latest)
if [ "${{ needs.detect-changes.outputs.operator }}" == "true" ]; then
echo "Building operator (changed)..."
docker build -t quay.io/ambient_code/vteam_operator:e2e-test \
-f components/operator/Dockerfile \
components/operator
else
echo "Operator unchanged, pulling latest..."
docker pull quay.io/ambient_code/vteam_operator:latest
docker tag quay.io/ambient_code/vteam_operator:latest quay.io/ambient_code/vteam_operator:e2e-test
fi
- name: Build or pull operator image
if: needs.detect-changes.outputs.operator == 'true'
uses: docker/build-push-action@v7
with:
context: components/operator
file: components/operator/Dockerfile
load: true
tags: quay.io/ambient_code/vteam_operator:e2e-test
cache-from: |
type=gha,scope=operator-amd64
type=gha,scope=e2e-operator
cache-to: type=gha,mode=max,scope=e2e-operator

# Build ambient-runner image (if changed or use latest)
if [ "${{ needs.detect-changes.outputs.claude-runner }}" == "true" ]; then
echo "Building ambient-runner (changed)..."
docker build -t quay.io/ambient_code/vteam_claude_runner:e2e-test \
-f components/runners/ambient-runner/Dockerfile \
components/runners
else
echo "Claude-runner unchanged, pulling latest..."
docker pull quay.io/ambient_code/vteam_claude_runner:latest
docker tag quay.io/ambient_code/vteam_claude_runner:latest quay.io/ambient_code/vteam_claude_runner:e2e-test
fi
- name: Pull operator latest (unchanged)
if: needs.detect-changes.outputs.operator != 'true'
run: |
docker pull quay.io/ambient_code/vteam_operator:latest
docker tag quay.io/ambient_code/vteam_operator:latest quay.io/ambient_code/vteam_operator:e2e-test

echo ""
echo "✅ All images ready"
docker images | grep e2e-test
- name: Build or pull ambient-runner image
if: needs.detect-changes.outputs.claude-runner == 'true'
uses: docker/build-push-action@v7
with:
context: components/runners
file: components/runners/ambient-runner/Dockerfile
load: true
tags: quay.io/ambient_code/vteam_claude_runner:e2e-test
cache-from: |
type=gha,scope=ambient-runner-amd64
type=gha,scope=e2e-ambient-runner
cache-to: type=gha,mode=max,scope=e2e-ambient-runner

- name: Pull ambient-runner latest (unchanged)
if: needs.detect-changes.outputs.claude-runner != 'true'
run: |
docker pull quay.io/ambient_code/vteam_claude_runner:latest
docker tag quay.io/ambient_code/vteam_claude_runner:latest quay.io/ambient_code/vteam_claude_runner:e2e-test

- name: Show built images
run: docker images | grep e2e-test

- name: Cache kind binary
uses: actions/cache@v4
with:
path: ~/k8s-tools/kind
key: kind-${{ runner.os }}-${{ env.KIND_VERSION }}

- name: Install kind
run: |
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.27.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind
mkdir -p ~/k8s-tools
if [[ ! -f ~/k8s-tools/kind ]]; then
echo "Downloading kind $KIND_VERSION..."
curl -sLo ~/k8s-tools/kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-amd64"
chmod +x ~/k8s-tools/kind
else
echo "Using cached kind"
fi
sudo cp ~/k8s-tools/kind /usr/local/bin/kind
kind version

- name: Setup kind cluster
Expand Down
9 changes: 1 addition & 8 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,14 +141,7 @@ jobs:
cd components/backend
go vet ./...

- name: Run golangci-lint
uses: golangci/golangci-lint-action@v9
with:
version: latest
working-directory: components/backend
args: --timeout=5m

- name: Run golangci-lint (test build tags)
- name: Run golangci-lint (all build tags)
uses: golangci/golangci-lint-action@v9
with:
version: latest
Expand Down
5 changes: 2 additions & 3 deletions .github/workflows/unit-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,12 +128,11 @@ jobs:
go run github.com/onsi/ginkgo/v2/ginkgo -r -v --cover --keep-going --github-output=true --tags=test --label-filter=${{ steps.configure.outputs.TEST_LABEL }} --junit-report=${{ env.JUNIT_FILENAME }} --output-dir=reports -- -testNamespace=${{ steps.configure.outputs.DEFAULT_NAMESPACE }}
continue-on-error: true

- name: Install Junit2Html plugin and generate report
- name: Generate HTML test report
if: (!cancelled())
shell: bash
run: |
pip install junit2html
junit2html ${{ env.TESTS_DIR }}/reports/${{ env.JUNIT_FILENAME }} ${{ env.TESTS_DIR }}/reports/test-report.html
pipx run junit2html ${{ env.TESTS_DIR }}/reports/${{ env.JUNIT_FILENAME }} ${{ env.TESTS_DIR }}/reports/test-report.html
continue-on-error: true

- name: Configure report name
Expand Down
Loading