ci: [validation] Same-repo CI run for #1095

.github/workflows/ci.yml

@@ -12,9 +12,6 @@ permissions:
 
 env:
   PYTHONUTF8: 1
-  # Windows runners can't reach public PyPI or npm; they install through JFrog.
-  WINDOWS_PACKAGE_INDEX: https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
-  WINDOWS_NPM_REGISTRY: https://databricks.jfrog.io/artifactory/api/npm/db-npm/
 
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name }}
@@ -41,16 +38,13 @@ jobs:
       - run: just lint
 
   test:
-    name: Unit tests · ${{ matrix.os == 'windows-server-latest' && 'Windows' || 'Linux' }}
+    name: Unit tests · ${{ matrix.os == 'windows-latest' && 'Windows' || 'Linux' }}
     runs-on: ${{ matrix.os }}
     needs: lint
-    permissions:
-      contents: read
-      id-token: write
     strategy:
       fail-fast: false
       matrix:
-        os: ${{ fromJSON((github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }}
+        os: [ubuntu-latest, windows-latest]
     defaults:
       run:
         shell: bash
@@ -64,23 +58,8 @@ jobs:
         with:
           persist-credentials: false
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
-      - name: Authenticate to JFrog with GitHub OIDC
-        id: jfrog
-        if: ${{ runner.os == 'Windows' }}
-        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5  # v4.9.1
-        env:
-          JF_URL: https://databricks.jfrog.io
-        with:
-          oidc-provider-name: github-actions
       - name: Install dependencies
-        env:
-          UV_INDEX_DATABRICKS_PYPI_USERNAME: ${{ steps.jfrog.outputs.oidc-user }}
-          UV_INDEX_DATABRICKS_PYPI_PASSWORD: ${{ steps.jfrog.outputs.oidc-token }}
         run: |
-          if [[ "$RUNNER_OS" == Windows ]]; then
-            unset UV_INDEX_URL
-            export UV_DEFAULT_INDEX="databricks-pypi=$WINDOWS_PACKAGE_INDEX"
-          fi
           uv lock
           uv sync
       - run: uv run --no-sync pytest --ignore=tests/test_e2e.py
@@ -109,21 +88,18 @@ jobs:
           uv run pytest tests/native_claude/test_mod.py -q
 
   e2e-shards:
-    name: ${{ matrix.name }} · ${{ matrix.os == 'windows-server-latest' && 'Windows' || 'Linux' }}
+    name: ${{ matrix.name }} · ${{ matrix.os == 'windows-latest' && 'Windows' || 'Linux' }}
     runs-on: ${{ matrix.os }}
     needs: lint
     # The merge queue runs only lint and unit tests; e2e already ran on the PR.
     if: ${{ github.event_name != 'merge_group' }}
-    permissions:
-      contents: read
-      id-token: write
     defaults:
       run:
         shell: bash
     strategy:
       fail-fast: false
       matrix:
-        os: ${{ fromJSON((github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && '["ubuntu-latest", "windows-server-latest"]' || '["ubuntu-latest"]') }}
+        os: [ubuntu-latest, windows-latest]
         group: [gateway, claude, codex, gemini, opencode, copilot, pi]
         include:
           - group: gateway
@@ -183,37 +159,11 @@ jobs:
         run: |
           test -f "$RUNNER_TEMP/.bin/databricks.exe"
           cygpath -w "$RUNNER_TEMP/.bin" >> "$GITHUB_PATH"
-      - name: Authenticate to JFrog with GitHub OIDC
-        id: jfrog
-        if: ${{ runner.os == 'Windows' }}
-        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5  # v4.9.1
-        env:
-          JF_URL: https://databricks.jfrog.io
-        with:
-          oidc-provider-name: github-actions
       - name: Install the shard's agent CLI
         if: ${{ matrix.package != '' }}
-        env:
-          NPM_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
-        run: |
-          if [[ "$RUNNER_OS" == Windows ]]; then
-            npmrc="$RUNNER_TEMP/jfrog.npmrc"
-            printf 'registry=%s\n//%s:_authToken=%s\n' \
-              "$WINDOWS_NPM_REGISTRY" "${WINDOWS_NPM_REGISTRY#https://}" "$NPM_TOKEN" > "$npmrc"
-            npm install -g --userconfig "$npmrc" "$AGENT_PACKAGE"
-            rm "$npmrc"
-          else
-            npm install -g "$AGENT_PACKAGE"
-          fi
+        run: npm install -g "$AGENT_PACKAGE"
       - name: Install ug and test dependencies
-        env:
-          UV_INDEX_DATABRICKS_PYPI_USERNAME: ${{ steps.jfrog.outputs.oidc-user }}
-          UV_INDEX_DATABRICKS_PYPI_PASSWORD: ${{ steps.jfrog.outputs.oidc-token }}
         run: |
-          if [[ "$RUNNER_OS" == Windows ]]; then
-            unset UV_INDEX_URL
-            export UV_DEFAULT_INDEX="databricks-pypi=$WINDOWS_PACKAGE_INDEX"
-          fi
           uv lock
           uv tool install .
           uv sync
@@ -240,9 +190,6 @@ jobs:
     needs: lint
     # The condition runs integration tests only if lint passes and the overall workflow is not cancelled.
     if: ${{ github.event_name != 'merge_group' && needs.lint.result == 'success' && !cancelled() }}
-    permissions:
-      contents: read
-      id-token: write
     uses: ./.github/workflows/integration.yml
     secrets: inherit  # zizmor: ignore[secrets-inherit] same-repo workflow that needs nearly every secret
 

.github/workflows/integration.yml

@@ -54,9 +54,6 @@ env:
   CODEX_VERSION: ${{ inputs.codex_version || '0.154.0' }}
   OPENCODE_VERSION: ${{ inputs.opencode_version || '1.18.31' }}
   PACKAGE_INDEX: ${{ inputs.default_index || 'https://pypi.org/simple' }}
-  # Windows runners install packages through the Databricks JFrog proxies.
-  WINDOWS_PACKAGE_INDEX: https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
-  WINDOWS_NPM_REGISTRY: https://databricks.jfrog.io/artifactory/api/npm/db-npm/
 
 jobs:
   installation:
@@ -98,15 +95,8 @@ jobs:
 
   installation-windows:
     name: Windows installation tests
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-    runs-on: windows-server-latest
+    runs-on: windows-latest
     timeout-minutes: 20
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      PACKAGE_INDEX: https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
-      NPM_REGISTRY: https://databricks.jfrog.io/artifactory/api/npm/db-npm/
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
@@ -120,31 +110,16 @@ jobs:
         with:
           version: 0.9.8
           enable-cache: ${{ inputs.ref == '' }}
-      - name: Authenticate to JFrog with GitHub OIDC
-        id: jfrog
-        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5  # v4.9.1
-        env:
-          JF_URL: https://databricks.jfrog.io
-        with:
-          oidc-provider-name: github-actions
       - name: Test a fresh installed package without workspace credentials
         shell: pwsh
-        env:
-          # uv 0.9.8 resolves credentials for the named default index from
-          # UV_INDEX_<NAME>_USERNAME/PASSWORD without placing them in its URL.
-          UV_DEFAULT_INDEX: databricks-pypi=${{ env.PACKAGE_INDEX }}
-          UV_INDEX_DATABRICKS_PYPI_USERNAME: ${{ steps.jfrog.outputs.oidc-user }}
-          UV_INDEX_DATABRICKS_PYPI_PASSWORD: ${{ steps.jfrog.outputs.oidc-token }}
-          UG_INTEGRATION_NPM_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
         run: |
           $output = Join-Path $env:RUNNER_TEMP "ug-integration"
           $runnerArgs = @(
             "--python", "3.12",
             "--ug-version", $env:UG_VERSION,
             "--entry-point", $env:ENTRY_POINT,
             "--claude-version", $env:CLAUDE_VERSION,
-            "--default-index", $env:UV_DEFAULT_INDEX,
-            "--npm-registry", $env:NPM_REGISTRY,
+            "--default-index", $env:PACKAGE_INDEX,
             "--installation-only",
             "--output", $output
           )
@@ -187,21 +162,18 @@ jobs:
           PY
 
   smoke:
-    name: Smoke journeys · ${{ matrix.agent == 'claude' && 'Claude' || 'Codex' }} · ${{ matrix.os == 'windows-server-latest' && 'Windows' || 'Linux' }}
+    name: Smoke journeys · ${{ matrix.agent == 'claude' && 'Claude' || 'Codex' }} · ${{ matrix.os == 'windows-latest' && 'Windows' || 'Linux' }}
     needs: workspace
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
     concurrency:
       # Both OS variants use the same workspace; avoid overlapping same-agent runs.
       group: integration-smoke-${{ github.run_id }}-${{ matrix.agent }}
       cancel-in-progress: false
-    permissions:
-      contents: read
-      id-token: write
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04, windows-server-latest]
+        os: [ubuntu-22.04, windows-latest]
         agent: [claude, codex]
     env:
       UCODE_TEST_WORKSPACE: ${{ secrets.UCODE_TEST_WORKSPACE }}
@@ -232,25 +204,9 @@ jobs:
         run: |
           test -f "$RUNNER_TEMP/.bin/databricks.exe"
           cygpath -w "$RUNNER_TEMP/.bin" >> "$GITHUB_PATH"
-      - name: Authenticate to JFrog with GitHub OIDC
-        id: jfrog
-        if: ${{ runner.os == 'Windows' }}
-        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5  # v4.9.1
-        env:
-          JF_URL: https://databricks.jfrog.io
-        with:
-          oidc-provider-name: github-actions
       - name: Run the selected live cases against the e2e workspace
         shell: bash
-        env:
-          UV_INDEX_DATABRICKS_PYPI_USERNAME: ${{ steps.jfrog.outputs.oidc-user }}
-          UV_INDEX_DATABRICKS_PYPI_PASSWORD: ${{ steps.jfrog.outputs.oidc-token }}
-          UG_INTEGRATION_NPM_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
         run: |
-          if [[ "$RUNNER_OS" == Windows ]]; then
-            PACKAGE_INDEX="databricks-pypi=$WINDOWS_PACKAGE_INDEX"
-            registry=(--npm-registry "$WINDOWS_NPM_REGISTRY")
-          fi
           case "$AGENT" in
             claude) args=(--claude-version "$CLAUDE_VERSION") ;;
             codex) args=(--codex-version "$CODEX_VERSION") ;;
@@ -262,7 +218,7 @@ jobs:
           uv run --no-project --python 3.12 python scripts/run_integration.py \
             --python 3.12 --ug-version "$UG_VERSION" --entry-point "$ENTRY_POINT" \
             --default-index "$PACKAGE_INDEX" --output "$RUNNER_TEMP/ug-integration" \
-            "${registry[@]}" "${args[@]}" -- -m "$TEST_MARKER"
+            "${args[@]}" -- -m "$TEST_MARKER"
       - name: Upload live test evidence
         if: ${{ !cancelled() }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
@@ -280,14 +236,9 @@ jobs:
   headless-windows:
     name: Windows headless journey · Claude
     needs: workspace
-    runs-on: windows-server-latest
+    runs-on: windows-latest
     timeout-minutes: 20
-    permissions:
-      contents: read
-      id-token: write
     env:
-      PACKAGE_INDEX: https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
-      NPM_REGISTRY: https://databricks.jfrog.io/artifactory/api/npm/db-npm/
       DEPENDENCY: ${{ inputs.dependency }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
@@ -316,31 +267,19 @@ jobs:
             Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
           & $databricks version
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-      - name: Authenticate to JFrog with GitHub OIDC
-        id: jfrog
-        uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5  # v4.9.1
-        env:
-          JF_URL: https://databricks.jfrog.io
-        with:
-          oidc-provider-name: github-actions
       - name: Configure and complete a real headless gateway task
         shell: pwsh
         env:
           UCODE_TEST_WORKSPACE: ${{ secrets.UCODE_TEST_WORKSPACE }}
           DATABRICKS_BEARER: ${{ secrets.DATABRICKS_BEARER }}
-          UV_DEFAULT_INDEX: databricks-pypi=${{ env.PACKAGE_INDEX }}
-          UV_INDEX_DATABRICKS_PYPI_USERNAME: ${{ steps.jfrog.outputs.oidc-user }}
-          UV_INDEX_DATABRICKS_PYPI_PASSWORD: ${{ steps.jfrog.outputs.oidc-token }}
-          UG_INTEGRATION_NPM_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
         run: |
           $output = Join-Path $env:RUNNER_TEMP "ug-integration"
           $runnerArgs = @(
             "--python", "3.12",
             "--ug-version", $env:UG_VERSION,
             "--entry-point", $env:ENTRY_POINT,
             "--claude-version", $env:CLAUDE_VERSION,
-            "--default-index", $env:UV_DEFAULT_INDEX,
-            "--npm-registry", $env:NPM_REGISTRY,
+            "--default-index", $env:PACKAGE_INDEX,
             "--headless-only",
             "--output", $output
           )
@@ -362,17 +301,14 @@ jobs:
             ${{ runner.temp }}/ug-integration/wheels/
 
   full:
-    name: Full journeys · ${{ matrix.agent == 'claude' && 'Claude' || 'Codex' }} · ${{ matrix.os == 'windows-server-latest' && 'Windows' || 'Linux' }}
+    name: Full journeys · ${{ matrix.agent == 'claude' && 'Claude' || 'Codex' }} · ${{ matrix.os == 'windows-latest' && 'Windows' || 'Linux' }}
     if: ${{ !cancelled() && needs.workspace.result == 'success' }}
     needs: [workspace, smoke]
     runs-on: ${{ matrix.os }}
     concurrency:
       # Keep the previous per-agent serialization across the new OS matrix.
       group: integration-full-${{ github.run_id }}-${{ matrix.agent }}
       cancel-in-progress: false
-    permissions:
-      contents: read
-      id-token: write
     # The runner enforces its own 3600s pytest deadline; keep the job above it
     # so a slow run fails through the runner's report instead of a job kill.
     timeout-minutes: 70
@@ -381,7 +317,7 @@ jobs:
       # One runner per OS variant; concurrency above serializes variants per agent.
       max-parallel: 4
       matrix:
-        os: [ubuntu-22.04, windows-server-latest]
+        os: [ubuntu-22.04, windows-latest]
         agent: [claude, codex]
     env:
       UCODE_TEST_WORKSPACE: ${{ secrets.UCODE_TEST_WORKSPACE }}
@@ -396,18 +332,15 @@ jobs:
   # Non-blocking: continue-on-error and absent from the cujs `needs`, so a flaky OpenCode
   # leg cannot block merges. Add it to cujs once the lane is stable.
   opencode:
-    name: Full journeys · OpenCode · ${{ matrix.os == 'windows-server-latest' && 'Windows' || 'Linux' }} (non-blocking)
+    name: Full journeys · OpenCode · ${{ matrix.os == 'windows-latest' && 'Windows' || 'Linux' }} (non-blocking)
     if: ${{ !cancelled() && needs.workspace.result == 'success' }}
     needs: workspace
     continue-on-error: true
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
-      id-token: write
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-22.04, windows-server-latest]
+        os: [ubuntu-22.04, windows-latest]
     timeout-minutes: 30
     env:
       UCODE_TEST_WORKSPACE: ${{ secrets.UCODE_TEST_WORKSPACE }}