improve runtest, optimize CI batching (#210)

play.ts

@@ -1,7 +1,6 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
+import { rmSync } from "node:fs";
 import { mkdtemp } from "node:fs/promises";
-import { platform, tmpdir } from "node:os";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import arg from "arg";
@@ -10,6 +9,8 @@ import type { AgentResult } from "./agents/shared.ts";
 import { type Inputs, main } from "./main.ts";
 import { defineFixture } from "./test/utils.ts";
 import { log } from "./utils/cli.ts";
+import { runInDocker } from "./utils/docker.ts";
+import { isInsideDocker } from "./utils/globals.ts";
 import { setupTestRepo } from "./utils/setup.ts";
 
 /**
@@ -109,121 +110,28 @@ Examples:
     process.exit(0);
   }
 
-  // default: run in Docker (unless --local or PLAY_LOCAL=1 or already inside Docker)
-  const isInsideDocker = existsSync("/.dockerenv");
+  // default: run in Docker (unless --local, PLAY_LOCAL=1, or already inside Docker)
   const useLocal = args["--local"] || process.env.PLAY_LOCAL === "1" || isInsideDocker;
 
   if (!useLocal) {
-    log.info("» running in Docker container...");
-
     const passArgs = process.argv
       .slice(2)
-      // shell-escape each argument to handle special characters in JSON payloads
-      .map((arg) => `'${arg.replace(/'/g, "'\\''")}'`)
+      .map((a) => `'${a.replace(/'/g, "'\\''")}'`)
       .join(" ");
     const nodeCmd = `node play.ts ${passArgs}`;
 
-    // pass all env vars to docker
-    const envFlags = Object.entries(process.env).flatMap(([key, value]) =>
-      value !== undefined ? ["-e", `${key}=${value}`] : []
-    );
-
-    // SSH for git - platform-specific handling
-    const sshFlags: string[] = [];
-    let sshSetupCmd = "";
-    const plat = platform();
-    const home = process.env.HOME;
-
-    if (plat === "win32") {
-      throw new Error(
-        "Docker mode is not supported on native Windows. Use WSL2 or set PLAY_LOCAL=1."
-      );
-    } else if (plat === "darwin") {
-      // macOS: Docker Desktop SSH agent forwarding
-      if (home) {
-        const knownHostsPath = join(home, ".ssh", "known_hosts");
-        if (existsSync(knownHostsPath)) {
-          sshFlags.push("-v", `${knownHostsPath}:/root/.ssh/known_hosts:ro`);
-        }
-      }
-      sshFlags.push(
-        "-v",
-        "/run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock",
-        "-e",
-        "SSH_AUTH_SOCK=/run/host-services/ssh-auth.sock"
-      );
-    } else {
-      // Linux/WSL: copy .ssh files into container with correct permissions
-      if (home) {
-        const sshDir = join(home, ".ssh");
-        if (existsSync(sshDir)) {
-          sshFlags.push("-v", `${sshDir}:/tmp/.ssh-host:ro`);
-          // copy ssh keys, add github.com to known_hosts, set GIT_SSH_COMMAND to use them
-          sshSetupCmd =
-            "mkdir -p /tmp/home/.ssh && cp /tmp/.ssh-host/id_* /tmp/home/.ssh/ 2>/dev/null; chmod 600 /tmp/home/.ssh/id_* 2>/dev/null; " +
-            "ssh-keyscan -t ed25519,rsa github.com >> /tmp/home/.ssh/known_hosts 2>/dev/null; chmod 644 /tmp/home/.ssh/known_hosts; " +
-            "export GIT_SSH_COMMAND='ssh -i /tmp/home/.ssh/id_rsa -o UserKnownHostsFile=/tmp/home/.ssh/known_hosts -o StrictHostKeyChecking=no'; ";
-        }
-      }
-    }
-
-    // always allocate a pseudo-TTY - Claude Code may require it
-    const ttyFlags = ["-t"];
-
-    // run as current user to avoid Claude CLI's root user restriction
-    const uid = process.getuid?.() ?? 1000;
-    const gid = process.getgid?.() ?? 1000;
-
     // use agent-specific volume to avoid conflicts when running in parallel
     const agentOverride = process.env.AGENT_OVERRIDE ?? "default";
     const volumeName = `pullfrog-action-node-modules-${agentOverride}`;
 
-    // initialize volume with correct ownership (runs as root briefly)
-    spawnSync(
-      "docker",
-      [
-        "run",
-        "--rm",
-        "-v",
-        `${volumeName}:/app/action/node_modules`,
-        "node:24",
-        "chown",
-        "-R",
-        `${uid}:${gid}`,
-        "/app/action/node_modules",
-      ],
-      { stdio: "ignore", cwd: __dirname }
-    );
-
-    const result = spawnSync(
-      "docker",
-      [
-        "run",
-        "--rm",
-        ...ttyFlags,
-        "--user",
-        `${uid}:${gid}`,
-        "-v",
-        `${__dirname}:/app/action:cached`,
-        "-v",
-        `${volumeName}:/app/action/node_modules`,
-        "-w",
-        "/app/action",
-        ...envFlags,
-        ...sshFlags,
-        "-e",
-        "COREPACK_ENABLE_DOWNLOAD_PROMPT=0",
-        "-e",
-        "HOME=/tmp/home",
-        "-e",
-        "TMPDIR=/tmp",
-        "node:24",
-        "bash",
-        "-c",
-        `${sshSetupCmd}mkdir -p /tmp/home/.config /tmp/home/.cache && corepack pnpm install --frozen-lockfile --ignore-scripts && ${nodeCmd}`,
-      ],
-      { stdio: "inherit", cwd: __dirname }
-    );
+    const result = runInDocker({
+      actionDir: __dirname,
+      args: process.argv.slice(2),
+      nodeCmd,
+      volumeName,
+      envFilterMode: "passthrough",
+      onStart: () => log.info("» running in Docker container..."),
+    });
 
     process.exit(result.status ?? 1);
   }