mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require explicit AgentRun tool Secret names

Browse Source
This commit is contained in:
root
2026-07-17 05:10:20 +02:00
parent f0dd4c8339
commit e2a1670736
4 changed files with 46 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.tekton/hwlab-nc01-production-pac.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ metadata:
pipelinesascode.tekton.dev/on-cel-expression: "event == 'push' && target_branch == 'release' && node == 'NC01'"
pipelinesascode.tekton.dev/max-keep-runs: "8"
unidesk.ai/owning-config-ref: "config/hwlab-node-lanes.yaml#lanes.production.targets.NC01"
unidesk.ai/effective-config-sha256: sha256:632f16c327dd5db47ea8b313237b24516a2490feb094f08c82d7f719fb4f3a88
unidesk.ai/effective-config-sha256: sha256:8c54c1d70b44aecc890f729e5d849c1a3ca68d7069c8ee20774dcd5a1b7ff365
unidesk.ai/source-artifact-renderer: hwlab-runtime-lane
unidesk.ai/source-artifact-mode: remote-pipeline-annotation
pipelinesascode.tekton.dev/pipeline: ci/pipelines/hwlab-nc01-production-ci-image-publish.yaml
ci/pipelines/hwlab-nc01-production-ci-image-publish.yaml
+11 -11
View File
File diff suppressed because one or more lines are too long
internal/cloud/code-agent-agentrun-adapter.ts
+20 -5
View File
@@ -1344,35 +1344,50 @@ function namespaceForAgentRunRuntimeLane(lane) {
return null;
}
function agentRunRuntimeAuthorityError(code, message) {
function agentRunRuntimeAuthorityError(code, message, details = {}) {
return Object.assign(new Error(message), {
code,
statusCode: 500,
details,
valuesPrinted: false
});
}
function agentRunToolCredentials(env = process.env, toolCapabilities = null) {
const namespace = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_TOOL_SECRET_NAMESPACE, env.HWLAB_CODE_AGENT_AGENTRUN_SECRET_NAMESPACE, DEFAULT_RUNNER_NAMESPACE);
const githubSecretName = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME, "agentrun-v01-tool-github-pr");
const githubSecretKey = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_KEY, "GH_TOKEN");
const unideskSecretName = firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME, "agentrun-v01-tool-unidesk-ssh");
const credentials = [];
if (toolCapabilityAllowed(toolCapabilities, "github_pr")) credentials.push({
if (toolCapabilityAllowed(toolCapabilities, "github_pr")) {
const githubSecretName = requireAgentRunToolSecretName(env, "HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME", "github");
credentials.push({
tool: "github",
purpose: "pull-request",
secretRef: { namespace, name: githubSecretName, keys: [githubSecretKey] },
projection: { kind: "env", envName: githubSecretKey, secretKey: githubSecretKey }
});
if (toolCapabilityAllowed(toolCapabilities, "unidesk_ssh")) credentials.push({
}
if (toolCapabilityAllowed(toolCapabilities, "unidesk_ssh")) {
const unideskSecretName = requireAgentRunToolSecretName(env, "HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME", "unidesk-ssh");
credentials.push({
tool: "unidesk-ssh",
purpose: "ssh-passthrough",
secretRef: { namespace, name: unideskSecretName, keys: ["UNIDESK_SSH_CLIENT_TOKEN"] },
projection: { kind: "env", envName: "UNIDESK_SSH_CLIENT_TOKEN", secretKey: "UNIDESK_SSH_CLIENT_TOKEN" }
});
}
return credentials;
}
function requireAgentRunToolSecretName(env, envName, tool) {
const secretName = text(env[envName]);
if (secretName) return secretName;
throw agentRunRuntimeAuthorityError(
"agentrun_tool_secret_not_configured",
`${envName} is required when the ${tool} capability is enabled`,
{ tool, envName, valuesPrinted: false }
);
}
async function resolveToolCapabilities({ params = {}, options = {} } = {}) {
const ownerUserId = text(params.ownerUserId);
const accessController = options.accessController;
internal/cloud/server-agent-chat.test.ts
+14 -2
View File
@@ -663,8 +663,8 @@ test("cloud api /v1/agent/chat delegates v0.3 turns to AgentRun v0.1 over adapte
assert.equal(Object.hasOwn(body.resourceBundleRef, "skillRefs"), false);
assert.equal(Object.hasOwn(body.resourceBundleRef, "workspaceFiles"), false);
const toolCredentials = body.executionPolicy.secretScope.toolCredentials;
assert.equal(toolCredentials.some((item) => item.tool === "github" && item.projection.envName === "GH_TOKEN" && item.secretRef.name === "agentrun-v01-tool-github-pr"), true);
assert.equal(toolCredentials.some((item) => item.tool === "unidesk-ssh" && item.projection.envName === "UNIDESK_SSH_CLIENT_TOKEN" && item.secretRef.name === "agentrun-v01-tool-unidesk-ssh"), true);
assert.equal(toolCredentials.some((item) => item.tool === "github" && item.projection.envName === "GH_TOKEN" && item.secretRef.name === "agentrun-test-tool-github-pr"), true);
assert.equal(toolCredentials.some((item) => item.tool === "unidesk-ssh" && item.projection.envName === "UNIDESK_SSH_CLIENT_TOKEN" && item.secretRef.name === "agentrun-test-tool-unidesk-ssh"), true);
assert.equal(body.sessionRef.sessionId, "ses_agentrun_server_test_agentrun");
assert.equal(body.sessionRef.metadata.hwlabProjectId, "prj_hwpod_workbench");
assert.equal(body.sessionRef.metadata.hwlabSessionId, "ses_server-test-agentrun");
@@ -857,6 +857,8 @@ test("cloud api /v1/agent/chat delegates v0.3 turns to AgentRun v0.1 over adapte
HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME: "agentrun-test-tool-github-pr",
HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME: "agentrun-test-tool-unidesk-ssh",
HWLAB_CODE_AGENT_DEEPSEEK_MODEL: "deepseek-chat",
HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED: "false",
HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED: "false",
@@ -1245,6 +1247,8 @@ test("cloud api preserves typed schema-invalid admission failure without claimin
HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "gpt-pika",
HWLAB_CODE_AGENT_AGENTRUN_GPT_PIKA_SECRET_NAME: "agentrun-test-provider-gpt-pika",
HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME: "agentrun-test-tool-github-pr",
HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME: "agentrun-test-tool-unidesk-ssh",
HWLAB_ENVIRONMENT: "v03",
HWLAB_GITOPS_PROFILE: "v03"
},
@@ -1452,6 +1456,8 @@ test("cloud api AgentRun adapter reports persistent thread resume when a complet
HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME: "agentrun-test-tool-github-pr",
HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME: "agentrun-test-tool-unidesk-ssh",
HWLAB_ENVIRONMENT: "v02",
HWLAB_GITOPS_PROFILE: "v02"
},
@@ -1626,6 +1632,8 @@ test("cloud api AgentRun adapter exposes invalid tool-call attribution through K
HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME: "agentrun-test-tool-github-pr",
HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME: "agentrun-test-tool-unidesk-ssh",
HWLAB_ENVIRONMENT: "v02",
HWLAB_GITOPS_PROFILE: "v02"
},
@@ -1833,6 +1841,8 @@ test("cloud api surfaces manager-side evicted-session recovery through Kafka pro
HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME: "agentrun-test-tool-github-pr",
HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME: "agentrun-test-tool-unidesk-ssh",
HWLAB_ENVIRONMENT: "v02",
HWLAB_GITOPS_PROFILE: "v02"
},
@@ -1992,6 +2002,8 @@ test("cloud api AgentRun adapter maps minimax-m3 provider profile to AgentRun ba
HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
HWLAB_CODE_AGENT_AGENTRUN_MINIMAX_M3_SECRET_NAME: "agentrun-test-provider-minimax-m3",
HWLAB_CODE_AGENT_AGENTRUN_GITHUB_TOOL_SECRET_NAME: "agentrun-test-tool-github-pr",
HWLAB_CODE_AGENT_AGENTRUN_UNIDESK_SSH_TOOL_SECRET_NAME: "agentrun-test-tool-unidesk-ssh",
HWLAB_ENVIRONMENT: "v02",
HWLAB_GITOPS_PROFILE: "v02"
},