fix(e2e): drop xfail strict=True on tests the cloud stack now passes

[G4614]

The Tokyo e2e stack currently returns 4xx on over-quota box creates (the runner can't honour cpus=999 etc. and the box ends in ERROR state, so the SDK sees the failure surfacing as the 4xx the tests expect). The xfail-strict markers were written assuming the documented "silent clamp at the create boundary" bug was still live; under the current behavior those tests XPASS and strict mode flips them to suite-level failures.

Test plan

	Before	After
pytest test_quota_enforcement.py against current Tokyo	5 XPASS(strict) → FAILED	5 XPASS — no failure
pytest test_error_code_mapping.py::test_resource_exhausted_over_cpu_quota_returns_429	XPASS(strict) → FAILED	XPASS
pytest test_exec_attach.py::test_reattach_after_original_completes	XPASS(strict) → FAILED	XPASS
Cases that genuinely still XFAIL (test_runner_concurrency, test_cli_detach_recovery, etc.)	XFAIL (no change)	XFAIL (no change) — strict was unrelated

Markers stay in place so the production bug references are still discoverable; only the strict=True flag is dropped. Add it back when the underlying bug is re-introduced and the test is genuinely expected to fail again.

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Updated API schema default values for role assignment fields in organization member and invitation requests, changing from a placeholder value to an empty array.

• Infrastructure & Automation

  • Enhanced CI/CD pipeline with automated deployment workflows for API services and supporting infrastructure components.
  • Improved end-to-end testing suite with cloud-based test execution capabilities.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR establishes a complete Tokyo E2E cloud CI/CD infrastructure with reusable deployment workflows, multi-service orchestration, and adapted test harness. It replaces the old self-hosted e2e-stack.yml with cloud-native workflows that deploy API, runner, and supporting services to AWS, then execute E2E tests against the live stack with health checks, idempotent initialization, and diagnostic log collection.

Changes

Tokyo E2E Cloud Infrastructure

Layer / File(s)	Summary
Shared deployment primitive .github/workflows/_deploy-single-service.yml	New reusable workflow that deploys a single ECS service: resolves cluster, builds/pushes Docker image, registers updated task definition with image+role swaps, verifies PRIMARY deployment matches.
Build infrastructure enhancements .github/workflows/build-c.yml, .github/workflows/build-runner-binary.yml	Updated both workflows to support reusable calling via workflow_call. build-c.yml adds target_filter matrix filtering. build-runner-binary.yml adds libboxlite_source input to choose between release tarball and freshly-built library artifact.
API deployment pipeline .github/workflows/deploy-api.yml, apps/api/Dockerfile, apps/api/Dockerfile.source	New workflow deploys API with redeploy-current mode, builds from new Dockerfile.source (ts-node source mode) or production Dockerfile (via parameterized NX_BUILD_CONFIG), performs S3 bucket live patching, and polls ALB targets for health. Handles circuit-breaker rollback detection and ECS stability verification.
Runner deployment pipeline .github/workflows/deploy-runner.yml	New workflow builds/deploys boxlite-runner binary to Tokyo EC2 via SSH+SCP+EC2 Instance Connect. Conditionally rebuilds C SDK and runner based on source changes, verifies restart via systemd PID/timestamp/SHA256 checks, and manages ephemeral SSH key lifecycle.
Supporting services deployment .github/workflows/deploy-app-services.yml, apps/proxy/Dockerfile, apps/otel-collector/Dockerfile, apps/ssh-gateway/Dockerfile, apps/otel-collector/builder-config.yaml, apps/package.json	New workflow deploys proxy, otel-collector, ssh-gateway services using shared _deploy-single-service primitive. Path-filter-based detection and manual selector input. Updated otel-collector Go module paths and removed deprecated dockerode npm dependencies.
E2E orchestration & test execution .github/workflows/e2e-cloud.yml, .github/workflows/e2e-cloud-test.yml, .github/workflows/e2e-stack.yml (removed), .github/workflows/README.md	New e2e-cloud.yml orchestrator conditionally deploys API/runner/services based on source changes, then triggers e2e-cloud-test.yml which resolves cloud resources, performs health/quota probes, builds Python SDK, runs pytest with junit output, and collects CloudWatch/journal logs on failure. Removed old self-hosted e2e-stack.yml. Updated workflow documentation.
E2E test harness adjustments scripts/test/e2e/cases/conftest.py, scripts/test/e2e/cases/test_error_code_mapping.py, scripts/test/e2e/cases/test_exec_attach.py, scripts/test/e2e/cases/test_quota_enforcement.py	Added BOXLITE_E2E_SKIP_PATH_VERIFY environment bypass in conftest.py for cloud CI. Changed pytest xfail markers from strict=True to strict=False across error-code, exec-attach, and quota-enforcement tests.
API schema and config apps/api-client-go/api/openapi.yaml	Changed default assignedRoleIds from sentinel UUID array to empty array in UpdateOrganizationMemberAccess and CreateOrganizationInvitation request models.

Sequence Diagram

sequenceDiagram
  participant Developer
  participant e2e-cloud
  participant deploy_api
  participant deploy_runner
  participant deploy_app_services
  participant e2e-cloud-test
  Developer->>e2e-cloud: push to main or manual dispatch
  e2e-cloud->>e2e-cloud: paths-filter: detect API/runner/services/SDK changes
  alt api changed
    e2e-cloud->>deploy_api: call reusable workflow
    deploy_api->>deploy_api: build/push API image, register ECS task def, verify health
  end
  alt runner_chain changed
    e2e-cloud->>deploy_runner: call reusable workflow
    deploy_runner->>deploy_runner: build C SDK and runner binary, deploy to EC2
  end
  alt supporting services changed
    e2e-cloud->>deploy_app_services: call reusable workflow with services list
    deploy_app_services->>deploy_app_services: deploy proxy/otel-collector/ssh-gateway
  end
  e2e-cloud->>e2e-cloud-test: all deployments succeeded
  e2e-cloud-test->>e2e-cloud-test: resolve cloud resources (ECS, ALB, EC2, S3)
  e2e-cloud-test->>e2e-cloud-test: health check, init quota, build SDK, run pytest
  e2e-cloud-test->>Developer: upload junit, collect logs on failure

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Possibly related PRs

• boxlite-ai/boxlite#678: Updates the same scripts/test/e2e pytest suite (conftest.py's verify_runner_saw_all_boxes fixture and test xfail settings) that are modified here for cloud CI compatibility.
• boxlite-ai/boxlite#683: Modifies scripts/test/e2e/cases/test_error_code_mapping.py xfail strict settings, directly overlapping with this PR's test adjustment layer.
• boxlite-ai/boxlite#730: Modifies apps/api/Dockerfile Nx build steps for API/dashboard, relating to this PR's new NX_BUILD_CONFIG parameterization.

Suggested reviewers

• law-chain-hot

Poem

🐰 A rabbit hops through clouds of code,
deploying APIs down the road,
E2E tests now dance and play,
in Tokyo's bright AWS way!
No more self-hosted, just the cloud,
workflows orchestrating, proud and loud! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly and specifically describes the main change: removing xfail strict=True from e2e tests that now pass on the cloud stack.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/e2e-drop-stale-xfail-strict

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 10

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/_deploy-single-service.yml:
- Around line 98-133: The workflow currently unconditionally sets
TASK_ROLE/EXEC_ROLE to the borrowed Api ARNs (from the api_roles step) when
creating the new task definition; change this so we first inspect the target
service's current task definition and reuse its taskRoleArn/executionRoleArn if
they are present and resolvable, and only fallback to the borrowed Api roles
when the existing ARNs are missing/invalid. Concretely, update the logic around
the api_roles step and the Register new TD step's env vars (TASK_ROLE and
EXEC_ROLE) to: 1) call aws ecs describe-services/describe-task-definition for
the service named by SERVICE to obtain its current taskRoleArn/executionRoleArn,
2) validate those ARNs (non-empty and not "None"), 3) export those as outputs if
valid, and 4) only set outputs to the Api-borrowed TASK_ROLE/EXEC_ROLE when the
validation fails so the borrow is a fallback rather than an unconditional
replacement.
- Around line 57-60: The workflow uses entries like actions/checkout@v5 and
aws-actions/configure-aws-credentials@v4 must be pinned to immutable commit
SHAs; find every `uses: owner/repo@<floating tag>` occurrence (e.g.,
actions/checkout@v5, aws-actions/configure-aws-credentials@v4,
aws-actions/amazon-ecr-login@v2) and replace the tag with the corresponding
40-hex commit SHA from the action's repository (ensure the SHA corresponds to
the intended release/tag), updating all affected workflows so each `uses:` is
owner/repo@<40-hex-commit-sha>.

In @.github/workflows/build-runner-binary.yml:
- Around line 27-33: Add an explicit allowlist validation step (e.g., "Validate
libboxlite_source") that reads the workflow input libboxlite_source and fails
fast if its value is not exactly "build" or "release"; ensure the step prints a
clear error and exits non‑zero so invalid values cannot silently fall through to
the existing release fallback logic that currently treats any non-"build" as
release.

In @.github/workflows/deploy-app-services.yml:
- Around line 145-150: The reusable workflow invocation using "uses:
./.github/workflows/_deploy-single-service.yml" currently includes "secrets:
inherit" which over-exposes repo secrets; remove "secrets: inherit" and instead
pass only the explicit secrets required by the called workflow (or omit the
secrets block if none are needed). Update each invocation of the reusable
workflow (e.g., the Proxy service call and the other similar invocations) to
replace "secrets: inherit" with a minimal "secrets:" mapping listing only the
specific secret names the called workflow expects (or delete the secrets key
entirely) so you limit scope to required values.
- Around line 101-112: The parsing of INPUT_SVCS tokens leaves leading/trailing
whitespace so values like " SshGateway" don't match the case branches; trim each
token before matching by processing the loop variable (s) to remove whitespace
(e.g., use parameter expansion or a trim helper) before the case statement that
checks Proxy, OtelCollector, SshGateway; ensure you update the loop over REQ and
the case comparison to use the trimmed token so unknown-service warnings no
longer occur for tokens with surrounding spaces.

In @.github/workflows/deploy-runner.yml:
- Around line 265-273: The describe-instances invocation currently grabs the
first match and assigns ID, IP, SG; instead, run a preliminary
describe-instances/--query to list all matching instance IDs (using the same
filter for tag:Name=boxlite-runner and running state), count the results, and
fail unless the count is exactly 1; then proceed to fetch the single instance's
ID/IP/SG (or call describe-instances again with --instance-ids "$ID") so ID, IP,
SG are deterministic. Ensure you reference the current aws ec2
describe-instances command and the variables ID, IP, SG in the check and emit an
error if count != 1.
- Around line 346-359: The SSH options currently disable host key verification
via SSH_OPTS and risk MITM; instead remove "-o StrictHostKeyChecking=no -o
UserKnownHostsFile=/dev/null" from SSH_OPTS and ensure the deploy job
creates/uses a real known_hosts containing the EC2 host key (e.g., run
ssh-keyscan or verify a pinned fingerprint into a file and set SSH_OPTS to use
"-o UserKnownHostsFile=/path/to/known_hosts -o StrictHostKeyChecking=yes"); keep
using KEY, IP, ARCHIVE, scp and ssh/EXPECTED_SHA as before but add a step before
scp/ssh to write the pinned host key (or fingerprint) into the known_hosts file
with proper permissions so scp $SSH_OPTS "$ARCHIVE"
"ubuntu@${IP}:/tmp/boxlite-runner.tar.gz" and ssh $SSH_OPTS "ubuntu@${IP}"
"EXPECTED_SHA='$EXPECTED_SHA' bash -s" will verify the server identity.

In @.github/workflows/e2e-cloud.yml:
- Around line 100-101: Replace tag-only GitHub Action references with immutable
commit SHAs: find each uses entry for actions/checkout@v5,
dorny/paths-filter@v3, aws-actions/configure-aws-credentials@v4, and
actions/upload-artifact@v4 and update them to the corresponding full 40-hex
commit SHA for the desired release; ensure the syntax remains uses:
owner/repo@<40-hex-sha> and commit SHAs are accurate and tested in CI before
merging.

In @.github/workflows/README.md:
- Around line 226-237: Summary: The README section for e2e-cloud.yml is stale
and describes a different job/trigger layout than the actual workflow. Update
the "Architecture:" and "Triggers:" paragraphs to reflect the current workflow:
replace the described three-job changes/e2e/e2e-gate pattern with the actual
jobs (e.g., deploy_runner, deploy_api, deploy_app_services and the e2e execution
job names present in e2e-cloud.yml) and remove references to a gate job that no
longer exists; also correct the "Triggers:" list to show the real triggers (add
or remove pull_request and include workflow_dispatch/push as present in the
file). Ensure you reference the exact job names found in e2e-cloud.yml
(deploy_runner, deploy_api, deploy_app_services, etc.) and keep the README
wording concise so branch-protection/operator expectations match the workflow.

In `@apps/otel-collector/builder-config.yaml`:
- Line 9: The exporters.path value is inconsistent between builder-config.yaml
and builder-config.dev.yaml which causes relative resolution to break depending
on Nx cwd; update the exporters[].path in both
apps/otel-collector/builder-config.yaml and
apps/otel-collector/builder-config.dev.yaml to the same canonical form (either
both use an absolute path from repo root or both use the same relative base) so
the cmd/builder resolves identically; locate the exporters entry
(exporters[].path) in each YAML and replace the differing values (e.g., change
"apps/otel-collector/exporter" and "otel-collector/exporter" to a single
consistent path) or alternatively set and document an explicit Nx cwd for the
builder invocation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fc8c39bc-778e-443d-8b46-6857f6495263

📥 Commits

Reviewing files that changed from the base of the PR and between 0cc2dda and 980ed0f.

⛔ Files ignored due to path filters (1)

• apps/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (22)

• .github/workflows/README.md
• .github/workflows/_deploy-single-service.yml
• .github/workflows/build-c.yml
• .github/workflows/build-runner-binary.yml
• .github/workflows/deploy-api.yml
• .github/workflows/deploy-app-services.yml
• .github/workflows/deploy-runner.yml
• .github/workflows/e2e-cloud-test.yml
• .github/workflows/e2e-cloud.yml
• .github/workflows/e2e-stack.yml
• apps/api-client-go/api/openapi.yaml
• apps/api/Dockerfile
• apps/api/Dockerfile.source
• apps/otel-collector/Dockerfile
• apps/otel-collector/builder-config.yaml
• apps/package.json
• apps/proxy/Dockerfile
• apps/ssh-gateway/Dockerfile
• scripts/test/e2e/cases/conftest.py
• scripts/test/e2e/cases/test_error_code_mapping.py
• scripts/test/e2e/cases/test_exec_attach.py
• scripts/test/e2e/cases/test_quota_enforcement.py

💤 Files with no reviewable changes (2)

• apps/package.json
• .github/workflows/e2e-stack.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -nP --glob '.github/workflows/*.yml' '^\s*-\s*uses:\s*(?!\./)[^@]+@(?![0-9a-fA-F]{40}\b)[^\s]+'

Repository: boxlite-ai/boxlite

Length of output: 211

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Workflow files found =="
fd -e yml -e yaml .github/workflows || true
echo
echo "== Count =="
echo "yml:"; find .github/workflows -type f -name '*.yml' 2>/dev/null | wc -l || true
echo "yaml:"; find .github/workflows -type f -name '*.yaml' 2>/dev/null | wc -l || true

echo
echo "== Show top-level filenames =="
find .github/workflows -maxdepth 1 -type f -print 2>/dev/null || true

Repository: boxlite-ai/boxlite

Length of output: 1218

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Re-run detection over both yml and yaml, without relying on --glob filter.
WORKDIR=".github/workflows"
echo "== Non-SHA-pinned third-party uses: entries (yml+yaml) =="
if [ -d "$WORKDIR" ]; then
  rg -nP --hidden --glob "${WORKDIR}/**/*.yml" --glob "${WORKDIR}/**/*.yaml" \
    '^\s*-\s*uses:\s*(?!\./)(?![^@]+@)[^@]+@(?![0-9a-fA-F]{40}\b)[^\s]+' \
    "$WORKDIR" || true
else
  echo "No $WORKDIR directory found"
fi

Repository: boxlite-ai/boxlite

Length of output: 120

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# More reliable: explicitly match common checkout/configure uses lines and filter out local/sha-pinned.
WORKDIR=".github/workflows"
echo "== Candidate uses lines =="
if [ -d "$WORKDIR" ]; then
  rg -n --hidden --glob "${WORKDIR}/**/*.yml" --glob "${WORKDIR}/**/*.yaml" \
    '^\s*-\s*uses:\s*(?!\./)' \
    "$WORKDIR" | head -n 200
fi

Repository: boxlite-ai/boxlite

Length of output: 350

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Print the workflow files mentioned in the original comment (if they exist) so we can update the claim.
for f in \
  .github/workflows/_deploy-single-service.yml \
  .github/workflows/build-runner-binary.yml \
  .github/workflows/deploy-api.yml \
  .github/workflows/deploy-runner.yml \
  .github/workflows/deploy-app-services.yml
do
  if [ -f "$f" ]; then
    echo "== $f =="
    sed -n '1,120p' "$f"
    echo
  else
    echo "== Missing: $f =="
  fi
done

Repository: boxlite-ai/boxlite

Length of output: 26031

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Workflow files found =="
fd -e yml -e yaml .github/workflows || true
echo
echo "== Count =="
echo "yml:"; find .github/workflows -type f -name '*.yml' 2>/dev/null | wc -l || true
echo "yaml:"; find .github/workflows -type f -name '*.yaml' 2>/dev/null | wc -l || true

echo
echo "== Show top-level filenames =="
find .github/workflows -maxdepth 1 -type f -print 2>/dev/null || true

Repository: boxlite-ai/boxlite

Length of output: 1218

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Re-run detection over both yml and yaml, without relying on --glob filter.
WORKDIR=".github/workflows"
echo "== Non-SHA-pinned third-party uses: entries (yml+yaml) =="
if [ -d "$WORKDIR" ]; then
  rg -nP --hidden --glob "${WORKDIR}/**/*.yml" --glob "${WORKDIR}/**/*.yaml" \
    '^\s*-\s*uses:\s*(?!\./)(?![^@]+@)[^@]+@(?![0-9a-fA-F]{40}\b)[^\s]+' \
    "$WORKDIR" || true
else
  echo "No $WORKDIR directory found"
fi

Repository: boxlite-ai/boxlite

Length of output: 120

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# More reliable: explicitly match common checkout/configure uses lines and filter out local/sha-pinned.
WORKDIR=".github/workflows"
echo "== Candidate uses lines (first 200) =="
if [ -d "$WORKDIR" ]; then
  rg -n --hidden --glob "${WORKDIR}/**/*.yml" --glob "${WORKDIR}/**/*.yaml" \
    '^\s*-\s*uses:\s*(?!\./)' \
    "$WORKDIR" | head -n 200
fi

Repository: boxlite-ai/boxlite

Length of output: 362

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Print the workflow files mentioned in the original comment (if they exist) so we can update the claim.
for f in \
  .github/workflows/_deploy-single-service.yml \
  .github/workflows/build-runner-binary.yml \
  .github/workflows/deploy-api.yml \
  .github/workflows/deploy-runner.yml \
  .github/workflows/deploy-app-services.yml
do
  if [ -f "$f" ]; then
    echo "== $f =="
    sed -n '1,140p' "$f"
    echo
  else
    echo "== Missing: $f =="
  fi
done

Repository: boxlite-ai/boxlite

Length of output: 30525

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import os, re, sys, pathlib
root = pathlib.Path(".github/workflows")
files = sorted([p for p in root.rglob("*.yml") if p.is_file()])

uses_re = re.compile(r'^\s*-\s*uses:\s*([^\s#]+)|^\s*uses:\s*([^\s#]+)\s*(?:#.*)?$')
local_re = re.compile(r'^\./|^\.\./|^\.github/')

bad = []
for f in files:
    txt = f.read_text(encoding="utf-8", errors="replace").splitlines()
    for i,line in enumerate(txt, 1):
        # capture either group 1 (dash uses) or group 2 (job uses:)
        m = re.match(r'^\s*-\s*uses:\s*([^\s#]+)', line)
        val = None
        if m:
            val = m.group(1)
        else:
            m2 = re.match(r'^\s*uses:\s*([^\s#]+)\s*(?:#.*)?$', line)
            if m2:
                val = m2.group(1)
        if not val: 
            continue
        if '@' not in val:
            continue
        if local_re.match(val):
            continue
        # anything like owner/repo/path@ref
        before, ref = val.rsplit('@',1)
        # treat refs that are exactly 40-hex as pinned
        if re.fullmatch(r'[0-9a-fA-F]{40}', ref):
            continue
        bad.append((str(f), i, val))
print(f"Total workflow files scanned: {len(files)}")
print(f"Non-SHA-pinned uses found: {len(bad)}")
for f,i,val in bad:
    print(f"{f}:{i}: {val}")
PY

Repository: boxlite-ai/boxlite

Length of output: 8741

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import pathlib, re
root = pathlib.Path(".github/workflows")
files = sorted([p for p in root.rglob("*.yml") if p.is_file()])

pattern = re.compile(r'`@v`\d+|`@master`|`@main`|`@release`|`@stable`|`@latest`|`@canary`')
hits = []
for f in files:
    for i,line in enumerate(f.read_text(encoding="utf-8", errors="replace").splitlines(),1):
        m = re.match(r'^\s*-\s*uses:\s*([^\s#]+)', line) or re.match(r'^\s*uses:\s*([^\s#]+)\s*(?:#.*)?$', line)
        if not m: 
            continue
        val = m.group(1)
        if '@' not in val: 
            continue
        if val.startswith('./') or val.startswith('../') or val.startswith('.github/'):
            continue
        if pattern.search(val):
            hits.append((str(f), i, val))
print("Examples of common floating tags:")
for f,i,val in hits[:200]:
    print(f"{f}:{i}: {val}")
print(f"(showing {min(len(hits),200)} of {len(hits)})")
PY

Repository: boxlite-ai/boxlite

Length of output: 8536

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
import pathlib, re

root = pathlib.Path(".github/workflows")
files = sorted([p for p in root.rglob("*.yml") if p.is_file()])

def extract_uses_line(line):
    m = re.match(r'^\s*-\s*uses:\s*([^\s#]+)', line)
    if m: 
        return m.group(1)
    m = re.match(r'^\s*uses:\s*([^\s#]+)\s*(?:#.*)?$', line)
    return m.group(1) if m else None

bad = []
local_re = re.compile(r'^(?:\./|\.\./|\.github/)')
sha40 = re.compile(r'^[0-9a-fA-F]{40}$')

for f in files:
    for idx, line in enumerate(f.read_text(encoding="utf-8", errors="replace").splitlines(), 1):
        val = extract_uses_line(line)
        if not val or '@' not in val:
            continue
        if local_re.match(val):
            continue
        _, ref = val.rsplit('@', 1)
        if not sha40.match(ref):
            bad.append((str(f), idx, val))

print(f"Total workflow files scanned: {len(files)}")
print(f"Non-SHA-pinned uses found: {len(bad)}")
for f, idx, val in bad:
    print(f"{f}:{idx}: {val}")
PY

Repository: boxlite-ai/boxlite

Length of output: 8741

---

Pin third-party GitHub Actions to commit SHAs (floating @v* refs weaken supply-chain integrity).

Scanning .github/workflows/*.yml (19 files) finds 133 uses: entries whose ref is not a 40-hex commit SHA (e.g., actions/checkout@v5, aws-actions/configure-aws-credentials@v4, aws-actions/amazon-ecr-login@v2, etc.). This includes:

• .github/workflows/_deploy-single-service.yml lines 57-60:

        - uses: actions/checkout@v5
  
        - name: Configure AWS credentials (OIDC)
          uses: aws-actions/configure-aws-credentials@v4

• Same pattern also appears in .github/workflows/build-runner-binary.yml, .github/workflows/deploy-api.yml, .github/workflows/deploy-runner.yml, .github/workflows/deploy-app-services.yml, and other workflows in the directory.

Replace each uses: owner/repo@<floating tag> with uses: owner/repo@<40-hex-commit-sha> across the affected workflows.

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 57-57: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 57-57: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/_deploy-single-service.yml around lines 57 - 60, The
workflow uses entries like actions/checkout@v5 and
aws-actions/configure-aws-credentials@v4 must be pinned to immutable commit
SHAs; find every `uses: owner/repo@<floating tag>` occurrence (e.g.,
actions/checkout@v5, aws-actions/configure-aws-credentials@v4,
aws-actions/amazon-ecr-login@v2) and replace the tag with the corresponding
40-hex commit SHA from the action's repository (ensure the SHA corresponds to
the intended release/tag), updating all affected workflows so each `uses:` is
owner/repo@<40-hex-commit-sha>.

Source: Linters/SAST tools

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Avoid unconditional role replacement with Api roles.

Line 149 and Line 150 force every service to use Api task/execution roles on each deploy. That turns a temporary break-glass workaround into a persistent least-privilege regression and can hide role drift after IAM is repaired. Keep existing service roles by default, and only fallback to Api roles when the current role ARNs are actually invalid/unresolvable.

Also applies to: 141-151

🧰 Tools

🪛 zizmor (1.25.2)

[info] 114-114: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[error] 125-125: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/_deploy-single-service.yml around lines 98 - 133, The
workflow currently unconditionally sets TASK_ROLE/EXEC_ROLE to the borrowed Api
ARNs (from the api_roles step) when creating the new task definition; change
this so we first inspect the target service's current task definition and reuse
its taskRoleArn/executionRoleArn if they are present and resolvable, and only
fallback to the borrowed Api roles when the existing ARNs are missing/invalid.
Concretely, update the logic around the api_roles step and the Register new TD
step's env vars (TASK_ROLE and EXEC_ROLE) to: 1) call aws ecs
describe-services/describe-task-definition for the service named by SERVICE to
obtain its current taskRoleArn/executionRoleArn, 2) validate those ARNs
(non-empty and not "None"), 3) export those as outputs if valid, and 4) only set
outputs to the Api-borrowed TASK_ROLE/EXEC_ROLE when the validation fails so the
borrow is a fallback rather than an unconditional replacement.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate libboxlite_source input explicitly.

Any value other than exact 'build' silently routes to release mode (Line 84), which can accidentally use an outdated libboxlite.a. Add an early allowlist check (release|build) and fail fast on invalid values.

Proposed guard step

+      - name: Validate libboxlite_source
+        run: |
+          case "${{ inputs.libboxlite_source }}" in
+            release|build) ;;
+            *)
+              echo "::error::Invalid libboxlite_source='${{ inputs.libboxlite_source }}' (expected: release|build)"
+              exit 1
+              ;;
+          esac

Also applies to: 83-97

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-runner-binary.yml around lines 27 - 33, Add an
explicit allowlist validation step (e.g., "Validate libboxlite_source") that
reads the workflow input libboxlite_source and fails fast if its value is not
exactly "build" or "release"; ensure the step prints a clear error and exits
non‑zero so invalid values cannot silently fall through to the existing release
fallback logic that currently treats any non-"build" as release.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Trim whitespace when parsing services input.

services: "Proxy, SshGateway" currently leaves a leading space and treats SshGateway as unknown at Line 109. Trim each token before the case match.

Proposed parsing fix

           IFS=',' read -ra REQ <<<"$INPUT_SVCS"
           for s in "${REQ[@]}"; do
+              s="$(echo "$s" | xargs)"
               case "$s" in
                   Proxy)         SHOULD_DEPLOY[Proxy]=true ;;
                   OtelCollector) SHOULD_DEPLOY[OtelCollector]=true ;;

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if [ -n "${INPUT_SVCS:-}" ]; then
	# Explicit subset
	IFS=',' read -ra REQ <<<"$INPUT_SVCS"
	for s in "${REQ[@]}"; do
	case "$s" in
	Proxy) SHOULD_DEPLOY[Proxy]=true ;;
	OtelCollector) SHOULD_DEPLOY[OtelCollector]=true ;;
	SshGateway) SHOULD_DEPLOY[SshGateway]=true ;;
	*) echo "::warning::Unknown service in input: $s (ignored)" ;;
	esac
	done
	echo "Using workflow_dispatch services=$INPUT_SVCS"
	if [ -n "${INPUT_SVCS:-}" ]; then
	# Explicit subset
	IFS=',' read -ra REQ <<<"$INPUT_SVCS"
	for s in "${REQ[@]}"; do
	s="$(echo "$s" | xargs)"
	case "$s" in
	Proxy) SHOULD_DEPLOY[Proxy]=true ;;
	OtelCollector) SHOULD_DEPLOY[OtelCollector]=true ;;
	SshGateway) SHOULD_DEPLOY[SshGateway]=true ;;
	*) echo "::warning::Unknown service in input: $s (ignored)" ;;
	esac
	done
	echo "Using workflow_dispatch services=$INPUT_SVCS"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-app-services.yml around lines 101 - 112, The
parsing of INPUT_SVCS tokens leaves leading/trailing whitespace so values like "
SshGateway" don't match the case branches; trim each token before matching by
processing the loop variable (s) to remove whitespace (e.g., use parameter
expansion or a trim helper) before the case statement that checks Proxy,
OtelCollector, SshGateway; ensure you update the loop over REQ and the case
comparison to use the trimmed token so unknown-service warnings no longer occur
for tokens with surrounding spaces.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Avoid blanket secrets: inherit for these reusable deploy calls.

The called workflow uses OIDC and repo vars; inheriting all repository secrets unnecessarily expands exposure. Pass only explicitly required secrets (or none).

Also applies to: 160-165, 175-180

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 145-145: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-app-services.yml around lines 145 - 150, The
reusable workflow invocation using "uses:
./.github/workflows/_deploy-single-service.yml" currently includes "secrets:
inherit" which over-exposes repo secrets; remove "secrets: inherit" and instead
pass only the explicit secrets required by the called workflow (or omit the
secrets block if none are needed). Update each invocation of the reusable
workflow (e.g., the Proxy service call and the other similar invocations) to
replace "secrets: inherit" with a minimal "secrets:" mapping listing only the
specific secret names the called workflow expects (or delete the secrets key
entirely) so you limit scope to required values.

Source: Linters/SAST tools

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Assert exactly one boxlite-runner instance before deploying.

The query takes the first match only. If more than one running instance has tag:Name=boxlite-runner, deployment target becomes nondeterministic. Add a count check and fail unless exactly one instance is returned.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-runner.yml around lines 265 - 273, The
describe-instances invocation currently grabs the first match and assigns ID,
IP, SG; instead, run a preliminary describe-instances/--query to list all
matching instance IDs (using the same filter for tag:Name=boxlite-runner and
running state), count the results, and fail unless the count is exactly 1; then
proceed to fetch the single instance's ID/IP/SG (or call describe-instances
again with --instance-ids "$ID") so ID, IP, SG are deterministic. Ensure you
reference the current aws ec2 describe-instances command and the variables ID,
IP, SG in the check and emit an error if count != 1.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Do not disable SSH host authenticity checks in deploy path.

Line 346 disables host key verification, so a MITM can impersonate the EC2 host during SCP/SSH. Use a pinned host key/fingerprint and a real known_hosts file.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-runner.yml around lines 346 - 359, The SSH options
currently disable host key verification via SSH_OPTS and risk MITM; instead
remove "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" from
SSH_OPTS and ensure the deploy job creates/uses a real known_hosts containing
the EC2 host key (e.g., run ssh-keyscan or verify a pinned fingerprint into a
file and set SSH_OPTS to use "-o UserKnownHostsFile=/path/to/known_hosts -o
StrictHostKeyChecking=yes"); keep using KEY, IP, ARCHIVE, scp and
ssh/EXPECTED_SHA as before but add a step before scp/ssh to write the pinned
host key (or fingerprint) into the known_hosts file with proper permissions so
scp $SSH_OPTS "$ARCHIVE" "ubuntu@${IP}:/tmp/boxlite-runner.tar.gz" and ssh
$SSH_OPTS "ubuntu@${IP}" "EXPECTED_SHA='$EXPECTED_SHA' bash -s" will verify the
server identity.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

files=(".github/workflows/e2e-cloud.yml" ".github/workflows/e2e-cloud-test.yml")
for f in "${files[@]}"; do
  echo "===== $f ====="
  if [ ! -f "$f" ]; then
    echo "MISSING: $f"
    continue
  fi
  # Print just the lines containing `uses:` with their line numbers.
  rg -n --no-heading "^\s*-\s*uses:\s*" "$f" || true
  echo
  echo "---- context around first 5 matches (if any) ----"
  mapfile -t matches < <(rg -n --no-heading "^\s*-\s*uses:\s*" "$f" | head -n 5 | cut -d: -f1)
  if [ "${`#matches`[@]}" -gt 0 ]; then
    for ln in "${matches[@]}"; do
      start=$((ln-5)); end=$((ln+5))
      sed -n "${start},${end}p" "$f" | nl -ba | sed "s/^ *\\([0-9][0-9]*\\)\\t/  [ctx]  /"
      echo
    done
  fi
done

Repository: boxlite-ai/boxlite

Length of output: 311

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

f1=".github/workflows/e2e-cloud.yml"
f2=".github/workflows/e2e-cloud-test.yml"

for f in "$f1" "$f2"; do
  echo "===== $f ====="
  [ -f "$f" ] || { echo "MISSING: $f"; continue; }

  rg -n --no-heading "^\s*-\s*uses:\s*" "$f" || true
  echo
  echo "---- any uses that are tag-only (no commit SHA) ----"
  # Heuristic: look for "`@v`" or "@<major.minor>" patterns; exclude "@<40hex>".
  rg -n --no-heading "^\s*-\s*uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" "$f" || true
  rg -n --no-heading "^\s*-\s*uses:\s*[^@]+@[0-9]+\.[0-9]+\s*$" "$f" || true
  echo "---- uses with commit SHA (40 hex) ----"
  rg -n --no-heading "^\s*-\s*uses:\s*[^@]+@[0-9a-fA-F]{40}\s*$" "$f" || true

  echo
done

Repository: boxlite-ai/boxlite

Length of output: 575

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

files=(
  ".github/workflows/e2e-cloud.yml"
  ".github/workflows/e2e-cloud-test.yml"
)

for f in "${files[@]}"; do
  echo "===== $f (all uses:) ====="
  # Capture all occurrences of `uses:` with line numbers.
  rg -n --no-heading "^\s*uses:\s*.*$" "$f" || true
  echo
  echo "===== $f (uses in list items: - uses:) ====="
  rg -n --no-heading "^\s*-\s*uses:\s*.*$" "$f" || true
  echo
  # Extract around the specific line numbers mentioned in the original comment (if present).
  for ln in 61 64 100 101 338; do
    if [ "$ln" -ge 1 ]; then
      # show 5 lines before/after ln if file has that line
      line_count=$(wc -l < "$f")
      if [ "$ln" -le "$line_count" ]; then
        echo "===== $f (context around line $ln) ====="
        sed -n "$((ln-3)),$((ln+3))p" "$f" | nl -ba
      fi
    fi
  done
  echo "-------------------------------------------"
done

Repository: boxlite-ai/boxlite

Length of output: 615

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

show_context() {
  local f="$1" ln="$2" radius=4
  local total
  total=$(wc -l < "$f")
  if [ "$ln" -lt 1 ] || [ "$ln" -gt "$total" ]; then
    echo "  (line $ln out of range for $f; total $total)"
    return
  fi
  local start=$((ln-radius))
  if [ "$start" -lt 1 ]; then start=1; fi
  local end=$((ln+radius))
  if [ "$end" -gt "$total" ]; then end=$total; fi

  echo "  --- context $f around line $ln (showing $start..$end) ---"
  sed -n "${start},${end}p" "$f" | awk '{printf "  %4d: %s\n", NR+'$start'-1, $0}'
}

check_file() {
  local f="$1"
  echo "===== $f (all uses:) ====="
  rg -n --no-heading "^\s*uses:\s*.*$" "$f" || true
  echo

  echo "===== $f (uses in list items: - uses:) ====="
  rg -n --no-heading "^\s*-\s*uses:\s*.*$" "$f" || true
  echo

  echo "===== $f (tag-only heuristic: `@v`*) ====="
  rg -n --no-heading "^\s*-\s*uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" "$f" || true
  echo

  echo "===== $f (tag-only heuristic: @<major>.<minor>) ====="
  rg -n --no-heading "^\s*-\s*uses:\s*[^@]+@[0-9]+\.[0-9]+\s*$" "$f" || true
  echo

  echo "===== $f (commit SHA pinned: @<40 hex>) ====="
  rg -n --no-heading "^\s*-\s*uses:\s*[^@]+@[0-9a-fA-F]{40}\s*$" "$f" || true
  echo

  for ln in 61 64 100 101 338; do
    show_context "$f" "$ln"
  done
  echo "-------------------------------------------"
}

check_file ".github/workflows/e2e-cloud.yml"
check_file ".github/workflows/e2e-cloud-test.yml"

Repository: boxlite-ai/boxlite

Length of output: 6861

---

Pin GitHub Actions uses to immutable commit SHAs (supply-chain hardening).
Non-immutable tag references are used in multiple workflows:

• .github/workflows/e2e-cloud.yml (lines 100-101): actions/checkout@v5, dorny/paths-filter@v3
• .github/workflows/e2e-cloud-test.yml (lines 61, 64, 338): actions/checkout@v5, aws-actions/configure-aws-credentials@v4, actions/upload-artifact@v4

Replace each tag-only uses: value with the full 40-hex commit SHA.

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 100-100: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 100-100: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

---

[error] 101-101: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-cloud.yml around lines 100 - 101, Replace tag-only
GitHub Action references with immutable commit SHAs: find each uses entry for
actions/checkout@v5, dorny/paths-filter@v3,
aws-actions/configure-aws-credentials@v4, and actions/upload-artifact@v4 and
update them to the corresponding full 40-hex commit SHA for the desired release;
ensure the syntax remains uses: owner/repo@<40-hex-sha> and commit SHAs are
accurate and tested in CI before merging.

Source: Linters/SAST tools

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

e2e-cloud.yml documentation is out of sync with the actual workflow.

This section describes a 3-job changes/e2e/e2e-gate pattern and PR triggers, but the workflow currently has deploy sub-jobs (deploy_runner, deploy_api, deploy_app_services), no gate job, and no pull_request trigger. Please update this section to match the file behavior so branch-protection and operator expectations stay accurate.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/README.md around lines 226 - 237, Summary: The README
section for e2e-cloud.yml is stale and describes a different job/trigger layout
than the actual workflow. Update the "Architecture:" and "Triggers:" paragraphs
to reflect the current workflow: replace the described three-job
changes/e2e/e2e-gate pattern with the actual jobs (e.g., deploy_runner,
deploy_api, deploy_app_services and the e2e execution job names present in
e2e-cloud.yml) and remove references to a gate job that no longer exists; also
correct the "Triggers:" list to show the real triggers (add or remove
pull_request and include workflow_dispatch/push as present in the file). Ensure
you reference the exact job names found in e2e-cloud.yml (deploy_runner,
deploy_api, deploy_app_services, etc.) and keep the README wording concise so
branch-protection/operator expectations match the workflow.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate config files
ls -la apps/otel-collector || true
find apps/otel-collector -maxdepth 2 -type f \( -name "builder-config*.yaml" -o -name "project.json" \) -print

# Show relevant builder config YAMLs
echo "---- apps/otel-collector/builder-config.yaml ----"
sed -n '1,120p' apps/otel-collector/builder-config.yaml

echo "---- apps/otel-collector/builder-config.dev.yaml ----"
sed -n '1,160p' apps/otel-collector/builder-config.dev.yaml

echo "---- apps/otel-collector/project.json ----"
sed -n '1,200p' apps/otel-collector/project.json

# Find builder code that reads builder-config.yaml
echo "---- Searching for builder-config usage ----"
rg -n "builder-config\.ya?ml" -S . || true

echo "---- Searching for 'exporter' path key usage ----"
rg -n "path:\s*apps/otel-collector/exporter|path:\s*otel-collector/exporter|exporter" -S apps/otel-collector . || true

# Identify any "builder" script/binary entry points
echo "---- Searching for nx/ts scripts referencing otel-collector builder ----"
rg -n "otel-collector.*builder|builder.*otel-collector" -S . || true

# List builder package or scripts near otel-collector
echo "---- Tree (shallow) under apps/otel-collector ----"
find apps/otel-collector -maxdepth 3 -type f -print | sed -n '1,200p'

Repository: boxlite-ai/boxlite

Length of output: 42467

---

🌐 Web query:

go.opentelemetry.io/collector/cmd/builder exporters path relative to config directory or working directory

💡 Result:

go.opentelemetry.io/collector/cmd/builder: the exporters[].path (module path values used for generated go.mod replace directives) is resolved relative to the builder process’s current working directory (CWD) when the manifest/module path is given as a relative path; internally it calls filepath.Abs(mod.Path), which “replaces it with current path "."” (i.e., CWD) [1]. Then, depending on builder configuration, the resulting path is either: 1) kept absolute for the replace directive when Distribution.UseAbsoluteReplacePaths is true (mod.Path = absPath) [2], or 2) converted to a path relative to the builder output directory (Distribution.OutputPath) via filepath.Rel(absOutputPath, absPath) (so the generated go.mod replace points to a path relative to the dist output dir) when UseAbsoluteReplacePaths is false [2]. So the answer is: - Relative paths in the builder YAML (e.g., exporters/receivers/processors module path fields) are interpreted against the working directory of the ocb/builder process, not against the config file directory [1]. - After interpretation, builder may rewrite the path to be relative to the output directory for portability in the generated module replaces (default behavior when UseAbsoluteReplacePaths is false) [2]. Implication: if you run ocb --config some/path/ocb.yaml from a different directory, and your path: entries are relative, they will be resolved using that run-time CWD; to make results independent of where you run from, you should either supply absolute paths or configure builder to generate relative replace paths to the output directory (and/or adjust your manifest paths accordingly) [1][2].

Citations:

• 1: https://github.com/open-telemetry/opentelemetry-collector/blob/c74f90fe/cmd/builder/internal/builder/config.go
• 2: https://github.com/open-telemetry/opentelemetry-collector/blob/00864cf7/cmd/builder/internal/builder/config.go

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Find other nx:run-commands usages to infer default cwd usage/patterns
rg -n '"executor"\s*:\s*"nx:run-commands"' -S apps . || true
rg -n '"executor"\s*:\s*"nx:run-commands"' -S . || true

# Show nx version (if present)
ls -la nx.json package.json 2>/dev/null || true
cat package.json 2>/dev/null | sed -n '1,120p' || true
cat nx.json 2>/dev/null | sed -n '1,160p' || true

Repository: boxlite-ai/boxlite

Length of output: 10204

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect Nx configuration files
ls -la . | head -n 50
ls -la apps | head -n 50
ls -la nx.json 2>/dev/null || true

echo "---- cat apps/nx.json (relevant parts) ----"
sed -n '1,260p' apps/nx.json

# Search for any run-commands cwd settings
echo "---- rg 'run-commands' 'cwd' in nx configs ----"
rg -n "run-commands|cwd|workingDirectory" apps/nx.json nx.json package.json . || true

Repository: boxlite-ai/boxlite

Length of output: 35760

---

🌐 Web query:

nx run-commands executor default working directory cwd when not specified

💡 Result:

When using the Nx run-commands executor, if the cwd (current working directory) option is not specified, the command runs in the workspace root [1][2]. Technical details regarding the cwd behavior: * Default Behavior: If cwd is omitted, Nx defaults to the root directory of the workspace [1][3]. * Customizing the Directory: You can specify a custom cwd by providing a string path in the executor options [1]. * Relative paths: Paths are treated as relative to the workspace root [1][3]. * Absolute paths: If an absolute path is provided, the command will execute in that specific location [1][3]. * Dynamic Configuration: To make the cwd dynamic—for example, to ensure commands always run within a project's own directory—you can use the {projectRoot} token [2][4]. This is commonly configured in the nx.json file under targetDefaults to apply consistent behavior across projects [4]. Example of setting cwd to the project root in nx.json: "targetDefaults": { "my-target": { "options": { "cwd": "{projectRoot}" } } }

Citations:

• 1: https://nx.dev/docs/reference/nx/executors
• 2: run-commands executor uses wrong working directory nrwl/nx#26928
• 3: https://github.com/nrwl/nx/blob/95621cd3/packages/nx/src/executors/run-commands/running-tasks.ts
• 4: https://stackoverflow.com/questions/78706658/is-there-a-way-to-configure-nx-to-always-run-tasks-from-the-project-root-rather

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Check scripts/CI for how nx is invoked and from which directory.
echo "---- root package.json scripts ----"
cat package.json | sed -n '1,160p'

echo "---- apps/package.json scripts (likely where nx commands live) ----"
cat apps/package.json | sed -n '1,220p'

echo "---- Find nx commands in repo ----"
rg -n "nx(\\s|\\$|run|build|test|serve)" package.json apps/package.json .github scripts Makefile -S || true

echo "---- Check for nx.json at repo root or other locations ----"
find . -maxdepth 3 -name "nx.json" -print

Repository: boxlite-ai/boxlite

Length of output: 15035

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Search CI/workflows for otel-collector build commands and their working directory
rg -n "otel-collector|boxlite-otel-collector" .github/workflows scripts Makefile apps/README* README* -S || true

# Look for where nx is invoked (from apps/ or repo root)
rg -n "yarn (nx|npx nx)|nx run .*otel-collector|nx run .*otel" .github/workflows Makefile scripts . -S || true

# Inspect workflow(s) that likely run builds
ls -la .github/workflows | head
find .github/workflows -maxdepth 1 -type f -print | sed -n '1,200p'

# Grep for "working-directory" hints
rg -n "working-directory:.*apps|working-directory:.*" .github/workflows -S || true

Repository: boxlite-ai/boxlite

Length of output: 5375

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---- apps/otel-collector/Dockerfile (WORKDIR / build context) ----"
sed -n '1,120p' apps/otel-collector/Dockerfile

echo "---- .github/workflows/build-go.yml ----"
sed -n '1,220p' .github/workflows/build-go.yml

echo "---- .github/workflows/build-node.yml ----"
sed -n '1,260p' .github/workflows/build-node.yml

echo "---- .github/workflows/build-c.yml ----"
sed -n '1,260p' .github/workflows/build-c.yml

echo "---- .github/workflows/build-runtime.yml (nx invocation?) ----"
sed -n '180,360p' .github/workflows/build-runtime.yml

echo "---- .github/workflows/api-client-drift.yml (where nx run) ----"
sed -n '1,130p' .github/workflows/api-client-drift.yml

Repository: boxlite-ai/boxlite

Length of output: 35686

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n "nx build otel-collector|nx run .*otel-collector|otel-collector\".*nx" . -S || true
rg -n "builder-config\.yaml" apps -S || true

Repository: boxlite-ai/boxlite

Length of output: 332

---

Fix inconsistent relative exporter path resolution for cmd/builder

apps/otel-collector/builder-config.yaml sets exporters[].path: apps/otel-collector/exporter, while apps/otel-collector/builder-config.dev.yaml uses path: otel-collector/exporter. The builder resolves these relative path values against the builder process CWD (Nx run-commands defaults CWD to the Nx workspace root), so one of the configs will break depending on where Nx is invoked from (repo root vs apps/).
Update both builder-config YAMLs to use the same path base (e.g., make both relative to an explicitly-set Nx cwd, or use absolute paths).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/otel-collector/builder-config.yaml` at line 9, The exporters.path value
is inconsistent between builder-config.yaml and builder-config.dev.yaml which
causes relative resolution to break depending on Nx cwd; update the
exporters[].path in both apps/otel-collector/builder-config.yaml and
apps/otel-collector/builder-config.dev.yaml to the same canonical form (either
both use an absolute path from repo root or both use the same relative base) so
the cmd/builder resolves identically; locate the exporters entry
(exporters[].path) in each YAML and replace the differing values (e.g., change
"apps/otel-collector/exporter" and "otel-collector/exporter" to a single
consistent path) or alternatively set and document an explicit Nx cwd for the
builder invocation.