End-to-end (security)

Matrix: name: security, shard: security

Cancelled

cancelled by a newer run in the same concurrency group

Set up job

Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@b7a2a2f24a90Runner: image diffinery-runner:8a871c84f8ee3e93f0d40c7d, in iad22, ENAM, container 7437e95cb7f225ec2f60628ccfa26b5ed2f8d2af5a26fd51e6288dc223d2d9fdRunner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), an earlier run of this job wasn't measured closely enough (busy cores every quarter second); runs-on: diffinery-large (or -medium, -small, -tiny) sets a sizeHost: AMD EPYC (family 25, model 17), 4 vCPUs, 2550 MHzWorkspace: /workspace/diffinery

Run actions/checkout@v42s

##[group]Run actions/checkout@v4##[endgroup]Syncing repository: codician/diffineryFetching the repository (depth 1)remote: Enumerating objects: 684, done.        Receiving objects:   0% (1/684)
Receiving objects:   1% (7/684)
Receiving objects:   2% (14/684)
Receiving objects:   3% (21/684)
Receiving objects:   4% (28/684)
Receiving objects:   5% (35/684)
Receiving objects:   6% (42/684)
Receiving objects:   7% (48/684)
Receiving objects:   8% (55/684)
Receiving objects:   9% (62/684)
Receiving objects:  10% (69/684)
Receiving objects:  11% (76/684)
Receiving objects:  12% (83/684)
Receiving objects:  13% (89/684)
Receiving objects:  14% (96/684)
Receiving objects:  15% (103/684)
Receiving objects:  16% (110/684)
Receiving objects:  17% (117/684)
Receiving objects:  18% (124/684)
Receiving objects:  19% (130/684)
Receiving objects:  20% (137/684)
Receiving objects:  21% (144/684)
Receiving objects:  22% (151/684)
Receiving objects:  23% (158/684)
Receiving objects:  24% (165/684)
Receiving objects:  25% (171/684)
Receiving objects:  26% (178/684)
Receiving objects:  27% (185/684)
Receiving objects:  28% (192/684)
Receiving objects:  29% (199/684)
Receiving objects:  30% (206/684)
Receiving objects:  31% (213/684)
Receiving objects:  32% (219/684)
Receiving objects:  33% (226/684)
Receiving objects:  34% (233/684)
Receiving objects:  35% (240/684)
Receiving objects:  36% (247/684)
Receiving objects:  37% (254/684)
Receiving objects:  38% (260/684)
Receiving objects:  39% (267/684)
Receiving objects:  40% (274/684)
Receiving objects:  41% (281/684)
Receiving objects:  42% (288/684)
Receiving objects:  43% (295/684)
Receiving objects:  44% (301/684)
Receiving objects:  45% (308/684)
Receiving objects:  46% (315/684)
Receiving objects:  47% (322/684)
Receiving objects:  48% (329/684)
Receiving objects:  49% (336/684)
Receiving objects:  50% (342/684)
Receiving objects:  51% (349/684)
Receiving objects:  52% (356/684)
Receiving objects:  53% (363/684)
Receiving objects:  54% (370/684)
Receiving objects:  55% (377/684)
Receiving objects:  56% (384/684)
Receiving objects:  57% (390/684)
Receiving objects:  58% (397/684)
Receiving objects:  59% (404/684)
Receiving objects:  60% (411/684)
Receiving objects:  61% (418/684)
Receiving objects:  62% (425/684)
Receiving objects:  63% (431/684)
Receiving objects:  64% (438/684)
Receiving objects:  65% (445/684)
Receiving objects:  66% (452/684)
Receiving objects:  67% (459/684)
Receiving objects:  68% (466/684)
Receiving objects:  69% (472/684)
Receiving objects:  70% (479/684)
Receiving objects:  71% (486/684)
Receiving objects:  72% (493/684)
Receiving objects:  73% (500/684)
Receiving objects:  74% (507/684)
Receiving objects:  75% (513/684)
Receiving objects:  76% (520/684)
Receiving objects:  77% (527/684)
Receiving objects:  78% (534/684)
Receiving objects:  79% (541/684)
Receiving objects:  80% (548/684)
Receiving objects:  81% (555/684)
Receiving objects:  82% (561/684)
Receiving objects:  83% (568/684)
Receiving objects:  84% (575/684)
Receiving objects:  85% (582/684)
Receiving objects:  86% (589/684)
Receiving objects:  87% (596/684)
Receiving objects:  88% (602/684)
Receiving objects:  89% (609/684)
Receiving objects:  90% (616/684)
Receiving objects:  91% (623/684)
Receiving objects:  92% (630/684)
Receiving objects:  93% (637/684)
Receiving objects:  94% (643/684)
Receiving objects:  95% (650/684)
Receiving objects:  96% (657/684)
remote: Total 684 (delta 0), reused 684 (delta 0)        Receiving objects:  97% (664/684)
Receiving objects:  98% (671/684)
Receiving objects:  99% (678/684)
Receiving objects: 100% (684/684)
Receiving objects: 100% (684/684), 3.04 MiB | 11.78 MiB/s, done.From https://diffinery.com/codician/diffinery * [new ref]         b7a2a2f24a9005e67e17114524f98fddab11bc2d -> origin/diffinery-checkoutNote: switching to 'b7a2a2f24a9005e67e17114524f98fddab11bc2d'.You are in 'detached HEAD' state. You can look around, make experimentalchanges and commit them, and you can discard any commits you make in thisstate without impacting any branches by switching back to a branch.If you want to create a new branch to retain commits you create, you maydo so (now or later) by using -c with the switch command. Example:  git switch -c <new-branch-name>Or undo this operation with:  git switch -Turn off this advice by setting config variable advice.detachedHead to falseHEAD is now at b7a2a2f Merge 43a87375a812834caba0f87a746d8b60feca2cbb into 1c63ad9caf3da457ca2e0e9adff25ab82b554c36HEAD is now at b7a2a2f24a9005e67e17114524f98fddab11bc2d

Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b12s

Download action repository 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1'##[group]Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1with:  dest: ~/setup-pnpm  run_install: null  cache: false  cache_dependency_path: pnpm-lock.yaml  package_json_file: package.json  standalone: false##[endgroup]##[group]Running self-installer...Progress: resolved 1, reused 0, downloaded 0, added 0Packages: +1+Progress: resolved 1, reused 0, downloaded 1, added 1, donedependencies:+ pnpm 10.28.0 (12.14.0 is available)Done in 1.2s##[endgroup]Installation Completed!

Run actions/setup-node@v47s

##[group]Run actions/setup-node@v4with:  node-version: 22  cache: pnpm##[endgroup]Found in cache @ 22.22.0 (pre-installed node satisfies '22')Cache Size: ~216 MB (226493609 B)Cache restored from key: node-cache-Linux-x64-pnpm-a02ba8dce5cb7329b868883337d1a03f862819a15859861dae22d3a8b1092f41

Run pnpm install --frozen-lockfile4s

##[group]Run pnpm install --frozen-lockfile##[endgroup]Scope: all 8 workspace projectsLockfile is up to date, resolution step is skippedProgress: resolved 1, reused 0, downloaded 0, added 0Packages: +250++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Progress: resolved 250, reused 244, downloaded 0, added 166Progress: resolved 250, reused 244, downloaded 0, added 250, done.../esbuild@0.25.11/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../esbuild@0.28.1/node_modules/esbuild postinstall$ node install.js.../esbuild@0.25.12/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall$ node install.js.../esbuild@0.25.11/node_modules/esbuild postinstall: Done.../esbuild@0.28.1/node_modules/esbuild postinstall: Done.../node_modules/workerd postinstall: Done.../esbuild@0.25.12/node_modules/esbuild postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall: DonedevDependencies:+ turbo 2.11.7+ typescript 5.9.3Done in 3.5s using pnpm v10.28.0

Run pnpm -r --if-present build2s

##[group]Run pnpm -r --if-present build##[endgroup]Scope: 7 of 8 workspace projectsapps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env nodeimport { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjscontainers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/cli build:   dist/diffinery.mjs  446.1kbapps/cli build: ⚡ Done in 75msapps/cli build: Donecontainers/runner build:   dist/agent.mjs  682.1kbcontainers/runner build: ⚡ Done in 88mscontainers/runner build: Doneapps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KBapps/diffinery build: docs: 72 pages (+2 generated at runtime), 6 images, CLI 0.1.0 (235 KiB), editor extension 0.1.1 (20 KiB)apps/diffinery build: Done

Run pnpm --filter @diffinery/app exec playwright install --with-deps chromium

Run as_root() { if [ "$(id -u)" = 0 ]; then "$@"; else sudo "$@"; fi; }

Run the shard's tests237h 7m

##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another.core='/e2e\.test\.mjs$'agents='/(agentic|review|tasks)\.test\.mjs$'security='/(security|status)\.test\.mjs$'# The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on# Diffinery's runners): two shards of their own, so no part of the file runs into node's# per-file timeout, which is the --test-timeout here.histories='^real histories:'large='^(large files|large pushes):'opts=(--test-timeout=600000)case "security" in  core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;;  histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;;  large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;;  agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;;  security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;;  *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;;esacecho "$files"node --test --test-concurrency=1 "${opts[@]}" $files##[endgroup]test/e2e/security.test.mjstest/e2e/status.test.mjsTAP version 13# Subtest: security: search, required checks, environments, reviews, locks, archives, drafts and tree namesok 1 - security: search, required checks, environments, reviews, locks, archives, drafts and tree names  ---  duration_ms: 33917.67326  type: 'test'  ...# Subtest: security: organization admins can't hand out ownershipok 2 - security: organization admins can't hand out ownership  ---  duration_ms: 126.291438  type: 'test'  ...# Subtest: security: anonymous writes, token scopes, agent secrets, merge rules and draftsok 3 - security: anonymous writes, token scopes, agent secrets, merge rules and drafts  ---  duration_ms: 1752.290124  type: 'test'  ...# Subtest: security: push protection covers commits made without gitok 4 - security: push protection covers commits made without git  ---  duration_ms: 510.883835  type: 'test'  ...# Subtest: security: limited tokens, invisible repositories, readers' labels and the audit trailok 5 - security: limited tokens, invisible repositories, readers' labels and the audit trail  ---  duration_ms: 16270.343818  type: 'test'  ...# Subtest: security: organization pictures are the owners' to change, and invitations aren't sent twiceok 6 - security: organization pictures are the owners' to change, and invitations aren't sent twice  ---  duration_ms: 99.379674  type: 'test'  ...# Subtest: security: organization members get the base permission, which only owners changeok 7 - security: organization members get the base permission, which only owners change  ---  duration_ms: 893.512112  type: 'test'  ...# Subtest: security: leaving an organization takes its repository access alongok 8 - security: leaving an organization takes its repository access along  ---  duration_ms: 495.711133  type: 'test'  ...# Subtest: security: organization settings are checked before anything is saved, and agents see the base permissionok 9 - security: organization settings are checked before anything is saved, and agents see the base permission  ---  duration_ms: 4399.36451  type: 'test'  ...# Subtest: security: a transferred repository keeps its data, and its old name redirects only for readersok 10 - security: a transferred repository keeps its data, and its old name redirects only for readers  ---  duration_ms: 6665.373641  type: 'test'  ...# Subtest: security: agents land changes on protected branches only through auto-merge a person allowed, gated by CIok 11 - security: agents land changes on protected branches only through auto-merge a person allowed, gated by CI  ---  duration_ms: 14138.237831  type: 'test'  ...# Subtest: security: an admin can let agents' auto-merges land on green checks without an approval, and nothing moreok 12 - security: an admin can let agents' auto-merges land on green checks without an approval, and nothing more  ---  duration_ms: 10990.555557  type: 'test'  ...# Subtest: security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queueok 13 - security: an archived repository lands nothing by itself: archiving ends auto-merge and empties the merge queue  ---  duration_ms: 698.073355  type: 'test'  ...# Subtest: security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected oneok 14 - security: landing a pull request deletes its head branch only when asked, through auto-merge and the queue too, and never a protected one  ---  duration_ms: 1202.922885  type: 'test'  ...

codician/diffinerypublic

End-to-end (security)