From 07a7f1d903ea04237a5b5f17e2d0d9e82ab69182 Mon Sep 17 00:00:00 2001 From: Rickylabs Date: Wed, 10 Jun 2026 15:33:08 +0200 Subject: [PATCH] ci: align agent toolchain versions --- .github/toolchain.env | 9 ++++ .github/workflows/copilot-setup-steps.yml | 54 +++++++++++++--------- .github/workflows/openhands-agent.yml | 7 ++- .openhands/setup.sh | 56 +++++++++++++++++++---- 4 files changed, 96 insertions(+), 30 deletions(-) create mode 100644 .github/toolchain.env diff --git a/.github/toolchain.env b/.github/toolchain.env new file mode 100644 index 000000000..a125e9880 --- /dev/null +++ b/.github/toolchain.env @@ -0,0 +1,9 @@ +# Shared CI/agent toolchain pins for NetScript. +# +# Keep these aligned with package scaffold constants and templates. OpenHands +# PR-comment runs hydrate this file from the workflow ref, so fixes here affect +# old PR branches as soon as the workflow is merged to main. +NETSCRIPT_DENO_VERSION=v2.7.11 +NETSCRIPT_DOTNET_VERSION=10.0.x +NETSCRIPT_DOTNET_CHANNEL=10.0 +NETSCRIPT_ASPIRE_CLI_VERSION=13.2.2 diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index 7df60e541..6eb1dfa49 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -9,21 +9,22 @@ # audit-fix passes (deno publish --dry-run, deno doc --lint, deno task check, # deno task e2e:cli) without a local agent. # -# Toolchain pinned to this repo's reality: -# - Deno 2.x (deno.json uses unstable: kv, temporal, tsgo, worker-options, raw-imports) -# - .NET SDK 10.x (CLI scaffold AppHost/ServiceDefaults target net10.0) -# - Aspire CLI via the official install script, pinned to a release + script hash -# (NOT `dotnet workload install aspire`, which was removed after Aspire 8) -# - Docker (pre-installed on ubuntu-latest; AppHost resources need the engine) +# Toolchain pinned to this repo's reality in .github/toolchain.env: +# - Deno 2.7.x +# - .NET SDK 10.x (CLI scaffold AppHost/ServiceDefaults target net10.0) +# - Aspire CLI 13.2.x (matches scaffold Aspire SDK/package constants) +# - Docker latest stable (AppHost resources need the engine) name: 'Copilot Setup Steps' on: workflow_dispatch: push: paths: + - .github/toolchain.env - .github/workflows/copilot-setup-steps.yml pull_request: paths: + - .github/toolchain.env - .github/workflows/copilot-setup-steps.yml jobs: @@ -35,47 +36,58 @@ jobs: - name: Checkout code uses: actions/checkout@v6 + - name: Load NetScript toolchain + id: toolchain + shell: bash + run: | + set -euo pipefail + source .github/toolchain.env + echo "deno-version=${NETSCRIPT_DENO_VERSION}" >> "$GITHUB_OUTPUT" + echo "dotnet-version=${NETSCRIPT_DOTNET_VERSION}" >> "$GITHUB_OUTPUT" + echo "aspire-version=${NETSCRIPT_ASPIRE_CLI_VERSION}" >> "$GITHUB_OUTPUT" + grep -F "ASPIRE_SDK: '${NETSCRIPT_ASPIRE_CLI_VERSION}'" \ + packages/cli/src/kernel/constants/scaffold/scaffold-versions.ts + # --- Deno (primary toolchain) --- - name: Setup Deno uses: denoland/setup-deno@v2 with: - deno-version: v2.x + deno-version: ${{ steps.toolchain.outputs.deno-version }} cache-hash: ${{ hashFiles('**/deno.json') }} # --- .NET SDK 10 (Aspire AppHost / ServiceDefaults target net10.0) --- - name: Setup .NET SDK uses: actions/setup-dotnet@v5 with: - dotnet-version: '10.0.x' + dotnet-version: ${{ steps.toolchain.outputs.dotnet-version }} # --- Aspire CLI (standalone install script; adds $HOME/.aspire/bin to PATH) --- - name: Install Aspire CLI run: | set -euo pipefail - aspire_version="13.4.2" - # Commit d7d0b6759ce4b936c76bc4775814d27db560dd6d is the target - # of the v13.4.2 release tag in dotnet/aspire. - # To verify/update: inspect https://github.com/dotnet/aspire/releases/tag/v13.4.2. - installer_url="https://raw.githubusercontent.com/dotnet/aspire/d7d0b6759ce4b936c76bc4775814d27db560dd6d/eng/scripts/get-aspire-cli.sh" - installer_sha256="df1247d87f6e5ca83e71abf55f78bca1bd9a421a3f2f0fd5481f153fc958632a" + aspire_version="${{ steps.toolchain.outputs.aspire-version }}" + installer_url="https://aspire.dev/install.sh" installer="$(mktemp)" trap 'rm -f "$installer"' EXIT curl --fail --show-error --silent --location --proto '=https' --tlsv1.2 \ --output "$installer" "$installer_url" - # sha256sum --check expects the hash, two space characters, then the filename. - if ! echo "$installer_sha256 $installer" | sha256sum --check; then - echo "::error::Aspire installer hash verification failed for $installer_url" - exit 1 - fi bash "$installer" --version "$aspire_version" --install-path "$HOME/.aspire/bin" --skip-path echo "$HOME/.aspire/bin" >> "$GITHUB_PATH" - name: Verify Aspire CLI run: | + set -euo pipefail export PATH="$HOME/.aspire/bin:$PATH" - aspire --version + actual="$(aspire --version)" + echo "$actual" + test "$actual" = "${{ steps.toolchain.outputs.aspire-version }}" + + # --- Docker (AppHost container resources) --- + - name: Setup Docker + uses: docker/setup-docker-action@v5 + with: + version: latest - # --- Docker (AppHost container resources; engine is pre-installed) --- - name: Verify Docker run: | docker --version diff --git a/.github/workflows/openhands-agent.yml b/.github/workflows/openhands-agent.yml index 1cdf38350..edded839e 100644 --- a/.github/workflows/openhands-agent.yml +++ b/.github/workflows/openhands-agent.yml @@ -264,7 +264,7 @@ jobs: WORKFLOW_REF: ${{ github.sha }} run: | mkdir -p /tmp/openhands-runtime - for path in .openhands/setup.sh .openhands/agent_runner.py; do + for path in .openhands/setup.sh .openhands/agent_runner.py .github/toolchain.env; do target="/tmp/openhands-runtime/$(basename "$path")" gh api "repos/${GITHUB_REPOSITORY}/contents/${path}?ref=${WORKFLOW_REF}" \ --jq .content | base64 -d > "$target" @@ -318,6 +318,11 @@ jobs: > .llm/tmp/openhands/pr-review-comments.json || true fi + - name: Setup Docker + uses: docker/setup-docker-action@v5 + with: + version: latest + - name: Bootstrap NetScript toolchain run: bash /tmp/openhands-runtime/setup.sh diff --git a/.openhands/setup.sh b/.openhands/setup.sh index 3631982cf..2446c5c4d 100644 --- a/.openhands/setup.sh +++ b/.openhands/setup.sh @@ -3,6 +3,28 @@ set -euo pipefail echo "Bootstrapping NetScript for OpenHands" +script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +toolchain_file="${NETSCRIPT_TOOLCHAIN_FILE:-}" +if [ -z "$toolchain_file" ]; then + if [ -f "$script_dir/toolchain.env" ]; then + toolchain_file="$script_dir/toolchain.env" + elif [ -f ".github/toolchain.env" ]; then + toolchain_file=".github/toolchain.env" + fi +fi + +if [ -z "$toolchain_file" ] || [ ! -f "$toolchain_file" ]; then + echo "Missing NetScript toolchain file." + exit 1 +fi + +# shellcheck source=/dev/null +source "$toolchain_file" + +: "${NETSCRIPT_DENO_VERSION:?}" +: "${NETSCRIPT_DOTNET_CHANNEL:?}" +: "${NETSCRIPT_ASPIRE_CLI_VERSION:?}" + export DENO_INSTALL="${DENO_INSTALL:-$HOME/.deno}" export PATH="$DENO_INSTALL/bin:$HOME/.aspire/bin:$HOME/.dotnet:$PATH" @@ -10,24 +32,42 @@ if ! command -v deno >/dev/null 2>&1; then curl -fsSL https://deno.land/install.sh | sh -s -- -y fi -if ! command -v dotnet >/dev/null 2>&1; then - curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh - bash /tmp/dotnet-install.sh --channel 10.0 --install-dir "$HOME/.dotnet" +target_deno="${NETSCRIPT_DENO_VERSION#v}" +actual_deno="$(deno --version | awk 'NR==1 {print $2}')" +if [ "$actual_deno" != "$target_deno" ]; then + deno upgrade --version "$target_deno" fi -if ! command -v aspire >/dev/null 2>&1; then - curl -fsSL https://aspire.dev/install.sh | bash +target_dotnet_major="${NETSCRIPT_DOTNET_CHANNEL%%.*}" +if ! command -v dotnet >/dev/null 2>&1 || + ! dotnet --list-sdks 2>/dev/null | grep -Eq "^${target_dotnet_major}\."; then + curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh + bash /tmp/dotnet-install.sh --channel "$NETSCRIPT_DOTNET_CHANNEL" --install-dir "$HOME/.dotnet" fi +aspire_installer="$(mktemp)" +trap 'rm -f "$aspire_installer"' EXIT +curl -fsSL https://aspire.dev/install.sh -o "$aspire_installer" +bash "$aspire_installer" \ + --version "$NETSCRIPT_ASPIRE_CLI_VERSION" \ + --install-path "$HOME/.aspire/bin" \ + --skip-path + echo "$DENO_INSTALL/bin" >> "$GITHUB_PATH" 2>/dev/null || true echo "$HOME/.aspire/bin" >> "$GITHUB_PATH" 2>/dev/null || true echo "$HOME/.dotnet" >> "$GITHUB_PATH" 2>/dev/null || true deno --version dotnet --version -aspire --version || true -docker --version || true -docker compose version || true +dotnet --list-sdks | grep -E "^${target_dotnet_major}\." +actual_aspire="$(aspire --version)" +echo "$actual_aspire" +if [ "$actual_aspire" != "$NETSCRIPT_ASPIRE_CLI_VERSION" ]; then + echo "Aspire CLI version mismatch: expected $NETSCRIPT_ASPIRE_CLI_VERSION, got $actual_aspire" + exit 1 +fi +docker --version +docker compose version deno install || echo "deno install non-fatal during OpenHands setup" dotnet nuget locals all --list || true