A repository per test run instead of the shared sandbox #107

2026-10-06T05:20:09Z

dev-agent commented

2026-10-06 05:20:09 +00:00

The live tests stop using the shared dongar/nisse-dev-testing-sandbox, as you asked. Its state built up across runs: a merged count_vowels, committed __pycache__ directories.

What changes

e2e_support.fresh_repo(operator, run, keys, agent=…) makes nisse-testing-operator/nisse-e2e-<run> as the test operator, the way an operator provides a project's (D4, D8):
- seed: tests/integration/seed/, the sandbox's package and tests without the leftovers;
- access: the agent's account as a collaborator with write access;
- protection: main takes pushes only from the owner, so the scripted operator can still set up fixtures and the agent is refused, and needs one approval to merge;
- push key: a deploy key generated for the run.
It's deleted afterwards. NISSE_E2E_KEEP_REPOS=1 keeps it for debugging.
Both e2e fixtures (old and new loop) use it, and the per-run base branches are gone. The merge helper approves first, since protection now requires an approval.
test_gitea_live uses it. CI passes NISSE_OPERATOR_TOKEN (now a secret) and no longer writes the sandbox deploy key.
scripts/e2e-cleanup.sh [--all] deletes nisse-e2e-* repos a dead run left behind.
nisse-test.yaml's project entry is a placeholder, and pytest and ruff skip the seed.
The token now has write:user, which Gitea requires for POST /user/repos.

Tests

test_fresh_repo_live.py: the repo is seeded, the agent may push to it, main is protected against the agent, and the repo is gone afterwards.
test_gitea_live: its D4 checks (the agent can't merge its own PR or push to main) pass in the fresh repo.
Full runs: scripts/e2e.sh passed 7 of 7, and e2e-cleanup.sh --all then found nothing left over. The unit (703) and integration (21) tiers pass.

After merging

You can delete dongar/nisse-dev-testing-sandbox and the NISSE_PUSH_KEY CI secret.
The bring-up config still names the sandbox. It moves to its own operator-made repo before the next live test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

The live tests stop using the shared `dongar/nisse-dev-testing-sandbox`, as you asked. Its state built up across runs: a merged `count_vowels`, committed `__pycache__` directories. ## What changes - **`e2e_support.fresh_repo(operator, run, keys, agent=…)`** makes `nisse-testing-operator/nisse-e2e-<run>` as the test operator, the way an operator provides a project's (D4, D8): - **seed:** `tests/integration/seed/`, the sandbox's package and tests without the leftovers; - **access:** the agent's account as a collaborator with write access; - **protection:** `main` takes pushes only from the owner, so the scripted operator can still set up fixtures and the agent is refused, and needs one approval to merge; - **push key:** a deploy key generated for the run. It's deleted afterwards. `NISSE_E2E_KEEP_REPOS=1` keeps it for debugging. - **Both e2e fixtures** (old and new loop) use it, and the per-run base branches are gone. The `merge` helper approves first, since protection now requires an approval. - **`test_gitea_live`** uses it. CI passes `NISSE_OPERATOR_TOKEN` (now a secret) and no longer writes the sandbox deploy key. - **`scripts/e2e-cleanup.sh [--all]`** deletes `nisse-e2e-*` repos a dead run left behind. - **`nisse-test.yaml`'s** project entry is a placeholder, and pytest and ruff skip the seed. - **The token** now has `write:user`, which Gitea requires for `POST /user/repos`. ## Tests - **`test_fresh_repo_live.py`:** the repo is seeded, the agent may push to it, `main` is protected against the agent, and the repo is gone afterwards. - **`test_gitea_live`:** its D4 checks (the agent can't merge its own PR or push to `main`) pass in the fresh repo. - **Full runs:** `scripts/e2e.sh` passed 7 of 7, and `e2e-cleanup.sh --all` then found nothing left over. The unit (703) and integration (21) tiers pass. ## After merging - You can delete `dongar/nisse-dev-testing-sandbox` and the `NISSE_PUSH_KEY` CI secret. - The bring-up config still names the sandbox. It moves to its own operator-made repo before the next live test. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

dev-agent added 1 commit 2026-10-06 05:20:09 +00:00

A repository per test run instead of the shared sandbox

CI / checks (push) Skipped

CI / checks (pull_request) Successful in 5m17s

Details

679ace1fd8

Every live test that touches a repository gets one of its own from
e2e_support.fresh_repo, made by the test operator as an operator makes a
project's (D4, D8): seeded from tests/integration/seed/ (the sandbox's
package, without past runs' leftovers), the agent's account a collaborator
with write access, main protected (pushes only by the owner, an approval to
merge), and a deploy key generated for the run. It is deleted afterwards
(NISSE_E2E_KEEP_REPOS keeps it); scripts/e2e-cleanup.sh deletes leftovers.

- Both e2e fixtures use it; per-run base branches are gone. The merge
  helper approves first, as the protection now requires.
- test_gitea_live uses it, so CI needs NISSE_OPERATOR_TOKEN and no longer
  writes the sandbox deploy key (NISSE_PUSH_KEY).
- A live test of the helper: seeded, shared with the agent, protected
  against it, deleted.
- nisse-test.yaml's project entry is a placeholder; pytest and ruff skip
  the seed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

dongar approved these changes

2026-10-06 05:25:51 +00:00

dev-agent merged commit b3bf6d5a6e into main

2026-10-06 05:26:01 +00:00

dev-agent deleted branch fresh-test-repos

2026-10-06 05:26:01 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dev/nisse#107