chore: add Cloud Agent dev environment config - #16
donny-devops wants to merge 2 commits into
Conversation
Co-authored-by: Adonis Jimenez <donny-devops@users.noreply.github.com>
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 2 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy clear (success) Scanned 2 changed file(s). No taxonomy bucket signals were detected. Scanned 2 changed file(s). No PR taxonomy bucket signals were detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 2 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 2 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
There was a problem hiding this comment.
Summary
This PR adds Cloud Agent development environment configuration for the FastAPI starter kit. The setup automates dependency installation and server startup, which improves the development experience.
Critical Issues Identified
Two crash scenarios were identified in the install.sh script where missing files (requirements.txt and .env.example) would cause the script to fail with unclear errors due to the set -euo pipefail setting. Both issues have been flagged with suggested fixes that add explicit file existence checks and graceful error handling.
After addressing these issues, the configuration should provide a robust and reliable development environment setup.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| if [ ! -f .env ]; then | ||
| cp .env.example .env | ||
| fi |
There was a problem hiding this comment.
🛑 Crash Risk: Script will exit with unclear error if .env.example is missing. Add explicit check before copying template file.
| if [ ! -f .env ]; then | |
| cp .env.example .env | |
| fi | |
| # Provide a local .env from the template on first setup (never overwrite an existing one). | |
| if [ ! -f .env ] && [ -f .env.example ]; then | |
| cp .env.example .env | |
| elif [ ! -f .env ]; then | |
| echo "Warning: .env.example not found, skipping .env creation" | |
| fi |
| source .venv/bin/activate | ||
|
|
||
| python -m pip install --upgrade pip | ||
| pip install -r requirements.txt |
There was a problem hiding this comment.
🛑 Crash Risk: Script will exit with unclear error if requirements.txt is missing. Add explicit check before installing dependencies.
| pip install -r requirements.txt | |
| if [ -f requirements.txt ]; then | |
| pip install -r requirements.txt | |
| else | |
| echo "Warning: requirements.txt not found, skipping dependency installation" | |
| fi |
trivy-action@v0.28.0 referenced the deleted setup-trivy@v0.2.1 tag, causing 'unable to resolve action' failures during job setup. v0.36.0 pins setup-trivy by commit SHA, so nested resolution succeeds. Co-authored-by: Adonis Jimenez <donny-devops@users.noreply.github.com>
ECC Tools / Security EvidenceCommit: Security evidence gate passed (success) No security-sensitive scanner-evidence gap detected. Mode: enforce Scanned 3 changed file(s). No missing scanner-evidence signal was detected. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Risk TaxonomyCommit: PR taxonomy review recommended (neutral) Detected 2 PR taxonomy bucket(s): Security Evidence, CI/CD Recommendation. Scanned 3 changed file(s). Roadmap taxonomy buckets: Security EvidenceSecurity-sensitive changes should carry explicit scanner, code-scanning, or focused regression evidence. Signals:
Paths:
CI/CD RecommendationCI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work. Signals:
Paths:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Reference Set ReadinessCommit: Reference set readiness gaps detected (neutral) Reference evidence present for 0/7 areas (0%) across 3 changed file(s). This check is based on files changed in this PR. Repository-level readiness is still reported by
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / Hosted Promotion ReadinessCommit: Hosted promotion readiness passed (success) No hosted promotion evidence gaps detected across 3 changed file(s); 0 corpus scenarios had matching evidence. This check compares PR file changes against the evaluator/RAG promotion corpus in No evaluator corpus scenarios matched this PR. Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Config AuditCommit: No changed-config issues detected (success) Scanned 1 config file(s) present at this commit across 1 changed config path(s) and found no issues in the supported security rules. Changed config files:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
ECC Tools / PR Harness AuditCommit: No harness issues detected (success) Scanned 1 changed config file(s) and found no harness issues. Changed config files:
Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission. |
Summary
Two things:
main).Changes
Dev environment
.cursor/environment.json— declares the environment: runsinstall.shon setup, exposes port8000, and launches auvicorndev server (with--reload) in a persistent terminal..cursor/install.sh— idempotent bootstrap that installspython3.12-venvif missing (the default image ships Python 3.12 withoutensurepip), creates.venv, installsrequirements.txt, and seeds.envfrom.env.exampleon first run (never overwriting an existing.env).CI fix
.github/workflows/ci.yml— bumpedaquasecurity/trivy-action@v0.28.0→@v0.36.0, pinned by commit SHA (ed142fd).Root cause:
trivy-action@v0.28.0'saction.yamlreferencedaquasecurity/setup-trivy@v0.2.1by tag. That tag was deleted upstream (onlyv0.2.6,v0.3.0,v0.3.1, ... remain), so GitHub Actions failed at Set up job withUnable to resolve action aquasecurity/setup-trivy@v0.2.1, unable to find version v0.2.1before any step ran.v0.36.0pinssetup-trivyby commit SHA internally, so nested resolution succeeds.Verification
Dev environment (in the Cloud Agent VM):
pytest— 74 passed;ruff check ./ruff format --check .— clean.uvicorn main:appserved live requests:GET /health→200, user/item CRUD,409on duplicate email,GET /ops/route?country=JP→shard_apac_01/NRT,404on missing user.CI fix (GitHub Actions on this PR):
Note:
/docs(Swagger UI) loads its assets from an external CDN blocked by the environment egress policy, so it does not render in-browser here. The API itself is fully functional, as shown above.