The backend now has a global AuthGateMiddleware: every data route
(workspaces/lookup, upload-agent, sse/...) requires auth, returning
401 {"detail":"authentication required"} otherwise. CI authenticates with
the service token via the X-Admin-Token header (proxies any user_id).
- run_agent_api.py: read ADMIN_API_TOKEN from env, attach X-Admin-Token to
both httpx clients (all lookup/upload/sse/action/cancel calls); warn if unset
- run-agent.yml: inject ADMIN_API_TOKEN from Gitea repo secret
- Gitea repo secret ADMIN_API_TOKEN registered
- TEST_WORKFLOW.md / .env.example: document ADMIN_API_TOKEN (.env local, secret in CI)
Verified end-to-end: workspaces/lookup for user_id=jhogyu now resolves
(401 -> 200), e.g. Aug_2026_Test -> 3523fa2b-...
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
user_id is now a required workflow_dispatch input (no default) and the
runner validates it is non-empty before doing anything. Removed the
'jsahn' default from the script arg and replaced jsahn with <user_id>
placeholders throughout TEST_WORKFLOW.md so the workflow is not pinned
to one account.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add workspace_name input; the runner resolves it to a workspace_id through
GET {api_base}/workspaces/lookup?user_id=... before uploading the agent.
workspace_id remains as an explicit override. Name matching is NFC-normalized
(handles Korean NFD/NFC) with a case-insensitive fallback, and a no-match
error lists the available workspace names. Requires one of name/id.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Gitea Actions only supports the v3 artifact protocol; upload-artifact@v4
uses the @actions/artifact v2 API which Gitea (identifying as GHES) rejects
with GHESNotSupportedError. The agent run step itself succeeds; only the
artifact upload was failing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
localhost:8800 fails because act_runner job containers run in their own
network namespace. Point api_base at the backend container on the shared
docker network (http://agent-backend:8000). Requires the runner's
config.yaml container.network to be set to the backend's docker network.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The public URL (legalpoc.eroomai.com) sits behind a Google OAuth proxy,
so CI requests get 302-redirected to the login page. Point api_base at the
internal backend (http://localhost:8800, served at root without /api prefix)
which the act_runner reaches on the same host. Documents host.docker.internal
and Tailscale fallbacks for containerized runners.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jsahnandClaude Opus 4.8