[MarkusNeusinger]

Summary

• Cloud Build refused the renderer deploy for PB-2a (feat(agents): serve plotly and bokeh in the agent chat (PB-2a) #12490) before its first step ran: invalid build: invalid .steps field: build step 7 arg 1 too long (max: 10000) (build dc1cf3ae, 2026-11-01). The inline smoke step had reached 11,347 characters with the plotly probe; the agents service deployed (it now offers plotly and bokeh to the admin) while the renderer kept its PB-1 revision, without PB-2a's figure-markup checks.
• The render probes (matplotlib, Makie, Chart.js, plotly, data run) move unchanged into agents/renderer/deploy_smoke.sh; only Cloud Build's $$ escapes become $ (a normalised line diff against the removed inline text is identical). The step keeps the candidate double read, the anonymous-403 check, the token mint and /status, and calls the script with the token in the environment. The step's argument is now 3,606 characters.
• tests/unit/test_cloudbuild_configs.py keeps every step argument of every Cloud Build config at or under 10,000 characters (it fails on main's renderer config), and ci-tests.yml runs the unit tests when a Cloud Build config or the script changes.

Plan

N/A (incident fix after the PB-2a merge).

Test plan

• pytest tests/unit tests/integration -n 4: 25,800 passed, 141 skipped.
• New tests: the step calls the script once, after /status, with the token through the environment; the script runs end to end against a fake curl (all five probes pass and send the token; a plotly render that fails twice exits non-zero and skips the data run); the plotly probe writes a valid RenderRequest.
• The limit test reports step 7 (smoke) arg 1: 11347 characters on main's config.
• Gemini 3.8 Flash pre-PR check: sound with changes, 3 low findings. Applied: the fake curl rejects unknown flags; the script is executable. Not applied: a 9,000-character margin, because app/cloudbuild.yaml already has a 9,895-character argument; moving that one is a separate follow-up.
• After the merge: deploy-renderer passes its smoke on Cloud Run (Makie, Chart.js and plotly gates) and promotes; then the site smoke.

No live loop exists for Cloud Build configs; the deploy after the merge is the first real run of the script.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🟡 Changes recommended

The test’s shallow discovery pattern can miss deeply nested Cloud Build configurations, leaving the advertised coverage incomplete.

1 open issue

• Search recursively for Cloud Build configs · New

What changed in this PR

This pull request fixes the renderer deployment failure caused by Cloud Build’s 10,000-character step-argument limit by moving the deploy smoke probes into a standalone script while preserving the existing validation and promotion gates.

Changes:

• Added agents/renderer/deploy_smoke.sh with matplotlib, Makie, Chart.js, Plotly, and data-run probes.
• Updated the renderer Cloud Build configuration to invoke the script with the token supplied through the environment.
• Added smoke-script and Cloud Build argument-limit tests.
• Updated CI path detection, documentation, and the changelog.

File	Summary	Final review notes
tests/​unit/​test_cloudbuild_configs.py	Verifies Cloud Build step arguments remain within platform limits.	Moderate, 2 votes: Make config discovery recursive so nested Cloud Build configurations cannot be omitted from coverage.
tests/​unit/​agents/​test_image.py	Tests probe contents, ordering, token forwarding, request construction, and failure handling.	—
docs/​concepts/​agent-network.md	Documents the expanded renderer smoke process and script-based deployment flow.	Nit, 1 vote: Update the renderer section of agents/README.md so it no longer conflicts with the expanded smoke behavior.
changelog.d/​renderer-smoke-script.md	Records the renderer deployment fix.	Nit, 1 vote: Remove (#12497) from the fragment so release tooling can append the pull request reference.
agents/​renderer/​deploy_smoke.sh	Hosts the renderer deployment smoke probes and retry behavior.	Moderate, 1 vote: Avoid expanding the token into curl arguments; pass the header through a configuration file descriptor to prevent exposure through process arguments.
agents/​renderer/​cloudbuild.yaml	Replaces the oversized inline smoke step with the external script invocation.	—
.github/​workflows/​ci-tests.yml	Runs tests when Cloud Build configurations or the smoke script change.	—

_{Review effort: Lite}