End-to-end (security)

Matrix: name: security, shard: security

Cancelled

cancelled by a newer run in the same concurrency group

Set up job

Diffinery runner: job e2e (End-to-end (security)) for codician/diffinery@7230a07327daRunner: image diffinery-runner:dfb768929ca5ce308febdab6, in lhr09, WEUR, container 28fdc17937db23d1e7467572822b9e4f7b68dacb87e27535a75a8f3b1b9a71ceRunner size: large (4 vCPU, 12 GiB of memory, 20 GB of disk), this job uses what a smaller runner doesn't have; runs-on: diffinery-large (or -medium, -small, -tiny) sets a sizeHost: AMD EPYC (family 25, model 1), 4 vCPUs, 2000 MHzWorkspace: /workspace/diffinery

Run actions/checkout@v42s

##[group]Run actions/checkout@v4##[endgroup]Syncing repository: codician/diffineryFetching the repository (depth 1)remote: Enumerating objects: 671, done.        Receiving objects:   0% (1/671)
Receiving objects:   1% (7/671)
Receiving objects:   2% (14/671)
Receiving objects:   3% (21/671)
Receiving objects:   4% (27/671)
Receiving objects:   5% (34/671)
Receiving objects:   6% (41/671)
Receiving objects:   7% (47/671)
Receiving objects:   8% (54/671)
Receiving objects:   9% (61/671)
Receiving objects:  10% (68/671)
Receiving objects:  11% (74/671)
Receiving objects:  12% (81/671)
Receiving objects:  13% (88/671)
Receiving objects:  14% (94/671)
Receiving objects:  15% (101/671)
Receiving objects:  16% (108/671)
Receiving objects:  17% (115/671)
Receiving objects:  18% (121/671)
Receiving objects:  19% (128/671)
Receiving objects:  20% (135/671)
Receiving objects:  21% (141/671)
Receiving objects:  22% (148/671)
Receiving objects:  23% (155/671)
Receiving objects:  24% (162/671)
Receiving objects:  25% (168/671)
Receiving objects:  26% (175/671)
Receiving objects:  27% (182/671)
Receiving objects:  28% (188/671)
Receiving objects:  29% (195/671)
Receiving objects:  30% (202/671)
Receiving objects:  31% (209/671)
Receiving objects:  32% (215/671)
Receiving objects:  33% (222/671)
Receiving objects:  34% (229/671)
Receiving objects:  35% (235/671)
Receiving objects:  36% (242/671)
Receiving objects:  37% (249/671)
Receiving objects:  38% (255/671)
Receiving objects:  39% (262/671)
Receiving objects:  40% (269/671)
Receiving objects:  41% (276/671)
Receiving objects:  42% (282/671)
Receiving objects:  43% (289/671)
Receiving objects:  44% (296/671)
Receiving objects:  45% (302/671)
Receiving objects:  46% (309/671)
Receiving objects:  47% (316/671)
Receiving objects:  48% (323/671)
Receiving objects:  49% (329/671)
Receiving objects:  50% (336/671)
Receiving objects:  51% (343/671)
Receiving objects:  52% (349/671)
Receiving objects:  53% (356/671)
Receiving objects:  54% (363/671)
Receiving objects:  55% (370/671)
Receiving objects:  56% (376/671)
Receiving objects:  57% (383/671)
Receiving objects:  58% (390/671)
Receiving objects:  59% (396/671)
Receiving objects:  60% (403/671)
Receiving objects:  61% (410/671)
Receiving objects:  62% (417/671)
Receiving objects:  63% (423/671)
Receiving objects:  64% (430/671)
Receiving objects:  65% (437/671)
Receiving objects:  66% (443/671)
Receiving objects:  67% (450/671)
Receiving objects:  68% (457/671)
Receiving objects:  69% (463/671)
Receiving objects:  70% (470/671)
Receiving objects:  71% (477/671)
Receiving objects:  72% (484/671)
Receiving objects:  73% (490/671)
Receiving objects:  74% (497/671)
Receiving objects:  75% (504/671)
Receiving objects:  76% (510/671)
Receiving objects:  77% (517/671)
Receiving objects:  78% (524/671)
Receiving objects:  79% (531/671)
Receiving objects:  80% (537/671)
Receiving objects:  81% (544/671)
Receiving objects:  82% (551/671)
Receiving objects:  83% (557/671)
Receiving objects:  84% (564/671)
Receiving objects:  85% (571/671)
Receiving objects:  86% (578/671)
Receiving objects:  87% (584/671)
Receiving objects:  88% (591/671)
Receiving objects:  89% (598/671)
Receiving objects:  90% (604/671)
Receiving objects:  91% (611/671)
Receiving objects:  92% (618/671)
Receiving objects:  93% (625/671)
Receiving objects:  94% (631/671)
Receiving objects:  95% (638/671)
Receiving objects:  96% (645/671)
Receiving objects:  97% (651/671)
remote: Total 671 (delta 0), reused 671 (delta 0)        Receiving objects:  98% (658/671)
Receiving objects:  99% (665/671)
Receiving objects: 100% (671/671)
Receiving objects: 100% (671/671), 2.98 MiB | 13.26 MiB/s, done.From https://diffinery.com/codician/diffinery * [new ref]         7230a07327da967e1050ddd9db1bd5aeb8bc9f65 -> origin/diffinery-checkoutNote: switching to '7230a07327da967e1050ddd9db1bd5aeb8bc9f65'.You are in 'detached HEAD' state. You can look around, make experimentalchanges and commit them, and you can discard any commits you make in thisstate without impacting any branches by switching back to a branch.If you want to create a new branch to retain commits you create, you maydo so (now or later) by using -c with the switch command. Example:  git switch -c <new-branch-name>Or undo this operation with:  git switch -Turn off this advice by setting config variable advice.detachedHead to falseHEAD is now at 7230a07 Merge d04b473ee018ae871068cbf24a3908ddc65a7476 into 7ceb5139d7846eabcc61cd294b6adeecfd234b2fHEAD is now at 7230a07327da967e1050ddd9db1bd5aeb8bc9f65

Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b15s

Download action repository 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1'##[group]Run pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1with:  dest: ~/setup-pnpm  run_install: null  cache: false  cache_dependency_path: pnpm-lock.yaml  package_json_file: package.json  standalone: false##[endgroup]##[group]Running self-installer...Progress: resolved 1, reused 0, downloaded 0, added 0Packages: +1+Progress: resolved 1, reused 0, downloaded 1, added 0Progress: resolved 1, reused 0, downloaded 1, added 1, donedependencies:+ pnpm 10.28.0 (12.14.0 is available)Done in 2.6s##[endgroup]Installation Completed!

Run actions/setup-node@v41s

##[group]Run actions/setup-node@v4with:  node-version: 22  cache: pnpm##[endgroup]Found in cache @ 22.22.0 (pre-installed node satisfies '22')pnpm cache is not found

Run pnpm install --frozen-lockfile22s

##[group]Run pnpm install --frozen-lockfile##[endgroup]Scope: all 8 workspace projectsLockfile is up to date, resolution step is skippedProgress: resolved 1, reused 0, downloaded 0, added 0Packages: +250++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++Progress: resolved 250, reused 0, downloaded 15, added 3Progress: resolved 250, reused 0, downloaded 51, added 16Progress: resolved 250, reused 0, downloaded 142, added 59Progress: resolved 250, reused 0, downloaded 156, added 64Progress: resolved 250, reused 0, downloaded 165, added 67Progress: resolved 250, reused 0, downloaded 189, added 76Progress: resolved 250, reused 0, downloaded 219, added 87Progress: resolved 250, reused 0, downloaded 235, added 92Progress: resolved 250, reused 0, downloaded 241, added 95Progress: resolved 250, reused 0, downloaded 244, added 249Progress: resolved 250, reused 0, downloaded 244, added 250, done.../esbuild@0.25.11/node_modules/esbuild postinstall$ node install.js.../esbuild@0.25.12/node_modules/esbuild postinstall$ node install.js.../esbuild@0.28.1/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../node_modules/workerd postinstall$ node install.js.../esbuild@0.25.11/node_modules/esbuild postinstall: Done.../esbuild@0.25.12/node_modules/esbuild postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall$ node install.js.../node_modules/workerd postinstall: Done.../esbuild@0.28.1/node_modules/esbuild postinstall: Done.../node_modules/workerd postinstall: Done.../esbuild@0.28.2/node_modules/esbuild postinstall: DonedevDependencies:+ turbo 2.11.7+ typescript 5.9.3Done in 21.3s using pnpm v10.28.0

Run pnpm -r --if-present build3s

##[group]Run pnpm -r --if-present build##[endgroup]Scope: 7 of 8 workspace projectsapps/cli build$ esbuild src/bin.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/diffinery.mjs "--banner:js=#!/usr/bin/env nodeimport { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/diffinery build$ node islands/build.mjs && node scripts/build-docs.mjscontainers/runner build$ esbuild src/main.ts --bundle --platform=node --target=node22 --format=esm --outfile=dist/agent.mjs --external:bufferutil --external:utf-8-validate "--banner:js=import { createRequire as __diffineryCreateRequire } from 'node:module'; const require = __diffineryCreateRequire(import.meta.url);"apps/cli build:   dist/diffinery.mjs  446.1kbapps/cli build: ⚡ Done in 105msapps/cli build: Donecontainers/runner build:   dist/agent.mjs  674.1kbcontainers/runner build: ⚡ Done in 147mscontainers/runner build: Doneapps/diffinery build: islands: kumo.js 466 KB, kumo.css 149 KB, terminal.js 286 KBapps/diffinery build: docs: 71 pages (+2 generated at runtime), 6 images, CLI 0.1.0 (235 KiB), editor extension 0.1.0 (20 KiB)apps/diffinery build: Done

Run pnpm --filter @diffinery/app exec playwright install --with-deps chromium

Run as_root() { if [ "$(id -u)" = 0 ]; then "$@"; else sudo "$@"; fi; }

Run the shard's tests248h 49m

##[group]Run # Shards of similar length; a new test file runs in "rest" unless it's added to another.core='/e2e\.test\.mjs$'agents='/(agentic|review|tasks)\.test\.mjs$'security='/(security|status)\.test\.mjs$'# The core file's real histories and large pushes take minutes each (jquery's alone 2 to 3 on# Diffinery's runners): two shards of their own, so no part of the file runs into node's# per-file timeout, which is the --test-timeout here.histories='^real histories:'large='^(large files|large pushes):'opts=(--test-timeout=600000)case "security" in  core) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-skip-pattern="$histories" --test-skip-pattern="$large") ;;  histories) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts=(--test-timeout=900000 --test-name-pattern="$histories") ;;  large) files=$(ls test/e2e/*.test.mjs | grep -E "$core"); opts+=(--test-name-pattern="$large") ;;  agents) files=$(ls test/e2e/*.test.mjs | grep -E "$agents") ;;  security) files=$(ls test/e2e/*.test.mjs | grep -E "$security") ;;  *) files=$(ls test/e2e/*.test.mjs | grep -vE "$core|$agents|$security") ;;esacecho "$files"node --test --test-concurrency=1 "${opts[@]}" $files##[endgroup]test/e2e/security.test.mjstest/e2e/status.test.mjsTAP version 13# Subtest: security: search, required checks, environments, reviews, locks, archives, drafts and tree namesok 1 - security: search, required checks, environments, reviews, locks, archives, drafts and tree names  ---  duration_ms: 61092.380944  type: 'test'  ...# Subtest: security: organization admins can't hand out ownershipok 2 - security: organization admins can't hand out ownership  ---  duration_ms: 264.991666  type: 'test'  ...# Subtest: security: anonymous writes, token scopes, agent secrets, merge rules and draftsok 3 - security: anonymous writes, token scopes, agent secrets, merge rules and drafts  ---  duration_ms: 3323.144748  type: 'test'  ...# Subtest: security: push protection covers commits made without gitok 4 - security: push protection covers commits made without git  ---  duration_ms: 784.919877  type: 'test'  ...

codician/diffinerypublic

End-to-end (security)