ci: limit CI matrices to Ubuntu linux/amd64 (#82)

[geeen-jp]

Summary

• Restrict agent-server and test CI to Ubuntu linux/amd64. Windows, macOS, and linux/arm64 matrix legs are removed from server.yml, tests.yml, and release-binaries.yml.
• Ubuntu binary startup smoke, external-tool import smoke, and the OpenAPI schema check stay. Docker variants python / java / golang stay on amd64, and release docker smoke still pulls and checks /health for linux/amd64.
• No Python, agent-server, or TypeScript behavior change. validate and make validate are unchanged. Nothing was manualized.

Workflows

Workflow	Triggers kept	Kept	Removed
.github/workflows/server.yml (Agent Server)	push to main and any tag; pull_request to main; workflow_dispatch	build-binary-and-test (matrix ubuntu-latest only), check-openapi-schema, build-and-push-image (python/java/golang × amd64), merge-manifests (amd64 source only), consolidate-build-info, update-pr-description	matrix legs macos-latest, windows-latest; image legs <variant>-arm64; Windows pyinstaller / cygpath steps. workflow_dispatch platforms default is linux/amd64.
.github/workflows/tests.yml (Run tests)	push to main; pull_request to **	test-directory-guard, sdk-tests, tools-tests, agent-server-tests, agent-server-stress-tests, workspace-tests, cross-tests, coverage-report (needs unchanged)	windows-tests and its coverage-windows artifact
.github/workflows/release-binaries.yml	push to main; release published; workflow_dispatch	resolve-tag, build-binary (ubuntu-24.04 linux x86_64 only), build-openapi, publish-binaries, docker-smoke-test (3 variants, amd64 pull + /health)	binary legs linux-arm64, macos-x86_64, macos-arm64, windows-x86_64; docker legs <variant>-arm64; manifest step no longer requires linux/arm64
.github/workflows/validate.yml	unchanged	job/check name validate	none
typescript-client-*.yml	unchanged	Ubuntu TypeScript checks	none

No workflow was converted to a manual-only job.

Required checks 移行

Removed or no-longer-generated checks (job ids kept for the Ubuntu legs, so surviving names do not change):

• windows-tests (tests.yml)
• build-binary-and-test (macos-latest), build-binary-and-test (windows-latest) (server.yml)
• Build & Push (<variant>-arm64) for python/java/golang (server.yml)
• Build (linux-arm64), Build (macos-x86_64), Build (macos-arm64), Build (windows-x86_64) (release-binaries.yml)
• Docker (<variant>-arm64) (release-binaries.yml)

Main branch protection is unconfirmed: GET branches/main/protection returns 403 and the rulesets API returns []. Settings were not changed. The operator must check the GitHub UI and drop any of the checks above if they are required, before merge. Same note is in .github/workflows/README-RELEASE.md under "CI scope and required checks".

Static checks

Head df9091f44cfd73aee719bc21ac10bdf05c68897b. actionlint v1.7.12 on server.yml, tests.yml, release-binaries.yml: 0 findings on this head and 0 on the same files at origin/main (no new findings). yaml.safe_load of every .github/workflows/*.yml: PASS (0 failures). Needs-graph: every needs: target exists in the same workflow; no job depends on windows-tests or another removed job; local uses: / workflow_run workflow files still exist. PASS.

GitHub Actions did not run (Actions are restricted on this repo).

make validate

make validate once: rc 0, duration 1034s. git status --porcelain empty afterward. No http.server listener left from the run. Port 8081 was not listening.

Closes #82

[github-actions]

📁 PR Artifacts Notice

This PR contains a .pr/ directory with temporary PR-specific documents. The directory will be automatically removed when the PR is approved.

[github-actions]

Endpoint audit

⚠️ 18 actionable Agent Server contract divergence(s) · report-only

Contract: pinned release artifact

Category	Count
Actionable client-only calls	0
Actionable server-only operations	18
Documented non-divergences	13
Agent Server contract operations	129
Audited handwritten client endpoints	119

Actionable client-only calls (0)

none

Actionable server-only operations (18)

• DELETE /api/canvas-extensions/installed/{}
• DELETE /api/llm/provider-connections/{}
• GET /api/canvas-extensions/installed
• GET /api/canvas-extensions/installed/{}
• GET /api/canvas-extensions/installed/{}/bundle
• GET /api/conversations/{}/events
• GET /api/file/archive
• GET /api/git/commits
• GET /api/git/commits/{}/changes
• GET /api/init
• GET /api/llm/provider-connections
• PATCH /api/canvas-extensions/installed/{}
• PATCH /api/llm/provider-connections/{}
• POST /api/canvas-extensions/install
• POST /api/conversations/{}/load_plugin
• POST /api/file/create_directory
• POST /api/init
• POST /api/llm/provider-connections

Documented non-divergences (13)

Client calls intentionally absent from the filtered contract (11)

• GET /
• GET /alive
• GET /health
• GET /ready
• GET /server_info

Reason: Operational Agent Server endpoints intentionally excluded from the filtered public release artifact.
Owner: OpenHands runtime maintainers

• DELETE /api/meta-profiles/{}
• GET /api/meta-profiles
• GET /api/meta-profiles/{}
• POST /api/meta-profiles/{}
• POST /api/meta-profiles/{}/activate

Reason: Client-ahead API stacked on the pending Agent Server meta-profiles implementation.
Owner: OpenHands SDK maintainers
Tracking: OpenHands#3744

• POST /api/profiles/{}/validate

Reason: Client-ahead API stacked on the pending Agent Server pre-flight LLM validation endpoint.
Owner: OpenHands TypeScript client maintainers
Tracking: OpenHands#4422

Server operations covered by an exposed browser URL (2)

• GET /api/conversations/{}/workspace
• GET /api/conversations/{}/workspace/{}

Reason: RemoteWorkspace.startWorkspaceSession exposes these authenticated URLs for browser iframe and file requests; they are not HttpClient method calls.
Owner: OpenHands TypeScript client maintainers

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	44225	8027	82%

report-only-changed-files is enabled. No files were changed during this commit :)