obsidian-vault/work/plans/gha-ci-executor.md

Plan: GHA CI Executor — macOS Build + Peekaboo

Date: 2026-05-14 Status: Planning

Goal

Migrate executor workers from Eagle's local Mac to GitHub Actions macOS runners:

• Each task spawns a GHA job
• Job installs Claude Code + Peekaboo + builds the app
• Executor (Claude Code) runs the fix, opens PR, posts report to Asana
• Eagle orchestrates: queues task → triggers GHA → monitors job → handles result

Architecture

Eagle (orchestrator) → triggers GHA workflow via gh CLI
                                    ↓
                    GHA macOS runner (macos-15-xlarge or self-hosted)
                                    ↓
                    Install: Xcode, Claude Code, Peekaboo, Simulator
                                    ↓
                    claude -p executor-worker.md  (non-interactive)
                                    ↓
                    Claude Code: fix → build → UI test via Peekaboo → PR
                                    ↓
                    Post result to Asana (gh pr comment + asana-bot)

Analysis Agent (Cloud-side)

Separate from the executor worker:

• Runs in Claude Cloud (or Eagle's Mac)
• Picks task tagged "обработать" from Asana
• Reads full task context (description, stories, user reports)
• Generates detailed executor prompt (investigation plan + acceptance criteria)
• Triggers GHA workflow with this prompt as input

GHA Workflow Design

name: Executor Worker
on:
  workflow_dispatch:
    inputs:
      task_gid:
        description: 'Asana task GID'
      executor_prompt:
        description: 'Base64-encoded executor prompt'
      branch_name:
        description: 'Git branch to create'

jobs:
  executor:
    runs-on: macos-15  # or self-hosted M-series
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v4
      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code
      - name: Install Peekaboo
        run: # brew install or download binary
      - name: Bootstrap Xcode
        run: # select Xcode version, accept license
      - name: Run Executor
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_CI_KEY }}
          ASANA_TOKEN: ${{ secrets.ASANA_CI_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          echo "${{ inputs.executor_prompt }}" | base64 -d > /tmp/prompt.md
          claude -p /tmp/prompt.md \
            --branch "${{ inputs.branch_name }}" \
            --no-interactive
      - name: Post Result
        if: always()
        run: # Post summary to Asana task + open PR if not already

Key Questions to Investigate

1. macOS runner availability: GitHub-hosted macos-15 or macos-15-xlarge?

   • Large runners cost more but needed for Xcode + Simulator
   • Self-hosted M4 Mac runner on Eagle itself? (no cloud cost but uses Eagle)

2. Peekaboo on GHA: Does Peekaboo work on GHA macOS runners?

   • Needs Screen Recording permission → headless runner may not grant it
   • Alternative: use xcrun simctl directly for UI tests
   • Or: spin up VM via ddg-vm (if GHA runner has the VM tool)

3. Build time: Full prod build on GHA macos-15?

   • Estimated 15-30 min cold, 5-10 min with cache
   • DerivedData caching via actions/cache is critical

4. Claude Code non-interactive: Does claude -p (non-interactive) work for complex fix tasks?

   • Yes — claude -p is the standard non-interactive mode
   • Needs --dangerously-skip-permissions or pre-approved tool config

5. Secrets: Need in GHA:

   • ANTHROPIC_CI_KEY — separate key for CI (not user key)
   • ASANA_CI_TOKEN — for posting results
   • GITHUB_TOKEN — auto-provided

Validation Steps

Before full implementation:

1. Test prod build on macos-15 runner: does it succeed without signing?
2. Test Peekaboo install + basic screenshot on GHA runner
3. Test claude -p with a simple prompt on GHA runner
4. Verify DerivedData caching works (build time < 10 min cached)

Phased Implementation

Phase 1: Validation (1-2 days)

• Create a test GHA workflow that: checks out repo, builds, runs basic UI test
• Verify Peekaboo accessibility permissions on headless runner
• Document what works / what doesn't

Phase 2: Claude Code Integration (2-3 days)

• Add Claude Code step to workflow
• Test with a trivial fix prompt
• Verify PR creation from GHA bot context

Phase 3: Analysis Agent (3-5 days)

• Cloud-side agent that picks Asana tasks + generates prompts
• Triggers GHA workflow via gh workflow run
• Monitors job, posts result to Asana

Phase 4: Eagle Integration (1 day)

• Eagle can trigger Phase 3 analysis agent on demand
• #executor topic shows GHA job status
• Auto-approval for GHA-spawned actions

Relation to Sentry Bot

Sentry bot pattern (already working):

• Cloud agent monitors Sentry errors
• Generates structured report
• Posts to Asana/Slack

GHA executor follows same pattern:

• Cloud agent picks Asana bug tasks
• Generates fix prompt
• GHA runner executes fix + validation

Notes

• GHA macos-15 runners do NOT have Xcode pre-cached — each run installs from scratch
• Self-hosted runner on Eagle avoids this but ties up the main Mac
• DuckDuckGo likely has existing GHA macOS setup — check existing workflows first
• Peekaboo may need tccutil or System Preferences pre-grant on runner