Repository navigation
feat: publish remote result branches - #149
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds branch-publishing support: WorkspaceBranchPublication contract, provider API and Docker implementation with credential injection, HTTP publish endpoint, client/CLI publish wiring, tests, and production docs describing publish semantics and required config. ChangesRemote Branch Publication Feature
Sequence Diagram(s)sequenceDiagram
participant Caller as publish_workspace_branch
participant Impl as _publish_git_workspace_branch
participant Git as git CLI
participant Env as _git_publication_push_env
participant Redact as _redact_git_remote_url
Caller->>Impl: request(branch_name, commit_message, config)
Impl->>Git: git status, check-ref-format, config user, add, commit
Impl->>Git: git rev-parse HEAD, git config --get remote.origin.url
Env->>Git: provide http.extraheader via extra_env during git push
Impl->>Git: git push origin HEAD:refs/heads/<branch>
Git-->>Impl: push result (success)
Impl->>Redact: redact credentials from remote URL
Impl-->>Caller: WorkspaceBranchPublication(pushed_ref, commit_sha, redacted_url)
sequenceDiagram
participant Client as HTTP Client
participant Server as /publish Endpoint
participant Config as Config Loader
participant Provider as WorkspaceProvider
participant Response as PublishSessionResponse
Client->>Server: POST mode=branch, branch_name
Server->>Config: load cloud workspace config
Server->>Config: load remote_publication config
alt config disabled
Server-->>Client: 400 publication not enabled
else mode is pr
Server-->>Client: 501 PR publication not implemented
else branch mode enabled
Server->>Provider: publish_workspace_branch_from_config
Provider-->>Server: WorkspaceBranchPublication
Server->>Response: populate branch_name, pushed_ref, commit_sha, remote_url
Server-->>Client: 200 response
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
coding-agent/docs/remote-sandbox-production.md (1)
153-159:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winAdd Git token env var to the
systemdproduction example.With
remote_publication.enabled = truein the sample config (Line 82) andgit_token_env = "CODING_AGENT_GIT_TOKEN"(Line 85), the service example should also showEnvironment=CODING_AGENT_GIT_TOKEN=...; otherwiseremote publish --branchmay fail in production setups that copy this config/snippet pair.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/docs/remote-sandbox-production.md` around lines 153 - 159, The systemd [Service] example is missing the Git token env var used by remote publication; update the unit to include Environment=CODING_AGENT_GIT_TOKEN=replace-with-secret alongside Environment=CODING_AGENT_BEARER_TOKEN=..., so when remote_publication.enabled is true and git_token_env = "CODING_AGENT_GIT_TOKEN" the process started by ExecStart (/usr/local/bin/coding-agent serve --config /etc/coding-agent/config.toml) has the expected CODING_AGENT_GIT_TOKEN available for remote publish operations.
🧹 Nitpick comments (1)
coding-agent/tests/ui/test_http_server.py (1)
3651-3653: 💤 Low valueConsider explicit mock call verification.
The test relies on assertions inside
fake_publishto validate parameters, but doesn't verify the function is actually called. While the current approach works, explicitly verifying the call count provides stronger guarantees against implementation changes.♻️ Example with unittest.mock
from unittest.mock import MagicMock # In test setup: mock_publish = MagicMock(side_effect=fake_publish) monkeypatch.setattr( "coding_agent.ui.http_server.publish_workspace_branch_from_config", mock_publish, ) # After the request: mock_publish.assert_called_once_with( {"provider": "docker"}, { "enabled": True, "git_author_name": "coding-agent", "git_author_email": "coding-agent@example.com", }, "ws-publish", "coding-agent/result", f"Apply coding-agent remote session {session_id} changes", )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/tests/ui/test_http_server.py` around lines 3651 - 3653, The test should explicitly verify the mock was called: replace the patched target for publish_workspace_branch_from_config with a MagicMock (or similar) that wraps fake_publish (e.g., MagicMock(side_effect=fake_publish)), keep monkeypatch.setattr on "coding_agent.ui.http_server.publish_workspace_branch_from_config", then after exercising the HTTP request call mock.assert_called_once_with(...) using the same expected args currently validated inside fake_publish (provider config, publish config dict, "ws-publish", "coding-agent/result", and the formatted commit message including session_id) to ensure the function was actually invoked exactly once.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@coding-agent/src/coding_agent/environment/docker_workspace_provider.py`:
- Around line 1215-1231: Validate the git remote URL before using it for pushes
or before calling _git_publication_push_env to inject auth: parse remote_url
(from _run_git_publish_command) and ensure its scheme and host are in an
allowlist of trusted values (e.g., https/git+https and specific hosts),
otherwise raise ValueError and refuse to inject Authorization headers or perform
the push; apply the same validation logic where remote_url is used later (the
other block around lines 1264-1280) so both code paths (functions/variables:
remote_url, _run_git_publish_command, _git_publication_push_env,
publication_config, provider_config, workspace_root, branch_name) enforce the
allowlist before constructing push_env or executing git push.
In `@coding-agent/tests/ui/test_http_server.py`:
- Around line 3614-3685: Add a new test named
test_publish_hides_other_user_session that follows the existing auth pattern:
set CODING_AGENT_SERVER_CONFIG via monkeypatch.setenv to the test auth config
(use _write_auth_config(tmp_path)), set settings.http_api_key to None, create a
session by POST /sessions with Authorization "Bearer admin-token" to get
session_id, then attempt to POST /sessions/{session_id}/publish with
Authorization "Bearer user-token-a" and json
{"mode":"branch","branch_name":"test"} and assert the response.status_code is
404; reference the existing test_publish_branch_returns_provider_result for
endpoint and payload structure and the helper names _write_auth_config,
settings.http_api_key, and the /sessions/{session_id}/publish route to locate
code.
---
Outside diff comments:
In `@coding-agent/docs/remote-sandbox-production.md`:
- Around line 153-159: The systemd [Service] example is missing the Git token
env var used by remote publication; update the unit to include
Environment=CODING_AGENT_GIT_TOKEN=replace-with-secret alongside
Environment=CODING_AGENT_BEARER_TOKEN=..., so when remote_publication.enabled is
true and git_token_env = "CODING_AGENT_GIT_TOKEN" the process started by
ExecStart (/usr/local/bin/coding-agent serve --config
/etc/coding-agent/config.toml) has the expected CODING_AGENT_GIT_TOKEN available
for remote publish operations.
---
Nitpick comments:
In `@coding-agent/tests/ui/test_http_server.py`:
- Around line 3651-3653: The test should explicitly verify the mock was called:
replace the patched target for publish_workspace_branch_from_config with a
MagicMock (or similar) that wraps fake_publish (e.g.,
MagicMock(side_effect=fake_publish)), keep monkeypatch.setattr on
"coding_agent.ui.http_server.publish_workspace_branch_from_config", then after
exercising the HTTP request call mock.assert_called_once_with(...) using the
same expected args currently validated inside fake_publish (provider config,
publish config dict, "ws-publish", "coding-agent/result", and the formatted
commit message including session_id) to ensure the function was actually invoked
exactly once.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 964418d8-91d4-4f72-bfb2-cee0b87e985d
📒 Files selected for processing (11)
coding-agent/docs/remote-sandbox-production.mdcoding-agent/src/coding_agent/__main__.pycoding-agent/src/coding_agent/environment/__init__.pycoding-agent/src/coding_agent/environment/docker_workspace_provider.pycoding-agent/src/coding_agent/environment/workspace_provider.pycoding-agent/src/coding_agent/remote/client.pycoding-agent/src/coding_agent/ui/http_server.pycoding-agent/src/coding_agent/ui/schemas.pycoding-agent/tests/cli/test_remote_client.pycoding-agent/tests/coding_agent/environment/test_docker_workspace_provider.pycoding-agent/tests/ui/test_http_server.py
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
coding-agent/tests/coding_agent/environment/test_docker_workspace_provider.py (1)
1219-1221: ⚡ Quick winAssert
http.extraheaderstructure to catch auth regressions.On Line 1221, the test only checks that the raw token is absent; it can still pass if
GIT_CONFIG_VALUE_0is empty or malformed. Add a shape assertion for the expected header prefix.Suggested test hardening
assert push_env["GIT_CONFIG_COUNT"] == "1" assert push_env["GIT_CONFIG_KEY_0"] == "http.extraheader" + assert push_env["GIT_CONFIG_VALUE_0"].startswith("AUTHORIZATION: basic ") + assert push_env["GIT_CONFIG_VALUE_0"] != "AUTHORIZATION: basic " assert "secret-token" not in push_env["GIT_CONFIG_VALUE_0"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/tests/coding_agent/environment/test_docker_workspace_provider.py` around lines 1219 - 1221, The test currently only ensures the raw token is absent in push_env["GIT_CONFIG_VALUE_0"] but doesn't verify the header shape; update the assertion for push_env keys (GIT_CONFIG_VALUE_0) in test_docker_workspace_provider.py to assert that GIT_CONFIG_VALUE_0 starts with the expected HTTP auth header prefix (e.g. "AUTHORIZATION: " or the exact prefix your code uses) and has non-empty content after the prefix, while still asserting the raw "secret-token" is not present; use the existing push_env["GIT_CONFIG_KEY_0"] and push_env["GIT_CONFIG_VALUE_0"] symbols to locate and change the assertions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@coding-agent/tests/coding_agent/environment/test_docker_workspace_provider.py`:
- Line 1330: The pytest.raises assertion uses an unescaped regex in the match
parameter; update the test that calls
pytest.raises(match="remote_publication.allowed_git_hosts must be configured")
to use a raw/escaped regex so dots are literal (e.g.
pytest.raises(match=r"remote_publication\.allowed_git_hosts must be configured")
or pytest.raises(match=re.escape("remote_publication.allowed_git_hosts must be
configured"))), locating the change in the test function that exercises
remote_publication.allowed_git_hosts in the DockerWorkspaceProvider tests.
---
Nitpick comments:
In
`@coding-agent/tests/coding_agent/environment/test_docker_workspace_provider.py`:
- Around line 1219-1221: The test currently only ensures the raw token is absent
in push_env["GIT_CONFIG_VALUE_0"] but doesn't verify the header shape; update
the assertion for push_env keys (GIT_CONFIG_VALUE_0) in
test_docker_workspace_provider.py to assert that GIT_CONFIG_VALUE_0 starts with
the expected HTTP auth header prefix (e.g. "AUTHORIZATION: " or the exact prefix
your code uses) and has non-empty content after the prefix, while still
asserting the raw "secret-token" is not present; use the existing
push_env["GIT_CONFIG_KEY_0"] and push_env["GIT_CONFIG_VALUE_0"] symbols to
locate and change the assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2f52a714-cad7-4538-bf54-43341b1d1e24
📒 Files selected for processing (5)
coding-agent/docs/adr/0024-remote-result-publication.mdcoding-agent/docs/remote-sandbox-production.mdcoding-agent/src/coding_agent/environment/docker_workspace_provider.pycoding-agent/tests/coding_agent/environment/test_docker_workspace_provider.pycoding-agent/tests/ui/test_http_server.py
✅ Files skipped from review due to trivial changes (1)
- coding-agent/docs/adr/0024-remote-result-publication.md
🚧 Files skipped from review as they are similar to previous changes (3)
- coding-agent/src/coding_agent/environment/docker_workspace_provider.py
- coding-agent/docs/remote-sandbox-production.md
- coding-agent/tests/ui/test_http_server.py
This was referenced May 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
Summary by CodeRabbit
New Features
Documentation
API
Tests