From 8ea8a72c0ff0189a142e55e8335ea4aabcc8afe7 Mon Sep 17 00:00:00 2001 From: Kamesh Akella Date: Wed, 7 Oct 2026 17:51:24 +0530 Subject: [PATCH 1/2] fix: use pipeline API key for OpenShell evaluation Avoid requiring a namespace inference Secret before the evaluation container can start. AI-Attribution: AIA PAI Ce Hin R gpt-6-luna v1.0 AI-Interpretation: https://aiattribution.github.io/statements/AIA-PAI-Ce-Hin-R-?model=gpt-6-luna --- pipeline/tasks/phases/evaluate.yaml | 13 ++----------- tests/test_openshell_pipeline_profile.py | 24 ++++++++++++++++++++++++ 2 files changed, 26 insertions(+), 11 deletions(-) diff --git a/pipeline/tasks/phases/evaluate.yaml b/pipeline/tasks/phases/evaluate.yaml index a50eff96..827346c0 100644 --- a/pipeline/tasks/phases/evaluate.yaml +++ b/pipeline/tasks/phases/evaluate.yaml @@ -1661,22 +1661,13 @@ spec: - secretRef: name: $(params.openshell-oidc-secret) optional: true - - secretRef: - name: inference - optional: false env: - name: HOME value: /tmp/openshell-home - name: INFERENCE_API_KEY - valueFrom: - secretKeyRef: - name: inference - key: api_key + value: "$(params.llm-api-key)" - name: OPENAI_API_KEY - valueFrom: - secretKeyRef: - name: inference - key: api_key + value: "$(params.llm-api-key)" - name: AGENT_EVAL_RUNS_DIR value: $(workspaces.source.path)/reports - name: OPENSHELL_GATEWAY_ENDPOINT diff --git a/tests/test_openshell_pipeline_profile.py b/tests/test_openshell_pipeline_profile.py index f2a6f9ef..2fb1d311 100644 --- a/tests/test_openshell_pipeline_profile.py +++ b/tests/test_openshell_pipeline_profile.py @@ -61,6 +61,30 @@ def test_evaluate_openshell_step_logs_mlflow(self): assert uri_note in openshell assert openshell.find(uri_note) < openshell.find("scripts/run_aeh.py") + def test_openshell_eval_uses_llm_param_instead_of_inference_secret(self): + task = _load(REPO / "pipeline" / "tasks" / "phases" / "evaluate.yaml") + openshell = next( + step for step in task["spec"]["steps"] + if step["name"] == "aeh-openshell-eval" + ) + + env_from_secret_names = { + source["secretRef"]["name"] + for source in openshell.get("envFrom", []) + if "secretRef" in source + } + env_secret_names = { + env["valueFrom"]["secretKeyRef"]["name"] + for env in openshell.get("env", []) + if "secretKeyRef" in env.get("valueFrom", {}) + } + assert "inference" not in env_from_secret_names | env_secret_names + + for name in ("INFERENCE_API_KEY", "OPENAI_API_KEY"): + env = next(item for item in openshell["env"] if item["name"] == name) + assert env["value"] == "$(params.llm-api-key)" + assert "valueFrom" not in env + def test_harbor_profiles_still_include_test(self): for path in (CI, CI_DEV): names = _task_names(_load(path)["spec"]) From afa43c08f918f51d73b56f363c4697444d63dac7 Mon Sep 17 00:00:00 2001 From: Kamesh Akella Date: Wed, 7 Oct 2026 17:57:06 +0530 Subject: [PATCH 2/2] style: format OpenShell regression test AI-Attribution: AIA PAI Ce Hin R gpt-6-luna v1.0 AI-Interpretation: https://aiattribution.github.io/statements/AIA-PAI-Ce-Hin-R-?model=gpt-6-luna --- tests/test_openshell_pipeline_profile.py | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/tests/test_openshell_pipeline_profile.py b/tests/test_openshell_pipeline_profile.py index 2fb1d311..b44f222e 100644 --- a/tests/test_openshell_pipeline_profile.py +++ b/tests/test_openshell_pipeline_profile.py @@ -63,15 +63,10 @@ def test_evaluate_openshell_step_logs_mlflow(self): def test_openshell_eval_uses_llm_param_instead_of_inference_secret(self): task = _load(REPO / "pipeline" / "tasks" / "phases" / "evaluate.yaml") - openshell = next( - step for step in task["spec"]["steps"] - if step["name"] == "aeh-openshell-eval" - ) + openshell = next(step for step in task["spec"]["steps"] if step["name"] == "aeh-openshell-eval") env_from_secret_names = { - source["secretRef"]["name"] - for source in openshell.get("envFrom", []) - if "secretRef" in source + source["secretRef"]["name"] for source in openshell.get("envFrom", []) if "secretRef" in source } env_secret_names = { env["valueFrom"]["secretKeyRef"]["name"]