Skip to content

[codex] Add GitHub readiness doctor checks - #186

Merged
DannyDesert merged 2 commits into
mainfrom
codex/github-readiness-validator-20260504
May 4, 2026
Merged

DannyDesert merged 2 commits into
mainfrom
codex/github-readiness-validator-20260504

Conversation

@DannyDesert

Copy link
Copy Markdown
Member

Summary

Adds GitHub readiness validation to the installer/deploy preflight path so YCLAW fails clearly when GitHub App auth, the default repo target, or webhook signature secret are missing or malformed.

Changes

  • Added local GitHub readiness checks for App credentials, PAT fallback visibility, explicit GITHUB_OWNER/GITHUB_REPO, and GITHUB_WEBHOOK_SECRET.
  • Wired the checks into yclaw doctor, which deploy already uses as its critical preflight gate.
  • Added pure validator tests plus runDoctor integration coverage for the runtime invocation path.

Test Plan

  • Tests pass (npm test)
  • Type check passes (npm run typecheck)
  • Manual verification: built CLI doctor --json smoke exits 0 and reports github-auth/github-repo-target/github-webhook-secret as pass with explicit GitHub App env.

Checklist

  • No new dependencies without justification
  • No secrets or credentials committed
  • Documentation updated (not included; behavior is surfaced in doctor output)
  • Config examples validated (not changed in this PR)

@DannyDesert
DannyDesert marked this pull request as ready for review May 4, 2026 18:27
@DannyDesert
DannyDesert merged commit b0d2c5a into main May 4, 2026
4 checks passed
@DannyDesert
DannyDesert deleted the codex/github-readiness-validator-20260504 branch May 4, 2026 18:27
DannyDesert added a commit that referenced this pull request May 4, 2026
## Summary
- add a public-release readiness regression test that blocks
Troy-specific AWS/Discord/private-network IDs in public
deploy/docs/prompt surfaces
- remove active Strategist Builder/Deployer directive publications and
update the objective workflow examples to route through Architect/AO-era
ownership
- make AO a first-class AWS Terraform service with private Cloud Map
service discovery, Core -> AO URL wiring, AO -> Core callback URL
wiring, AO storage/concurrency config, and fail-fast GitHub/AO auth
checks
- scrub deployment helper docs/scripts and Terraform comments/defaults
so the product does not publish private deployment IDs
- fix Terraform validation blockers in Secrets Manager for_each handling
and S3 lifecycle configuration

## Coverage against existing PRs
- PR #183 already covers local compose/CLI AO install defaults; this PR
covers the AWS Terraform deploy path and public-release leakage checks.
- PR #184 covers broader config wiring drift; this PR only removes the
remaining active Strategist Builder/Deployer publications and adds a
focused regression guard.
- PR #185 is a Socket workflow fix and is not duplicated here.
- PR #186 covers GitHub readiness doctor checks; this PR adds AWS
deploy-time GitHub/AO auth requirements.
- PR #187 covers dynamic repo registration; this PR only passes
GitHub/AO repo identity through AWS deployment config.

## Verification
- `npx vitest run packages/core/tests/public-release-readiness.test.ts`
- `npm run validate-configs --workspace=packages/core`
- `terraform -chdir=deploy/aws validate`
- `npm run typecheck`
- `npm test`
- `npm run build`

## Notes
- `terraform validate` proves syntax/module wiring. The new GitHub/AO
`check` blocks are plan-time guardrails and require real variable values
during an AWS plan/apply.
- The full test suite currently emits an existing Vitest warning about a
nested `vi.mock` in `packages/core/tests/discord-executor.test.ts`;
tests still pass.

Co-authored-by: Troy Murray <troy@graviton.xyz>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant