Skip to content

fix: pin consumer LLM workflow installs #2730

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stranske merged 2 commits into from
Jul 7, 2026
Merged

fix: pin consumer LLM workflow installs #2730

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
07adcac
fix: pin consumer LLM workflow installs
stranske Jul 7, 2026
a240c90
fix: cover issue optimizer llm installs
stranske Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .github/workflows/agents-auto-pilot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,8 +238,7 @@ jobs:
if: steps.check_enabled.outputs.enabled == 'true'
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
pip install -r tools/requirements-llm.txt
python -m pip install -r tools/requirements-llm.txt

- name: Initialize auto-pilot metrics logs
if: steps.check_enabled.outputs.enabled == 'true'
Expand Down
5 changes: 1 addition & 4 deletions .github/workflows/agents-issue-optimizer.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,10 +130,7 @@ jobs:
if: steps.check.outputs.should_run == 'true'
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
# Install langchain dependencies
pip install langchain langchain-core langchain-openai \
langchain-anthropic langchain-community
python -m pip install -r tools/requirements-llm.txt

- name: Check optimizer recursion guard
if: steps.check.outputs.should_run == 'true'
Expand Down
2 changes: 1 addition & 1 deletion agents/codex-1447.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
<!--
needs-human:
Label: needs-human
Workflow updates required in .github/workflows/agents-auto-pilot.yml and .github/workflows/reusable-agents-verifier.yml. Add pinned installs (`pip install -r tools/requirements-llm.txt` and `pip install -r .workflows-lib/tools/requirements-llm.txt` for evaluate/compare), add actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 pip cache keyed by Python version + requirements hash (`${{ hashFiles('tools/requirements-llm.txt') }}` and `${{ hashFiles('.workflows-lib/tools/requirements-llm.txt') }}`), and remove any floating `pip install langchain*` lines. Workflow edits require agent-high-privilege.
Workflow updates required in .github/workflows/agents-auto-pilot.yml, .github/workflows/agents-issue-optimizer.yml, and .github/workflows/reusable-agents-verifier.yml. Add pinned installs (`pip install -r tools/requirements-llm.txt` and `pip install -r .workflows-lib/tools/requirements-llm.txt` for evaluate/compare), add actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 pip cache keyed by Python version + requirements hash (`${{ hashFiles('tools/requirements-llm.txt') }}` and `${{ hashFiles('.workflows-lib/tools/requirements-llm.txt') }}`), and remove any floating `pip install langchain*` lines. Workflow edits require agent-high-privilege.
-->
6 changes: 3 additions & 3 deletions config/template-drift-allowlist.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,9 +93,9 @@ reason = Intentional divergence re-baselined 2026-06-30: root and consumer guard
[pair.11]
main = .github/workflows/agents-issue-optimizer.yml
template = templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
main_sha256 = 26806e76cd620e227c81566f4db0cb9a4eca2ddd4c3e05a941d2c4072b2fe3b5
template_sha256 = ea5a33238a2dfc8bbc5e4661f66751dde1e9ca853b2cf77ed4eb286865fb9c93
reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA-pins third-party actions per the fleet action-pin contract (docs/HISTORY.md, PR #1925) and sets LangSmith tracing env; root uses floating major tags with repo-internal concurrency + sparse-checkout (docs/fixes/sparse-checkout-audit-2026-02-03.csv). Fingerprints refreshed after #2391/#2394 bumps. Do not align: would strip consumer action pins.
main_sha256 = 1e2fb1b588d00f694fd9d02816944e68a4d1a8041f4f052730b1f30f3ad696db
template_sha256 = bbd9d30e392d3df884ebabd9738fcd5864d79754dcfc04068466132e4c2e769d
reason = Intentional divergence re-baselined 2026-07-07: root and consumer issue-optimizer workflows keep different auth plumbing/action pin surfaces, but both now use the pinned tools/requirements-llm.txt install path with python -m pip. Do not align wholesale because that would strip consumer action pins/token setup.
Comment on lines 93 to +98

@coderabbitai coderabbitai Bot Jul 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Recompute sha256 for the actual current workflow files to compare against the allowlist entries.
sha256sum .github/workflows/agents-issue-optimizer.yml templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
fd check_template_drift.py --exec cat {}

Repository: stranske/Workflows

Length of output: 25459

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import hashlib

def normalize_text(text: str) -> str:
    normalized = text.replace("\r\n", "\n").replace("\r", "\n")
    lines = [line.rstrip() for line in normalized.split("\n")]
    while lines and lines[-1] == "":
        lines.pop()
    if not lines:
        return ""
    return "\n".join(lines) + "\n"

def normalized_sha256(path: Path) -> str:
    text = path.read_text(encoding="utf-8")
    return hashlib.sha256(normalize_text(text).encode("utf-8")).hexdigest()

paths = [
    Path("config/template-drift-allowlist.txt"),
    Path(".github/workflows/agents-issue-optimizer.yml"),
    Path("templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml"),
]
for path in paths:
    print(f"== {path} ==")
    if path.exists():
        text = path.read_text(encoding="utf-8").splitlines()
        for i, line in enumerate(text[92:98], start=93):
            print(f"{i}: {line}")
        if path.suffix == ".yml":
            print(f"normalized_sha256={normalized_sha256(path)}")
            print(f"line_count={len(text)}")
    else:
        print("MISSING")
PY

Repository: stranske/Workflows

Length of output: 1616

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
import hashlib
import configparser

def normalize_text(text: str) -> str:
    normalized = text.replace("\r\n", "\n").replace("\r", "\n")
    lines = [line.rstrip() for line in normalized.split("\n")]
    while lines and lines[-1] == "":
        lines.pop()
    if not lines:
        return ""
    return "\n".join(lines) + "\n"

def normalized_sha256(text: str) -> str:
    return hashlib.sha256(normalize_text(text).encode("utf-8")).hexdigest()

repo = Path('.').resolve()
allowlist_path = repo / 'config/template-drift-allowlist.txt'
main_path = repo / '.github/workflows/agents-issue-optimizer.yml'
template_path = repo / 'templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml'

for p in [allowlist_path, main_path, template_path]:
    print(f"== {p.relative_to(repo)} ==")
    print(f"exists={p.exists()}")
    if p.exists():
        txt = p.read_text(encoding='utf-8')
        print(f"normalized_sha256={normalized_sha256(txt)}")
        print(f"raw_bytes={len(txt.encode('utf-8'))}")
        if p == allowlist_path:
            parser = configparser.ConfigParser(interpolation=None)
            parser.read(p, encoding='utf-8')
            for section in parser.sections():
                if section == 'pair.11':
                    print("pair.11 parsed values:")
                    for key in ['main', 'template', 'main_sha256', 'template_sha256', 'reason']:
                        print(f"  {key}={parser.get(section, key)}")
PY

python3 - <<'PY'
from pathlib import Path
import hashlib
import configparser
import yaml

def normalize_text(text: str) -> str:
    normalized = text.replace("\r\n", "\n").replace("\r", "\n")
    lines = [line.rstrip() for line in normalized.split("\n")]
    while lines and lines[-1] == "":
        lines.pop()
    if not lines:
        return ""
    return "\n".join(lines) + "\n"

def normalized_sha256(text: str) -> str:
    return hashlib.sha256(normalize_text(text).encode("utf-8")).hexdigest()

repo = Path('.').resolve()
allowlist = configparser.ConfigParser(interpolation=None)
allowlist.read(repo / 'config/template-drift-allowlist.txt', encoding='utf-8')
entry = allowlist['pair.11']
main_path = repo / entry['main']
template_path = repo / entry['template']
main_text = main_path.read_text(encoding='utf-8')
template_text = template_path.read_text(encoding='utf-8')

print("pair.11 match status:")
print("  main_hash_matches=", entry['main_sha256'] == normalized_sha256(main_text))
print("  template_hash_matches=", entry['template_sha256'] == normalized_sha256(template_text))
print("  content_equal=", normalize_text(main_text) == normalize_text(template_text))

# Reproduce checker results for all pairs using the repo's discovery rules
manifest_path = repo / '.github/sync-manifest.yml'
manifest = yaml.safe_load(manifest_path.read_text(encoding='utf-8')) if manifest_path.exists() else {}
workflow_names = set()
for e in (manifest or {}).get('workflows', []) or []:
    if isinstance(e, dict):
        src = str(e.get('source', ''))
        if src.startswith('.github/workflows/'):
            workflow_names.add(src.removeprefix('.github/workflows/'))

alias = {"agents-63-issue-intake.yml": "agents-issue-intake.yml"}
main_dir = repo / '.github/workflows'
template_dir = repo / 'templates/consumer-repo/.github/workflows'
pairs = []
for main in sorted(main_dir.glob('agents-*.yml')):
    template_name = alias.get(main.name, main.name)
    template = template_dir / template_name
    if (not template.exists()) and (main.name not in alias) and (template_name not in workflow_names):
        continue
    pairs.append((main, template))

drifts = []
for main, template in pairs:
    main_text = main.read_text(encoding='utf-8')
    if not template.exists():
        drifts.append((main.name, template.name, 'missing-template'))
        continue
    template_text = template.read_text(encoding='utf-8')
    if normalize_text(main_text) != normalize_text(template_text):
        drifts.append((main.name, template.name, 'diff'))
print("drift_pairs=", drifts)
PY

Repository: stranske/Workflows

Length of output: 2446

Refresh pair.11's template hash config/template-drift-allowlist.txt:93-98 — main_sha256 still matches, but template_sha256 is stale for templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml, so this pair will keep tripping the drift check until the allowlist entry is regenerated.

🧰 Tools
🪛 LanguageTool

[uncategorized] ~94-~94: The official name of this software platform is spelled with a capital “H”.
Context: ...s digest to ebef44a. [pair.11] main = .github/workflows/agents-issue-optimizer.yml te...

(GITHUB)

[uncategorized] ~95-~95: The official name of this software platform is spelled with a capital “H”.
Context: ...yml template = templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml ma...

(GITHUB)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@config/template-drift-allowlist.txt` around lines 93 - 98, The allowlist
entry for pair.11 is out of date because the template hash no longer matches the
current contents of
templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml. Regenerate
or update the pair.11 hashes in config/template-drift-allowlist.txt so
template_sha256 reflects the latest template while keeping main_sha256
unchanged, and preserve the existing reason text unless the divergence meaning
has changed.

Source: Pipeline failures


[pair.12]
main = .github/workflows/agents-keepalive-loop-reporter.yml
Expand Down
3 changes: 1 addition & 2 deletions docs/workflow-snippets/agents-auto-pilot-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,4 @@
if: steps.check_enabled.outputs.enabled == 'true'
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
pip install -r tools/requirements-llm.txt
python -m pip install -r tools/requirements-llm.txt
24 changes: 14 additions & 10 deletions docs/workflow-updates/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,23 @@ This folder contains YAML snippets that must be manually applied to protected Gi
3. Insert the cache step from `docs/workflow-updates/agents-auto-pilot-changes.yml` immediately after the updated `Set up Python` step.
4. Replace the existing `Install Python dependencies` step with the install step from `docs/workflow-updates/agents-auto-pilot-changes.yml`.

5. Open `.github/workflows/reusable-agents-verifier.yml`.
6. Update the existing `Setup Python for LLM evaluation` step to include `id: setup-python-evaluate`.
7. Insert the evaluate-mode cache step from `docs/workflow-updates/reusable-agents-verifier-changes.yml` immediately after that setup step.
8. Replace the existing `Install LLM evaluation dependencies` step with the evaluate install step from `docs/workflow-updates/reusable-agents-verifier-changes.yml`.
5. Open `.github/workflows/agents-issue-optimizer.yml`.
6. Confirm the `Install dependencies` step uses `python -m pip install -r tools/requirements-llm.txt` and does not install unpinned `langchain` packages.

9. Update the existing `Setup Python for comparison` step to include `id: setup-python-compare`.
10. Insert the compare-mode cache step from `docs/workflow-updates/reusable-agents-verifier-changes.yml` immediately after that setup step.
11. Replace the existing `Install comparison dependencies` step with the compare install step from `docs/workflow-updates/reusable-agents-verifier-changes.yml`.
7. Open `.github/workflows/reusable-agents-verifier.yml`.
8. Update the existing `Setup Python for LLM evaluation` step to include `id: setup-python-evaluate`.
9. Insert the evaluate-mode cache step from `docs/workflow-updates/reusable-agents-verifier-changes.yml` immediately after that setup step.
10. Replace the existing `Install LLM evaluation dependencies` step with the evaluate install step from `docs/workflow-updates/reusable-agents-verifier-changes.yml`.

11. Update the existing `Setup Python for comparison` step to include `id: setup-python-compare`.
12. Insert the compare-mode cache step from `docs/workflow-updates/reusable-agents-verifier-changes.yml` immediately after that setup step.
13. Replace the existing `Install comparison dependencies` step with the compare install step from `docs/workflow-updates/reusable-agents-verifier-changes.yml`.

**Verification**
1. Confirm `.github/workflows/agents-auto-pilot.yml` contains `pip install -r tools/requirements-llm.txt` and no unpinned `langchain` install commands.
2. Confirm `.github/workflows/reusable-agents-verifier.yml` contains `pip install -r .workflows-lib/tools/requirements-llm.txt` in both evaluate and compare paths.
3. Confirm both workflows include `actions/cache@v4` steps with keys that include `python-version` and the relevant `hashFiles(...)` call.
1. Confirm `.github/workflows/agents-auto-pilot.yml` contains `python -m pip install -r tools/requirements-llm.txt` and no unpinned `langchain` install commands.
2. Confirm `.github/workflows/agents-issue-optimizer.yml` contains `python -m pip install -r tools/requirements-llm.txt` and no unpinned `langchain` install commands.
3. Confirm `.github/workflows/reusable-agents-verifier.yml` contains `pip install -r .workflows-lib/tools/requirements-llm.txt` in both evaluate and compare paths.
4. Confirm both cached workflows include `actions/cache@v4` steps with keys that include `python-version` and the relevant `hashFiles(...)` call.

**Notes**
The cache key format uses `steps.<setup-step-id>.outputs.python-version`, so the `id` additions are required for the cache key to include the Python version.
3 changes: 1 addition & 2 deletions docs/workflow-updates/agents-auto-pilot-changes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,5 +16,4 @@
if: steps.check_enabled.outputs.enabled == 'true'
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
pip install -r tools/requirements-llm.txt
python -m pip install -r tools/requirements-llm.txt
6 changes: 5 additions & 1 deletion scripts/check_test_dependencies.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,11 @@ if [ "$all_ok" = true ]; then
echo -e "${GREEN}All required dependencies are available!${NC}"
echo ""
echo "You can run the full test suite with:"
echo " ./scripts/run_tests.sh"
if [ -x ./scripts/run_tests.sh ]; then
echo " ./scripts/run_tests.sh"
else
echo " python -m pytest"
fi
exit 0
else
echo -e "${RED}Some required dependencies are missing!${NC}"
Expand Down
6 changes: 4 additions & 2 deletions scripts/generate_llm_workflow_update_comment.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@

DEFAULT_WORKFLOWS = (
Path(".github/workflows/agents-auto-pilot.yml"),
Path(".github/workflows/agents-issue-optimizer.yml"),
Path(".github/workflows/reusable-agents-verifier.yml"),
)

Expand Down Expand Up @@ -54,9 +55,10 @@ def _build_label_line(include_label: bool) -> list[str]:
def _build_main_body() -> str:
"""Build the main instruction body of the comment."""
return (
"Workflow updates required in .github/workflows/agents-auto-pilot.yml and "
"Workflow updates required in .github/workflows/agents-auto-pilot.yml, "
".github/workflows/agents-issue-optimizer.yml, and "
".github/workflows/reusable-agents-verifier.yml. Add pinned installs "
"(`pip install -r tools/requirements-llm.txt` and "
"(`python -m pip install -r tools/requirements-llm.txt` and "
"`pip install -r .workflows-lib/tools/requirements-llm.txt` for evaluate/compare), "
Comment thread
stranske marked this conversation as resolved.
"add actions/cache@v4 pip cache keyed by requirements hash + Python version, "
"and remove any floating `pip install langchain*` lines. Workflow edits require "
Expand Down
3 changes: 1 addition & 2 deletions templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,8 +238,7 @@ jobs:
if: steps.check_enabled.outputs.enabled == 'true'
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
pip install -r tools/requirements-llm.txt
python -m pip install -r tools/requirements-llm.txt

- name: Initialize auto-pilot metrics logs
if: steps.check_enabled.outputs.enabled == 'true'
Expand Down
5 changes: 1 addition & 4 deletions templates/consumer-repo/.github/workflows/agents-issue-optimizer.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,10 +147,7 @@ jobs:
if: steps.check.outputs.should_run == 'true'
run: |
python -m pip install --upgrade pip
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
# Install langchain dependencies
pip install langchain langchain-core langchain-openai \
langchain-anthropic langchain-community
python -m pip install -r workflows-scripts/tools/requirements-llm.txt

- name: Check optimizer recursion guard
if: steps.check.outputs.should_run == 'true'
Expand Down
27 changes: 22 additions & 5 deletions tests/docs/test_workflow_snippets_yaml.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,21 +63,38 @@ def test_install_snippets_reference_requirements_llm(
snippet_path: Path, requirements_path: str
) -> None:
contents = snippet_path.read_text(encoding="utf-8")
assert requirements_path in contents
expected_commands = {
f"pip install -r {requirements_path}",
f"python -m pip install -r {requirements_path}",
}
assert any(command in contents for command in expected_commands), (
f"Expected {snippet_path} to include one of " f"{sorted(expected_commands)!r}"
)

parsed = yaml.safe_load(contents)
assert isinstance(parsed, list), f"{snippet_path} should contain a YAML list"
assert any(
isinstance(step, dict)
and isinstance(step.get("run"), str)
and any(
line.strip() == f"pip install -r {requirements_path}"
for line in step["run"].splitlines()
)
and any(line.strip() in expected_commands for line in step["run"].splitlines())
for step in parsed
), f"Expected install snippet to include pip install for {requirements_path}"


def test_install_snippets_keep_literal_expected_commands() -> None:
auto_pilot_text = Path("docs/workflow-snippets/agents-auto-pilot-install.yml").read_text(
encoding="utf-8"
)
verifier_text = Path("docs/workflow-snippets/reusable-agents-verifier-install.yml").read_text(
encoding="utf-8"
)
auto_pilot_command = "python -m pip install -r tools/requirements-llm.txt"
verifier_command = "pip install -r .workflows-lib/tools/requirements-llm.txt"

assert auto_pilot_text.count(auto_pilot_command) == 1
assert verifier_text.count(verifier_command) == 2


def test_pip_freeze_step_runs_python_module() -> None:
snippet_path = Path("docs/workflow-snippets/pip-freeze-step.yml")
parsed = yaml.safe_load(snippet_path.read_text(encoding="utf-8"))
Expand Down
4 changes: 4 additions & 0 deletions tests/scripts/test_generate_llm_workflow_update_comment.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ def test_build_comment_includes_label_and_requirements() -> None:

assert "Label: needs-human" in comment
assert ".github/workflows/agents-auto-pilot.yml" in comment
assert ".github/workflows/agents-issue-optimizer.yml" in comment
assert ".github/workflows/reusable-agents-verifier.yml" in comment
assert "pip install -r tools/requirements-llm.txt" in comment
assert "pip install -r .workflows-lib/tools/requirements-llm.txt" in comment
Expand All @@ -34,6 +35,7 @@ def test_build_comment_lists_default_workflows() -> None:

assert "Affected workflows:" in comment
assert "- .github/workflows/agents-auto-pilot.yml" in comment
assert "- .github/workflows/agents-issue-optimizer.yml" in comment
assert "- .github/workflows/reusable-agents-verifier.yml" in comment


Expand All @@ -47,6 +49,7 @@ def test_build_comment_preserves_output_without_notes() -> None:
assert "Workflow updates required" in comment
assert "Affected workflows:" in comment
assert "- .github/workflows/agents-auto-pilot.yml" in comment
assert "- .github/workflows/agents-issue-optimizer.yml" in comment
assert "- .github/workflows/reusable-agents-verifier.yml" in comment
# Verify no notes section is added
assert "Notes:" not in comment
Expand Down Expand Up @@ -123,6 +126,7 @@ def test_build_main_body() -> None:
"""Test main body generation."""
body = _build_main_body()
assert "Workflow updates required" in body
assert ".github/workflows/agents-issue-optimizer.yml" in body
assert "pip install -r tools/requirements-llm.txt" in body
assert "agent-high-privilege" in body

Expand Down
14 changes: 13 additions & 1 deletion tests/workflows/test_workflow_llm_installs.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@

WORKFLOWS_DIR = Path(".github/workflows")
AUTO_PILOT = WORKFLOWS_DIR / "agents-auto-pilot.yml"
ISSUE_OPTIMIZER = WORKFLOWS_DIR / "agents-issue-optimizer.yml"
VERIFIER = WORKFLOWS_DIR / "reusable-agents-verifier.yml"
REUSABLE_CODEX_RUN = WORKFLOWS_DIR / "reusable-codex-run.yml"
REUSABLE_CLAUDE_RUN = WORKFLOWS_DIR / "reusable-claude-run.yml"
Expand Down Expand Up @@ -191,12 +192,22 @@ def test_agents_auto_pilot_llm_install_is_pinned() -> None:
text = _load_text(AUTO_PILOT)
_assert_pinned_install(
text,
"pip install -r tools/requirements-llm.txt",
"python -m pip install -r tools/requirements-llm.txt",
AUTO_PILOT.name,
)
_assert_no_floating_langchain(text, AUTO_PILOT.name)


def test_agents_issue_optimizer_llm_install_is_pinned() -> None:
text = _load_text(ISSUE_OPTIMIZER)
_assert_pinned_install(
text,
"python -m pip install -r tools/requirements-llm.txt",
ISSUE_OPTIMIZER.name,
)
_assert_no_floating_langchain(text, ISSUE_OPTIMIZER.name)


def test_agents_auto_pilot_pip_cache_is_configured() -> None:
if os.environ.get("AGENT_ENV", "agent-standard") != "agent-high-privilege":
pytest.skip("needs-human: workflow updates require agent-high-privilege")
Expand Down Expand Up @@ -295,6 +306,7 @@ def test_workflow_llm_needs_human_comment_documents_blocker() -> None:
required_phrases = [
"Label: needs-human",
".github/workflows/agents-auto-pilot.yml",
".github/workflows/agents-issue-optimizer.yml",
".github/workflows/reusable-agents-verifier.yml",
ACTIONS_CACHE_V6_REF,
"tools/requirements-llm.txt",
Expand Down
Loading