|
| 1 | +# Install databricks-bot-engine (pinned REF) + the Claude Agent SDK/CLI. |
| 2 | +# |
| 3 | +# WHY THIS IS A LOCAL COMPOSITE (not `uses: databricks/databricks-bot-engine/...`): |
| 4 | +# databricks-sql-python cannot reference the engine's actions/reusable workflows |
| 5 | +# cross-repo — GitHub fails with "Unable to resolve action ..., not found" (the |
| 6 | +# internal engine repo's Actions aren't consumable from an external repo; adbc's |
| 7 | +# workflows note the same: "a cross-repo `uses:` of the hub's internal composite |
| 8 | +# action does NOT work"). So we do NOT `uses:` engine actions. Instead this local |
| 9 | +# action `pip install`s the engine over HTTPS with a token — a plain clone, which |
| 10 | +# an external repo CAN do — inlining what the engine's own install-bot-engine |
| 11 | +# action does in REF mode. Keep in sync with that action at the pinned engine SHA. |
| 12 | +# |
| 13 | +# Auth is PAT-FREE: the caller passes a short-lived, engine-scoped GitHub App |
| 14 | +# installation token as `engine-token` (minted from the bot App creds). It slots |
| 15 | +# into the same git auth path a PAT would; nothing stored/long-lived. |
| 16 | +name: Install bot engine (local) |
| 17 | +description: pip-install the pinned databricks-bot-engine + Claude Agent SDK/CLI, PAT-free (engine-scoped App token). |
| 18 | + |
| 19 | +inputs: |
| 20 | + engine-ref: |
| 21 | + description: 'Engine commit SHA (full 40-char) to install.' |
| 22 | + required: true |
| 23 | + engine-repo: |
| 24 | + description: 'owner/name of the engine repo.' |
| 25 | + required: false |
| 26 | + default: 'databricks/databricks-bot-engine' |
| 27 | + engine-token: |
| 28 | + description: 'Short-lived engine-scoped GitHub App installation token (contents:read). Authenticates the private-engine clone; no stored PAT.' |
| 29 | + required: true |
| 30 | + use-jfrog: |
| 31 | + description: 'Route pip/npm through the internal JFrog mirror (egress-blocked runners). Requires id-token: write on the job.' |
| 32 | + required: false |
| 33 | + default: 'true' |
| 34 | + sdk-version: |
| 35 | + description: 'claude-agent-sdk version. Keep in sync with the engine at the pinned SHA.' |
| 36 | + required: false |
| 37 | + default: '0.2.102' |
| 38 | + cli-version: |
| 39 | + description: '@anthropic-ai/claude-code version. Keep in sync with the engine at the pinned SHA.' |
| 40 | + required: false |
| 41 | + default: '2.1.61' |
| 42 | + |
| 43 | +runs: |
| 44 | + using: composite |
| 45 | + steps: |
| 46 | + - name: Configure JFrog mirror (pip + npm) |
| 47 | + if: inputs.use-jfrog == 'true' |
| 48 | + shell: bash |
| 49 | + run: | |
| 50 | + set -euo pipefail |
| 51 | + # Keyless: mint a GitHub OIDC token, exchange it for a short-lived JFrog |
| 52 | + # access token (the protected runner group is egress-blocked from |
| 53 | + # pypi.org / registry.npmjs.org). Requires the job to grant id-token: write. |
| 54 | + ID_TOKEN=$(curl -sLS \ |
| 55 | + -H "User-Agent: actions/oidc-client" \ |
| 56 | + -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ |
| 57 | + "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"') |
| 58 | + echo "::add-mask::${ID_TOKEN}" |
| 59 | + # Fail fast HERE if the OIDC mint failed (jq prints `null` for a missing |
| 60 | + # .value; a request error yields empty), so the diagnostic points at the |
| 61 | + # real cause instead of surfacing later as a misleading "could not extract |
| 62 | + # JFrog access token" from the exchange below. |
| 63 | + if [ -z "$ID_TOKEN" ] || [ "$ID_TOKEN" = "null" ]; then |
| 64 | + echo "::error::Could not mint GitHub OIDC token (is id-token:write granted?)"; exit 1 |
| 65 | + fi |
| 66 | + ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \ |
| 67 | + "https://databricks.jfrog.io/access/api/v1/oidc/token" \ |
| 68 | + -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"') |
| 69 | + echo "::add-mask::${ACCESS_TOKEN}" |
| 70 | + if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then |
| 71 | + echo "::error::Could not extract JFrog access token (is id-token:write granted?)"; exit 1 |
| 72 | + fi |
| 73 | + echo "PIP_INDEX_URL=https://gha-service-account:${ACCESS_TOKEN}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV" |
| 74 | + cat > ~/.npmrc << EOF |
| 75 | + registry=https://databricks.jfrog.io/artifactory/api/npm/db-npm/ |
| 76 | + //databricks.jfrog.io/artifactory/api/npm/db-npm/:_authToken=${ACCESS_TOKEN} |
| 77 | + always-auth=true |
| 78 | + EOF |
| 79 | + echo "JFrog mirror configured for pip + npm" |
| 80 | +
|
| 81 | + - name: Install engine (pinned REF) + Claude SDK/CLI |
| 82 | + shell: bash |
| 83 | + env: |
| 84 | + ENGINE_REF: ${{ inputs.engine-ref }} |
| 85 | + ENGINE_REPO: ${{ inputs.engine-repo }} |
| 86 | + ENGINE_TOKEN: ${{ inputs.engine-token }} |
| 87 | + SDK_VERSION: ${{ inputs.sdk-version }} |
| 88 | + CLI_VERSION: ${{ inputs.cli-version }} |
| 89 | + run: | |
| 90 | + set -euo pipefail |
| 91 | + # Supply-chain: require a full 40-char commit SHA (immutable pin). `case` |
| 92 | + # globs match the whole string, so an embedded newline is rejected too. |
| 93 | + case "$ENGINE_REF" in |
| 94 | + *[!0-9a-f]* | "") |
| 95 | + echo "::error::engine-ref must be a full 40-char commit SHA, got '$ENGINE_REF'"; exit 1 ;; |
| 96 | + esac |
| 97 | + if [ "${#ENGINE_REF}" -ne 40 ]; then |
| 98 | + echo "::error::engine-ref must be a full 40-char commit SHA, got '$ENGINE_REF'"; exit 1 |
| 99 | + fi |
| 100 | + if [ -z "$ENGINE_TOKEN" ]; then |
| 101 | + echo "::error::engine-token is required (engine repo is private)"; exit 1 |
| 102 | + fi |
| 103 | + # Supply the token via a git extraheader, NOT in the URL handed to pip: |
| 104 | + # pip echoes the requirement spec (incl. any in-URL credential) in normal |
| 105 | + # and error output where Actions masking is not guaranteed. The header |
| 106 | + # lives only in a JOB-LOCAL git config for this job. Mask the token + its |
| 107 | + # base64 form defensively. |
| 108 | + echo "::add-mask::${ENGINE_TOKEN}" |
| 109 | + BASIC=$(printf 'x-access-token:%s' "$ENGINE_TOKEN" | base64 | tr -d '\n') |
| 110 | + echo "::add-mask::${BASIC}" |
| 111 | + export GIT_CONFIG_GLOBAL="${RUNNER_TEMP:-/tmp}/bot-engine-gitconfig-$$" |
| 112 | + : > "$GIT_CONFIG_GLOBAL" |
| 113 | + trap 'git config --global --unset-all "http.https://github.com/.extraheader" || true; rm -f "$GIT_CONFIG_GLOBAL"' EXIT |
| 114 | + git config --global "http.https://github.com/.extraheader" "Authorization: Basic ${BASIC}" |
| 115 | + python -m pip install --upgrade pip |
| 116 | + # REF mode resolves the published engine's deps unpinned + installs the |
| 117 | + # SDK/CLI by version (a consumer can't see the engine's hash-locked |
| 118 | + # requirements). SDK_VERSION/CLI_VERSION track the engine at ENGINE_REF. |
| 119 | + pip install "databricks-bot-engine @ git+https://github.com/${ENGINE_REPO}@${ENGINE_REF}" |
| 120 | + pip install "claude-agent-sdk==${SDK_VERSION}" |
| 121 | + npm install -g "@anthropic-ai/claude-code@${CLI_VERSION}" |
| 122 | + echo "$(npm prefix -g)/bin" >> "$GITHUB_PATH" |
0 commit comments