Failed to authenticate. API Error: 401 {"type":"error","error":{"type":"authentication_error","message":"Invalid authentication credentials"},"request_id":"req_011Cb1xC2T1zeEq84Vd9hUrb"}
[2026-05-14] vault sync
This commit is contained in:
Alexey Martemyanov
@@ -0,0 +1,151 @@
|
||||
# Plan: GHA CI Executor — macOS Build + Peekaboo
|
||||
|
||||
**Date**: 2026-05-14
|
||||
**Status**: Planning
|
||||
|
||||
## Goal
|
||||
|
||||
Migrate executor workers from Eagle's local Mac to GitHub Actions macOS runners:
|
||||
- Each task spawns a GHA job
|
||||
- Job installs Claude Code + Peekaboo + builds the app
|
||||
- Executor (Claude Code) runs the fix, opens PR, posts report to Asana
|
||||
- Eagle orchestrates: queues task → triggers GHA → monitors job → handles result
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
Eagle (orchestrator) → triggers GHA workflow via gh CLI
|
||||
↓
|
||||
GHA macOS runner (macos-15-xlarge or self-hosted)
|
||||
↓
|
||||
Install: Xcode, Claude Code, Peekaboo, Simulator
|
||||
↓
|
||||
claude -p executor-worker.md (non-interactive)
|
||||
↓
|
||||
Claude Code: fix → build → UI test via Peekaboo → PR
|
||||
↓
|
||||
Post result to Asana (gh pr comment + asana-bot)
|
||||
```
|
||||
|
||||
## Analysis Agent (Cloud-side)
|
||||
|
||||
Separate from the executor worker:
|
||||
- Runs in Claude Cloud (or Eagle's Mac)
|
||||
- Picks task tagged "обработать" from Asana
|
||||
- Reads full task context (description, stories, user reports)
|
||||
- Generates detailed executor prompt (investigation plan + acceptance criteria)
|
||||
- Triggers GHA workflow with this prompt as input
|
||||
|
||||
## GHA Workflow Design
|
||||
|
||||
```yaml
|
||||
name: Executor Worker
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
task_gid:
|
||||
description: 'Asana task GID'
|
||||
executor_prompt:
|
||||
description: 'Base64-encoded executor prompt'
|
||||
branch_name:
|
||||
description: 'Git branch to create'
|
||||
|
||||
jobs:
|
||||
executor:
|
||||
runs-on: macos-15 # or self-hosted M-series
|
||||
timeout-minutes: 120
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Install Claude Code
|
||||
run: npm install -g @anthropic-ai/claude-code
|
||||
- name: Install Peekaboo
|
||||
run: # brew install or download binary
|
||||
- name: Bootstrap Xcode
|
||||
run: # select Xcode version, accept license
|
||||
- name: Run Executor
|
||||
env:
|
||||
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_CI_KEY }}
|
||||
ASANA_TOKEN: ${{ secrets.ASANA_CI_TOKEN }}
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
echo "${{ inputs.executor_prompt }}" | base64 -d > /tmp/prompt.md
|
||||
claude -p /tmp/prompt.md \
|
||||
--branch "${{ inputs.branch_name }}" \
|
||||
--no-interactive
|
||||
- name: Post Result
|
||||
if: always()
|
||||
run: # Post summary to Asana task + open PR if not already
|
||||
```
|
||||
|
||||
## Key Questions to Investigate
|
||||
|
||||
1. **macOS runner availability**: GitHub-hosted `macos-15` or `macos-15-xlarge`?
|
||||
- Large runners cost more but needed for Xcode + Simulator
|
||||
- Self-hosted M4 Mac runner on Eagle itself? (no cloud cost but uses Eagle)
|
||||
|
||||
2. **Peekaboo on GHA**: Does Peekaboo work on GHA macOS runners?
|
||||
- Needs Screen Recording permission → headless runner may not grant it
|
||||
- Alternative: use `xcrun simctl` directly for UI tests
|
||||
- Or: spin up VM via ddg-vm (if GHA runner has the VM tool)
|
||||
|
||||
3. **Build time**: Full prod build on GHA macos-15?
|
||||
- Estimated 15-30 min cold, 5-10 min with cache
|
||||
- DerivedData caching via `actions/cache` is critical
|
||||
|
||||
4. **Claude Code non-interactive**: Does `claude -p` (non-interactive) work for complex fix tasks?
|
||||
- Yes — `claude -p` is the standard non-interactive mode
|
||||
- Needs `--dangerously-skip-permissions` or pre-approved tool config
|
||||
|
||||
5. **Secrets**: Need in GHA:
|
||||
- `ANTHROPIC_CI_KEY` — separate key for CI (not user key)
|
||||
- `ASANA_CI_TOKEN` — for posting results
|
||||
- `GITHUB_TOKEN` — auto-provided
|
||||
|
||||
## Validation Steps
|
||||
|
||||
Before full implementation:
|
||||
1. Test prod build on `macos-15` runner: does it succeed without signing?
|
||||
2. Test Peekaboo install + basic screenshot on GHA runner
|
||||
3. Test `claude -p` with a simple prompt on GHA runner
|
||||
4. Verify DerivedData caching works (build time < 10 min cached)
|
||||
|
||||
## Phased Implementation
|
||||
|
||||
### Phase 1: Validation (1-2 days)
|
||||
- Create a test GHA workflow that: checks out repo, builds, runs basic UI test
|
||||
- Verify Peekaboo accessibility permissions on headless runner
|
||||
- Document what works / what doesn't
|
||||
|
||||
### Phase 2: Claude Code Integration (2-3 days)
|
||||
- Add Claude Code step to workflow
|
||||
- Test with a trivial fix prompt
|
||||
- Verify PR creation from GHA bot context
|
||||
|
||||
### Phase 3: Analysis Agent (3-5 days)
|
||||
- Cloud-side agent that picks Asana tasks + generates prompts
|
||||
- Triggers GHA workflow via `gh workflow run`
|
||||
- Monitors job, posts result to Asana
|
||||
|
||||
### Phase 4: Eagle Integration (1 day)
|
||||
- Eagle can trigger Phase 3 analysis agent on demand
|
||||
- `#executor` topic shows GHA job status
|
||||
- Auto-approval for GHA-spawned actions
|
||||
|
||||
## Relation to Sentry Bot
|
||||
|
||||
Sentry bot pattern (already working):
|
||||
- Cloud agent monitors Sentry errors
|
||||
- Generates structured report
|
||||
- Posts to Asana/Slack
|
||||
|
||||
GHA executor follows same pattern:
|
||||
- Cloud agent picks Asana bug tasks
|
||||
- Generates fix prompt
|
||||
- GHA runner executes fix + validation
|
||||
|
||||
## Notes
|
||||
|
||||
- GHA macos-15 runners do NOT have Xcode pre-cached — each run installs from scratch
|
||||
- Self-hosted runner on Eagle avoids this but ties up the main Mac
|
||||
- DuckDuckGo likely has existing GHA macOS setup — check existing workflows first
|
||||
- Peekaboo may need `tccutil` or System Preferences pre-grant on runner
|
||||
Reference in New Issue
Block a user