Adding the Integrations Tests #173

RoxyFarhad · 2025-10-29T20:59:26Z

No description provided.

semgrep-app · 2025-10-29T21:01:06Z

.github/workflows/build-and-push-tutorial-agent.yml

+        run: |
+          AGENT_NAME="${{ steps.image-name.outputs.agent_name }}"
+          VERSION_TAG="${{ inputs.version_tag }}"
+          REPOSITORY_NAME="${{ github.repository }}/tutorial-agents/${AGENT_NAME}"
+          FULL_IMAGE="${REGISTRY}/${REPOSITORY_NAME}:${VERSION_TAG}"
+
+          agentex agents build \
+            --manifest "${{ inputs.agent_path }}/manifest.yaml" \
+            --registry "${REGISTRY}" \
+            --tag "${VERSION_TAG}" \
+            --platforms "linux/amd64" \
+            --repository-name "${REPOSITORY_NAME}" \
+            --push
+
+          echo "Successfully built and pushed: ${FULL_IMAGE}"
+          echo "### Build Complete" >> $GITHUB_STEP_SUMMARY
+          echo "- **Image**: \`${FULL_IMAGE}\`" >> $GITHUB_STEP_SUMMARY


Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-app · 2025-10-29T21:01:07Z

.github/workflows/build-and-push-tutorial-agent.yml

+        run: |
+          # Remove examples/tutorials/ prefix and replace / with -
+          AGENT_NAME=$(echo "${{ inputs.agent_path }}" | sed 's|^examples/tutorials/||' | sed 's|/|-|g')
+          echo "AGENT_NAME=$AGENT_NAME" >> $GITHUB_ENV
+          echo "agent_name=$AGENT_NAME" >> $GITHUB_OUTPUT
+          echo "Agent name set to $AGENT_NAME"
+


Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-app · 2025-10-29T21:01:08Z

.github/workflows/build-and-push-tutorial-agent.yml

+        run: |
+          if [ ! -f "${{ inputs.agent_path }}/manifest.yaml" ]; then
+            echo "❌ Error: manifest.yaml not found in '${{ inputs.agent_path }}'"
+            exit 1
+          fi
+          echo "✅ manifest.yaml found"
+          echo "### Validation Summary" >> $GITHUB_STEP_SUMMARY
+          echo "- **Agent Path**: ${{ inputs.agent_path }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Version Tag**: ${{ inputs.version_tag }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Status**: ✅ Validation passed" >> $GITHUB_STEP_SUMMARY
+


Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

semgrep-app · 2025-10-29T21:01:09Z

.github/workflows/build-and-push-tutorial-agent.yml

+        run: |
+          if [ ! -d "${{ inputs.agent_path }}" ]; then
+            echo "❌ Error: Agent path '${{ inputs.agent_path }}' does not exist"
+            exit 1
+          fi
+          echo "✅ Agent path verified: ${{ inputs.agent_path }}"
+


Semgrep identified an issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

/fp <comment> for false positive

/ar <comment> for acceptable risk

/other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

socket-security · 2025-11-02T17:30:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	httpx-aiohttp@0.1.8 ⏵ 0.1.9
	agentex-sdk@0.4.19 ⏵ 0.5.3	⁺⁹

View full report

adding the basic workflows

c8c5d4d

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 8e7e051 to c8c5d4d Compare October 29, 2025 21:00

semgrep-app bot reviewed Oct 29, 2025

View reviewed changes

adding a workaround for now

75ac121

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 41fdfc5 to 75ac121 Compare October 29, 2025 22:21

adding this part of the pipeline

8f51022

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch 5 times, most recently from 0f5077c to 020984e Compare October 29, 2025 23:10

adding the test running part

54996c2

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 020984e to 54996c2 Compare October 29, 2025 23:13

RoxyFarhad added 2 commits October 30, 2025 13:15

show logs if the agent test times out

bd1a129

fixing this pipeline

2446a36

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from ce263ca to 7023a18 Compare November 2, 2025 15:47

fixing the rye issue

e10ad36

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 7023a18 to e10ad36 Compare November 2, 2025 16:05

RoxyFarhad added 2 commits November 2, 2025 11:15

debug pipeline

7e69b1a

another way

fcb8313

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 6f4b382 to fcb8313 Compare November 2, 2025 17:20

RoxyFarhad added 2 commits November 2, 2025 12:29

Merge branch 'main' into RF/feat/integration-pipeline

4104748

bump the version

be036c0

adding the logs here

30875ea

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch 2 times, most recently from 65181e4 to 7e9b901 Compare November 2, 2025 17:43

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 22c90b5 to 5b8f23b Compare November 2, 2025 18:39

checking tutorial ports

b4d87d7

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 5b8f23b to b4d87d7 Compare November 2, 2025 18:42

debuging the sdk version

6c7de97

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 960c3c6 to 6c7de97 Compare November 3, 2025 14:40

RoxyFarhad added 6 commits November 3, 2025 09:49

adding the hosting stuff

b61699b

trying to fix this

cac62f8

fix comms

90d93e7

adding the yq stuff

579dd97

running all the tests again

1ffabf7

adding the api ley

ba43d93

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 1d1f77c to 1feda9f Compare November 3, 2025 17:54

cleaning up

5a13b31

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 1feda9f to 5a13b31 Compare November 3, 2025 18:30

RoxyFarhad added 2 commits November 3, 2025 13:49

adding the pytest stuff

550d043

simplifying to matrix

258045d

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from 6294dbb to 87f0fdf Compare November 3, 2025 19:22

fixing tests

cebe84d

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch 2 times, most recently from e4f3636 to 134d3ef Compare November 3, 2025 19:45

testing this

95401c0

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch 5 times, most recently from 69eb4e4 to dc04e1a Compare November 3, 2025 22:55

cleaning up

bfab5aa

RoxyFarhad force-pushed the RF/feat/integration-pipeline branch from dc04e1a to bfab5aa Compare November 3, 2025 23:02

RoxyFarhad added 2 commits November 4, 2025 10:27

Merge branch 'main' into RF/feat/integration-pipeline

4749863

using the latest image that is pulled

4059f47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Adding the Integrations Tests #173

Adding the Integrations Tests #173

RoxyFarhad commented Oct 29, 2025

Uh oh!

semgrep-app bot Oct 29, 2025

Uh oh!

semgrep-app bot Oct 29, 2025

Uh oh!

semgrep-app bot Oct 29, 2025

Uh oh!

semgrep-app bot Oct 29, 2025

Uh oh!

socket-security bot commented Nov 2, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Adding the Integrations Tests #173

Are you sure you want to change the base?

Adding the Integrations Tests #173

Conversation

RoxyFarhad commented Oct 29, 2025

Uh oh!

semgrep-app bot Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

semgrep-app bot Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

semgrep-app bot Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

semgrep-app bot Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Nov 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security bot commented Nov 2, 2025 •

edited

Loading