Run scheduled Git live-update integration test on PRs

[cooktheryan]

The live-update test was skipped on pull requests because it committed and force-pushed to the shared ci branch. Replace that global mutation with a job-local bare Git repository served over read-only smart HTTP, and run make-change-to-repo on PRs and main pushes with read-only GitHub permissions and checkout credential persistence disabled.

Use the engine and sample image artifacts built from the tested revision. Start FetchIt normally, deploy two raw workloads, commit and push one workload update into the temporary repository, and wait for the scheduler to reconcile it. Require a new container ID and environment value for the changed workload, an unchanged ID for the other workload, and no FetchIt restart. Bound waits and preserve logs before cleaning up job-specific resources.

Keep the existing job name and downstream build dependencies. Add README and Read the Docs instructions for the isolated test and local reproduction.

Validation: native Git smart-HTTP clone/pull and FetchIt's actual go-git HTTP authentication transport passed against the fixture locally; shell syntax, shellcheck, actionlint, and strict Sphinx checks passed. The full container/scheduler test passed on this PR as make-change-to-repo (54 seconds). The unit-test and Sphinx jobs also passed.

[sourcery-ai]

Sorry @cooktheryan, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 17 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR enables the scheduled Git live-update integration test for PRs without modifying shared GitHub branches by using a job-local bare repository over read-only smart HTTP, revision-local container artifacts, restricted permissions, bounded cleanup-aware execution, and stronger reconciliation assertions; documentation covers the isolated test and local reproduction.

Sequence diagram for the isolated scheduled Git update test

sequenceDiagram
    participant Workflow as GitHub Actions
    participant Test as test-live-update.sh
    participant Git as git-server.py
    participant FetchIt
    participant Workloads

    Workflow->>Test: run test-live-update.sh
    Test->>Git: start isolated bare repository over smart HTTP
    Test->>FetchIt: start FetchIt with revision-local artifacts
    Test->>Workloads: deploy two raw workloads
    FetchIt->>Git: poll repository for scheduled updates
    Test->>Git: commit and push one workload update
    Git-->>FetchIt: serve updated Git revision
    FetchIt->>Workloads: reconcile changed workload
    Test->>Workloads: verify new container ID and environment value
    Test->>Workloads: verify unchanged workload ID
    Test->>FetchIt: verify no restart
    Test->>Git: clean up job-local resources

Loading

File-Level Changes

Change	Details	Files
Replace shared-branch mutation with an isolated, read-only smart-HTTP Git fixture for scheduled live-update testing.	Create a temporary bare repository and seed two raw workloads. Serve Git fetch operations through a loopback Python HTTP fixture with receive-pack disabled. Push the workload update only to the job-local repository and clean up all temporary resources.	tests/integration/live-update/git-server.py tests/integration/live-update/test-live-update.sh
Run the live-update integration test on pull requests and main workflow executions using revision-local artifacts and least-privilege checkout settings.	Remove the branch/event condition while preserving the existing job name and build dependencies. Grant contents read permission, disable checkout credential persistence, and invoke the isolated test script. Load engine and sample image artifacts produced by the tested revision.	.github/workflows/docker-image.yml
Strengthen live-update assertions and operational safeguards for CI and local execution.	Bound the workflow and reconciliation waits and preserve FetchIt and fixture logs during cleanup. Verify initial and updated colors, replacement of only the changed workload, stable workload identity, and no FetchIt restart. Document isolated scheduled Git testing and local reproduction instructions.	tests/integration/live-update/test-live-update.sh README.md docs/documentation.rst

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.