dify/.github/workflows/sandbox-runtime-tests.yml

name: Sandbox Runtime Tests

on:
  workflow_call:
    inputs:
      native_scope:
        type: boolean
        default: false
  workflow_dispatch:
    inputs:
      native_scope:
        description: Qualify isolated native scopes on the ephemeral Linux runner
        type: boolean
        default: true

permissions:
  contents: read

concurrency:
  group: sandbox-runtime-tests-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  sandbox-runtime-unit:
    name: Sandbox Runtime Unit Tests
    runs-on: depot-ubuntu-24.04
    defaults:
      run:
        shell: bash
        working-directory: dify-agent-runtime

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: dify-agent-runtime/go.mod
          cache-dependency-path: dify-agent-runtime/go.sum

      - name: Install real job runtime dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --yes tmux
          make bin/shellctl-runner bin/shellctl-runner-exit bin/shellctl-sanitize-pty
          echo "$GITHUB_WORKSPACE/dify-agent-runtime/bin" >> "$GITHUB_PATH"

      - name: Run unit tests
        run: go test -race -count=1 ./...

  sandbox-runtime-lint:
    name: Sandbox Runtime Lint
    runs-on: depot-ubuntu-24.04
    defaults:
      run:
        shell: bash
        working-directory: dify-agent-runtime

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: dify-agent-runtime/go.mod
          cache-dependency-path: dify-agent-runtime/go.sum

      - name: Run golangci-lint
        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
        with:
          working-directory: dify-agent-runtime
          version: latest

  sandbox-runtime-integration:
    name: Sandbox Runtime Integration Tests
    runs-on: depot-ubuntu-24.04
    defaults:
      run:
        shell: bash
        working-directory: dify-agent-runtime

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: dify-agent-runtime/go.mod
          cache-dependency-path: dify-agent-runtime/go.sum

      - name: Build and start runtime
        run: make integration-up

      - name: Run integration tests
        run: make integration-test

      - name: Build native supervisor fixture binaries
        if: inputs.native_scope
        run: |
          set -euo pipefail
          mkdir -p "$RUNNER_TEMP/native-runtime-bin"
          for entry in shellctl runner runner-exit sanitize-pty; do
            binary="shellctl-$entry"
            if [ "$entry" = shellctl ]; then binary=shellctl; fi
            CGO_ENABLED=0 go build -o "$RUNNER_TEMP/native-runtime-bin/$binary" "./cmd/$entry"
          done
          CGO_ENABLED=0 go test -c -tags 'integration native_scope' -o "$RUNNER_TEMP/native-runtime-bin/testscope-kernel.test" ./internal/testscope

      - name: Provision delegated native supervisor
        if: inputs.native_scope
        run: bash ../.github/scripts/builder-native-runtime-ci.sh provision "$RUNNER_TEMP/native-runtime-bin" "$PWD/docker"

      - name: Verify inherited mount isolation on the kernel
        if: inputs.native_scope
        run: |
          set -euo pipefail
          bash ../.github/scripts/builder-native-runtime-ci.sh mount-test "$RUNNER_TEMP/native-runtime-bin" 2>&1 | go tool test2json -t -p github.com/langgenius/dify/dify-agent-runtime/internal/testscope | tee "$RUNNER_TEMP/native-runtime-mount-tests.jsonl"

      - name: Run real native scope tests
        if: inputs.native_scope
        run: |
          set -euo pipefail
          . ./.integration-state
          export SHELLCTL_GO_URL="http://localhost:$HOST_PORT"
          export SHELLCTL_TEST_TOKEN="$AUTH_TOKEN"
          export SHELLCTL_GO_URL_NO_ISOLATION="http://localhost:$HOST_PORT_NOISO"
          export SHELLCTL_TEST_TOKEN_NO_ISOLATION="$AUTH_TOKEN_NOISO"
          go test -race -tags=integration,native_scope ./tests -run '^TestNativeScope(Real|Broker|Output)' -count=1 -timeout=300s -json | tee "$RUNNER_TEMP/native-runtime-tests.jsonl"
          go test -race -tags=integration,native_scope ./tests -run '^TestNativeScopeRestartPrepare$' -count=1 -timeout=120s -json | tee "$RUNNER_TEMP/native-runtime-restart-prepare.jsonl"

      - name: Restart manager while retaining native worker
        if: inputs.native_scope
        run: bash ../.github/scripts/builder-native-runtime-ci.sh restart

      - name: Resume same job after manager restart
        if: inputs.native_scope
        run: |
          set -euo pipefail
          . ./.integration-state
          export SHELLCTL_GO_URL="http://localhost:$HOST_PORT"
          export SHELLCTL_TEST_TOKEN="$AUTH_TOKEN"
          export SHELLCTL_GO_URL_NO_ISOLATION="http://localhost:$HOST_PORT_NOISO"
          export SHELLCTL_TEST_TOKEN_NO_ISOLATION="$AUTH_TOKEN_NOISO"
          go test -race -tags=integration,native_scope ./tests -run '^TestNativeScopeRestartResume$' -count=1 -timeout=120s -json | tee "$RUNNER_TEMP/native-runtime-restart-resume.jsonl"

      - name: Verify complete native case inventory
        if: inputs.native_scope
        run: python3 ../.github/scripts/verify-native-runtime-results.py "$RUNNER_TEMP"

      - name: Dump native supervisor evidence
        if: always() && inputs.native_scope
        run: bash ../.github/scripts/builder-native-runtime-ci.sh logs > "$RUNNER_TEMP/native-runtime-fixture.log" 2>&1

      - name: Upload native runtime evidence
        if: always() && inputs.native_scope
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: native-runtime-evidence
          path: |
            ${{ runner.temp }}/native-runtime-mount-tests.jsonl
            ${{ runner.temp }}/native-runtime-tests.jsonl
            ${{ runner.temp }}/native-runtime-restart-prepare.jsonl
            ${{ runner.temp }}/native-runtime-restart-resume.jsonl
            ${{ runner.temp }}/native-runtime-fixture.log
          if-no-files-found: error

      - name: Stop native supervisor fixture
        if: always() && inputs.native_scope
        run: bash ../.github/scripts/builder-native-runtime-ci.sh cleanup

      - name: Dump container logs on failure
        if: failure()
        run: make integration-logs || true

      - name: Stop runtime container
        if: always()
        run: make integration-down