Wire live-test credentials into CI from Actions secrets #10

Merged

dev-agent merged 2 commits from ci-live-secrets into main 2026-09-07 14:41:26 +00:00

Conversation 1 Commits 2 Files Changed 3

+40 -13

dev-agent commented 2026-09-07 14:28:12 +00:00

Collaborator

Copy link

Copy source

Item 3 of the CI-live-tests setup: the integration step now injects NISSE_LLM_*, NISSE_ROLE_EXECUTOR, and NISSE_MATRIX_* from repo Actions secrets. The existing skip-guards mean a missing secret or unreachable service degrades to a skip with its reason printed (-rs), never a red X on unrelated work.

This PR's own CI run doubles as the reachability test (item 2): check the Integration tests step's log — "7 passed" means both live paths work from the runner; skips will name exactly which variables were missing, and a failure will show which network hop broke (the candidates we've seen before: public-IP hairpin into Authelia, or DNS inside the runner container not following split-horizon).

🤖 Generated with Claude Code

Item 3 of the CI-live-tests setup: the integration step now injects `NISSE_LLM_*`, `NISSE_ROLE_EXECUTOR`, and `NISSE_MATRIX_*` from repo Actions secrets. The existing skip-guards mean a missing secret or unreachable service degrades to a skip with its reason printed (`-rs`), never a red X on unrelated work. This PR's own CI run doubles as the reachability test (item 2): check the Integration tests step's log — "7 passed" means both live paths work from the runner; skips will name exactly which variables were missing, and a failure will show which network hop broke (the candidates we've seen before: public-IP hairpin into Authelia, or DNS inside the runner container not following split-horizon). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dev-agent added 1 commit 2026-09-07 14:28:12 +00:00

Wire live-test credentials into CI from Actions secrets ... 968347a6be

The integration step now receives the LLM and Matrix env vars from
repo secrets, so the live smoke tests run in CI when the runner can
reach the services; the skip-guards keep a missing secret or
unreachable service as a skip, never a failure. -rs surfaces skip
reasons in the CI log for diagnosis.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dev-agent added 1 commit 2026-09-07 14:33:15 +00:00

Gate live tests on one sentinel var each, fail on partial config ... 10aa77899e

Skipping now keys solely on NISSE_LLM_BASE_URL and
NISSE_MATRIX_HOMESERVER: if the sentinel is set, the live path is
expected to work and any other missing variable is an assertion
failure naming it, not a silent skip. A misnamed or misplaced CI
secret previously produced a green run with no live coverage.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dongar approved these changes 2026-09-07 14:40:46 +00:00

dev-agent merged commit ac9ae27bdc into main 2026-09-07 14:41:26 +00:00

dev-agent deleted branch ci-live-secrets 2026-09-07 14:41:26 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

dongar

Labels

Clear labels

bug

Reproduce first; the fix goes ahead after a grace period unless the operator replies

design

Agree the design (ARCHITECTURE.md + build plan PR) before any code

discuss

Talk it through with the operator before restating

e2e:full

CI runs all 48 property walks and the whole end-to-end suite on this PR

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

dev-agent dongar (Don Garrett) nisse-review

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dev/nisse#10