RomanNum3ral
/
paperclip
mirror of https://github.com/paperclipai/paperclip.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
paperclip/.github/workflows
History
Dotta d3c04d8932
fix(runner-e2e): prepare frozen Daytona plugin dependencies (#12791) 
## Thinking Path

> - Paperclip manages AI agents and their provider runtimes.
> - The paid runner workflow installs target dependencies with lifecycle
scripts disabled.
> - The bundled Daytona plugin depends on an audited repo-local plugin
SDK link.
> - The lifecycle-safe install path did not create that link.
> - This pull request restores only the trusted Daytona preparation step
before provider secrets are exposed.
> - The benefit is a working Daytona canary without enabling dependency
lifecycle scripts.

## Linked Issues or Issue Description

**What happened?**

The Daytona paid canary stopped before lease or provider startup. The
trusted paid job disabled root lifecycle scripts, so the repo-local
plugin SDK link was absent. The plugin install returned a missing
runtime dependency error for @paperclipai/plugin-sdk.

**Expected behavior**

The trusted workflow must prepare the bundled Daytona plugin without
running untrusted dependency lifecycle scripts. The paid cell must start
only after its runtime dependencies and entrypoints pass validation.

**Steps to reproduce**

1. Dispatch the runner full-stack paid workflow for
core-compatibility.runner-acpx-claude.daytona.message-marker.
2. Let the trusted job install root dependencies with lifecycle scripts
disabled.
3. Observe the Daytona plugin installation fail before a lease or
provider process starts.

**Paperclip version or commit**

Feature head 781ac7e08c. The failed canary
is Actions run 33803959325.

**Deployment mode**

GitHub Actions paid runner validation.

**Agent adapter(s) involved**

ACPX Claude through the bundled Daytona plugin.

**Additional context**

This is a small trusted-workflow prerequisite for public PR #12769. Old
green run 33118525827 created the SDK link through root postinstall.
This change keeps lifecycle scripts disabled and restores only the
audited prerequisite.

## What Changed

- Install standalone Daytona dependencies with lifecycle scripts
disabled.
- Run the audited repo-local plugin SDK linker before provider secrets
are exposed.
- Build the bundled Daytona plugin and verify its runtime dependency
plus both entrypoints.
- Add a security regression for ordering, scope, and secret isolation.

## Verification

- Five focused workflow-security tests passed.
- Seven focused linker tests passed.
- The exact Daytona preparation command completed locally in nine
seconds.
- Prettier and diff whitespace checks passed.

## Risks

Risk is low and limited to Daytona paid cells. The setup still disables
dependency lifecycle scripts. The trusted step runs before provider
credentials enter the job. Any missing or mismatched path fails closed
before provider startup.

## Model Used

OpenAI GPT-5 Codex with repository tools and code execution.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used with version and capability
details
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have described the issue in this PR with the bug template labels
- [x] I have not referenced internal or instance-local Paperclip issues
or links
- [x] My branch name describes the change
- [x] Focused local tests pass
- [x] I added tests for the change
- [x] I updated the relevant trusted-workflow security regression
- [x] I documented the risks above
 		2026-09-03 16:31:22 -05:00
..
agent-runtime-images.yml
…
commitperclip-review.yml
…
docker.yml chore(lockfile): refresh pnpm-lock.yaml (#12771) 2026-09-03 11:08:34 -05:00
e2e.yml test(runner): add full-stack acceptance and eval gates (#12700) 2026-09-02 08:55:08 -05:00
pr-trusted.yml chore(lockfile): refresh pnpm-lock.yaml (#12771) 2026-09-03 11:08:34 -05:00
pr.yml chore(deps): bump paperclipai/paperclip/.github/workflows/pr-trusted.yml from 39b8ee2960 to f038633bf5 (#12562) 2026-09-03 10:23:42 -07:00
refresh-lockfile.yml chore(lockfile): refresh pnpm-lock.yaml (#12771) 2026-09-03 11:08:34 -05:00
release-smoke.yml Follow the current onboarding arc in the release smoke (#12423) 2026-08-28 07:21:08 -07:00
release-verify.yml test(runner): add full-stack acceptance and eval gates (#12700) 2026-09-02 08:55:08 -05:00
release.yml fix(onboarding): restore browser launch and gate canaries (#12667) 2026-09-01 10:10:30 -05:00
runner-chaos-evals.yml test(runner): add full-stack acceptance and eval gates (#12700) 2026-09-02 08:55:08 -05:00
runner-full-stack-e2e.yml fix(runner-e2e): prepare frozen Daytona plugin dependencies (#12791) 2026-09-03 16:31:22 -05:00
runner-live-evals.yml test(runner): add full-stack acceptance and eval gates (#12700) 2026-09-02 08:55:08 -05:00
storybook-visual.yml
…