From 570038eec66752b6f04f1b3db435a8ce50c0974e Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Fri, 24 Apr 2026 11:45:28 -0300 Subject: [PATCH 1/4] ci: raise agent audit turn limit and preserve logs The Friday test-health audit hit the 30-turn cap on its first-ever run (2026-04-24) and the agent log was discarded with the self-hosted runner. Heavier recipes need more room, and the next failure should be diagnosable. - Raise --max-turns from 30 to 50 - Switch --output-format from text to stream-json so events are emitted during the run instead of only at process exit; prefix with stdbuf -oL -eL to line-buffer the pipe - Upload /tmp/claude-audit-log.txt and /tmp/audit-.md as an artifact (if: always(), 14-day retention) using the upload-artifact SHA already pinned in build-notebooks.yml Signed-off-by: Andre Manoel --- .github/workflows/agentic-ci-daily.yml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/agentic-ci-daily.yml b/.github/workflows/agentic-ci-daily.yml index 263f6e0ca..ab9200640 100644 --- a/.github/workflows/agentic-ci-daily.yml +++ b/.github/workflows/agentic-ci-daily.yml @@ -174,11 +174,11 @@ jobs: | sed "s|{{date}}|$(date -u +%Y-%m-%d)|g" \ | sed "s|{{memory_path}}|.agentic-ci-state|g") - claude \ + stdbuf -oL -eL claude \ --model "$AGENTIC_CI_MODEL" \ -p "$PROMPT" \ - --max-turns 30 \ - --output-format text \ + --max-turns 50 \ + --output-format stream-json \ --verbose \ 2>&1 | tee /tmp/claude-audit-log.txt @@ -205,6 +205,17 @@ jobs: json.dump(state, f, indent=2) " + - name: Upload agent log + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: claude-audit-log-${{ matrix.suite }}-${{ github.run_id }} + path: | + /tmp/claude-audit-log.txt + /tmp/audit-${{ matrix.suite }}.md + retention-days: 14 + if-no-files-found: ignore + - name: Write job summary if: always() env: From 00e3c1559e9b58d8c7b1034767640d3638ebf3d8 Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Fri, 24 Apr 2026 15:19:09 -0300 Subject: [PATCH 2/4] ci: disambiguate audit artifact name across run attempts actions/upload-artifact@v4+ rejects duplicate names within a workflow, and re-running a failed run reuses the same github.run_id. Append github.run_attempt so re-runs upload successfully instead of failing at the exact moment the artifact is most useful. Found by Codex review of #571. Signed-off-by: Andre Manoel --- .github/workflows/agentic-ci-daily.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agentic-ci-daily.yml b/.github/workflows/agentic-ci-daily.yml index ab9200640..362182bde 100644 --- a/.github/workflows/agentic-ci-daily.yml +++ b/.github/workflows/agentic-ci-daily.yml @@ -209,7 +209,7 @@ jobs: if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - name: claude-audit-log-${{ matrix.suite }}-${{ github.run_id }} + name: claude-audit-log-${{ matrix.suite }}-${{ github.run_id }}-${{ github.run_attempt }} path: | /tmp/claude-audit-log.txt /tmp/audit-${{ matrix.suite }}.md From 9feb635377edf85f0b9f893c1f54e7b2d0fbfb30 Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Fri, 24 Apr 2026 15:20:31 -0300 Subject: [PATCH 3/4] ci: only upload agent log on failure Raise the bar for persisting the full verbose stream-json event log: we only need it when we're actually debugging a failure, and the audit report itself still lands in the step summary on success. Shrinks the window where tool inputs, read file contents, or other verbose-stream detail could end up in a 14-day artifact. Addresses the minor privacy finding from Codex review of #571. Signed-off-by: Andre Manoel --- .github/workflows/agentic-ci-daily.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agentic-ci-daily.yml b/.github/workflows/agentic-ci-daily.yml index 362182bde..92dc728cb 100644 --- a/.github/workflows/agentic-ci-daily.yml +++ b/.github/workflows/agentic-ci-daily.yml @@ -206,7 +206,7 @@ jobs: " - name: Upload agent log - if: always() + if: failure() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: claude-audit-log-${{ matrix.suite }}-${{ github.run_id }}-${{ github.run_attempt }} From bfcda3b4ddae25905d90cfceab453993fb00df2f Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Fri, 24 Apr 2026 15:38:29 -0300 Subject: [PATCH 4/4] ci: drop raw agent log from job summary With --output-format stream-json the previous tail -100 of the agent log emitted raw NDJSON into the GH Actions UI summary, which is unreadable. The audit report itself (/tmp/audit-.md) already carries the human-readable payload, and the full event stream is available as an on-failure artifact, so the raw tail was redundant and worse than nothing for the summary surface. Also rewords the fallback message to point at the artifact when no report lands (typically a failure). Signed-off-by: Andre Manoel --- .github/workflows/agentic-ci-daily.yml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/workflows/agentic-ci-daily.yml b/.github/workflows/agentic-ci-daily.yml index 92dc728cb..dc742701a 100644 --- a/.github/workflows/agentic-ci-daily.yml +++ b/.github/workflows/agentic-ci-daily.yml @@ -227,15 +227,5 @@ jobs: if [ -s "/tmp/audit-${SUITE}.md" ]; then cat "/tmp/audit-${SUITE}.md" >> "$GITHUB_STEP_SUMMARY" else - echo "No report generated." >> "$GITHUB_STEP_SUMMARY" - fi - - if [ -s "/tmp/claude-audit-log.txt" ]; then - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "
Agent log" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo '```' >> "$GITHUB_STEP_SUMMARY" - tail -100 /tmp/claude-audit-log.txt >> "$GITHUB_STEP_SUMMARY" - echo '```' >> "$GITHUB_STEP_SUMMARY" - echo "
" >> "$GITHUB_STEP_SUMMARY" + echo "No report generated. See the \`claude-audit-log-*\` artifact on failures for the full event stream." >> "$GITHUB_STEP_SUMMARY" fi