fix(ci): simplify API deployment version check and extend timeout

- Simplified the API deployment verification step in the GitHub workflow to use `git describe --tags` as the single source of truth for the expected version.
- Extended the timeout for API readiness check from 5 minutes to 15 minutes to accommodate cold starts.
- Minor cleanup and comments added for clarity in the deployment workflow.
- Updated GitAgent.py to improve staging logic and added tests for git_add behavior.

Test plan:
- Verified the workflow changes locally and in CI runs.
- Confirmed that the new timeout allows for longer cold starts without failure.
- Ran unit tests for GitAgent modifications and confirmed all pass.

Author: FlorentRvl

.github/workflows/deploy_api.yml

@@ -100,54 +100,30 @@ jobs:
       - name: Verify API deployment and version
         run: |
           echo "🔍 Verifying API deployment with expected version..."
-          
+
           # Get current commit hash
           CURRENT_COMMIT=$(git rev-parse HEAD)
           CURRENT_COMMIT_SHORT=$(git rev-parse --short HEAD)
           echo "Current commit (full): $CURRENT_COMMIT"
           echo "Current commit (short): $CURRENT_COMMIT_SHORT"
-          
-          # Debug: Get all releases and their target commits
-          echo "🔍 Fetching releases from GitHub API..."
-          RELEASES_JSON=$(curl -s -H "Authorization: token ${{ secrets.ACCESS_TOKEN }}" \
-            "https://api.github.com/repos/${{ github.repository }}/releases")
-          
-          echo "📋 Available releases and their target commits (ordered by date):"
-          echo "$RELEASES_JSON" | jq -r '.[] | "\(.tag_name) -> \(.target_commitish) (created: \(.created_at))"' | head -10
-          
-          # Search for release that points to current commit
-          # Try multiple matching strategies
-          EXPECTED_VERSION=$(echo "$RELEASES_JSON" | \
-            jq -r --arg commit "$CURRENT_COMMIT" --arg short_commit "$CURRENT_COMMIT_SHORT" \
-            '.[] | select(.target_commitish == $commit or .target_commitish == $short_commit or .target_commitish == ("refs/heads/" + $commit) or .target_commitish == ("refs/heads/" + $short_commit)) | .tag_name' | \
-            head -1)
-          
-          # If still not found, try matching against the default branch
-          if [ -z "$EXPECTED_VERSION" ] || [ "$EXPECTED_VERSION" = "null" ]; then
-            echo "🔄 Trying to match against default branch releases..."
-            # Get the most recent release targeting main/master, sorted by creation date
-            EXPECTED_VERSION=$(echo "$RELEASES_JSON" | \
-              jq -r 'sort_by(.created_at) | reverse | .[] | select(.target_commitish == "main" or .target_commitish == "master" or .target_commitish == "") | .tag_name' | \
-              head -1)
-            echo "📌 Selected most recent release targeting main branch: $EXPECTED_VERSION"
-          fi
-          
-          # Fallback to git describe if no release found
-          if [ -z "$EXPECTED_VERSION" ] || [ "$EXPECTED_VERSION" = "null" ]; then
-            EXPECTED_VERSION=$(git describe --tags 2>/dev/null || echo "v0.0.1")
-            echo "❌ No release found for commit, using git describe: $EXPECTED_VERSION"
-          else
-            echo "✅ Found release for commit: $EXPECTED_VERSION"
-          fi
-          
+
+          # The API reports its version via get_git_tag() -> the VERSION file baked
+          # into the image at build time from `git describe --tags`
+          # (see .deploy/docker/images/Dockerfile.linux.x86_64). Use the exact same
+          # source of truth here so the strings can actually match.
+          EXPECTED_VERSION=$(git describe --tags 2>/dev/null || echo "unknown")
+          echo "✅ Expected version (git describe --tags): $EXPECTED_VERSION"
+
           # API URL based on registry name
           API_URL="https://${{ env.REGISTRY_NAME }}.default.space.naas.ai"
           OPENAPI_URL="$API_URL/openapi.json"
-          
+
           echo "Checking API at: $OPENAPI_URL"
-          
-          # Wait up to 5 minutes for API to be ready with correct version
-          TIMEOUT=300  # 5 minutes
+
+          # Wait for API to be ready with correct version. A fresh space
+          # create/update is a cold start (image pull + app boot + DNS/TLS) that
+          # routinely takes longer than 5 minutes, so allow up to 15.
+          TIMEOUT=900  # 15 minutes
           INTERVAL=10  # Check every 10 seconds
           ELAPSED=0
           

libs/naas-abi-marketplace/naas_abi_marketplace/applications/git/agents/GitAgent.py

@@ -53,6 +53,7 @@ class GitAgent(Agent):
 6) If the user also asked to open/update a PR, continue with **Path PR-only** steps 2–4.
 
 Constraints:
+- Only stage and commit files that were changed as part of the requested work. NEVER stage untracked or unrelated files (e.g. scratch notes, generated markdown like `_KICKSTART.md`). Do not use `git add .` or `git add -A`; pass explicit paths to `git_add`, which skips untracked/unchanged paths automatically.
 - Do NOT use destructive git operations (no force push, no hard reset).
 - Keep PR body concise: include Summary + Test plan.
 - Before any push, the branch must be up to date with origin. `git_push` enforces this by running `git pull` first when the branch exists on origin; never bypass it.
@@ -121,16 +122,41 @@ def git_log(limit: int = 10) -> str:
                 "Stage files for the next commit (git add). Provide the list of "
                 "paths to stage. Use this before `git_commit` when the files you "
                 "want to commit are not yet staged (e.g. lockfiles modified by "
-                "tooling)."
+                "tooling). Only paths that are actual changes to tracked files "
+                "are staged; untracked and unchanged paths are skipped so that "
+                "unrelated files are never committed."
             )
         )
         def git_add(paths: list[str]) -> str:
             if not paths:
                 return "No paths provided to stage."
-            code, output = _run_allow_fail(["git", "add", "--", *paths])
-            if code != 0:
-                raise RuntimeError(f"git add failed:\n{output}")
-            return f"Staged: {', '.join(paths)}"
+
+            to_stage: list[str] = []
+            skipped: list[str] = []
+            for path in paths:
+                # Porcelain status for this path: empty => no change;
+                # every line starting with "??" => untracked (a new file, not a
+                # change to a tracked file).
+                status = _run(["git", "status", "--porcelain", "--", path])
+                lines = [line for line in status.splitlines() if line]
+                if not lines:
+                    skipped.append(f"{path} (no changes)")
+                elif all(line.startswith("??") for line in lines):
+                    skipped.append(f"{path} (untracked)")
+                else:
+                    to_stage.append(path)
+
+            if to_stage:
+                code, output = _run_allow_fail(["git", "add", "--", *to_stage])
+                if code != 0:
+                    raise RuntimeError(f"git add failed:\n{output}")
+
+            parts = []
+            if to_stage:
+                parts.append(f"Staged: {', '.join(to_stage)}")
+            if skipped:
+                parts.append(f"Skipped (not a tracked change): {', '.join(skipped)}")
+            return " | ".join(parts) if parts else "Nothing to stage."
 
         @tool(description="Restore files to HEAD (discard working-tree changes)")
         def git_restore(paths: list[str]) -> str:

libs/naas-abi-marketplace/naas_abi_marketplace/applications/git/agents/GitAgent_test.py

@@ -63,12 +63,27 @@ def test_git_commit_nothing_staged_is_recoverable(agent, tmp_path, monkeypatch):
     assert "git_add" in result, result
 
 
+def _commit_file(path, name, content):
+    import subprocess
+
+    (path / name).write_text(content)
+    subprocess.run(["git", "add", "--", name], cwd=path, check=True, capture_output=True)
+    subprocess.run(
+        ["git", "commit", "-m", f"add {name}", "-n"],
+        cwd=path,
+        check=True,
+        capture_output=True,
+    )
+
+
 def test_git_add_then_commit(agent, tmp_path, monkeypatch):
     import subprocess
 
     _init_git_repo(tmp_path)
     monkeypatch.chdir(tmp_path)
-    (tmp_path / "uv.lock").write_text("locked\n")
+    # uv.lock is a tracked file that then gets modified (the real scenario).
+    _commit_file(tmp_path, "uv.lock", "locked\n")
+    (tmp_path / "uv.lock").write_text("locked v2\n")
 
     add_tool = agent._tools_by_name["git_add"]
     add_result = add_tool.invoke({"paths": ["uv.lock"]})
@@ -82,3 +97,39 @@ def test_git_add_then_commit(agent, tmp_path, monkeypatch):
         ["git", "log", "--oneline"], cwd=tmp_path, capture_output=True, text=True
     ).stdout
     assert "chore: update lockfile" in log, log
+
+
+def test_git_add_skips_untracked_files(agent, tmp_path, monkeypatch):
+    import subprocess
+
+    _init_git_repo(tmp_path)
+    monkeypatch.chdir(tmp_path)
+    _commit_file(tmp_path, "uv.lock", "locked\n")
+    # A modified tracked file plus an unrelated untracked scratch file.
+    (tmp_path / "uv.lock").write_text("locked v2\n")
+    (tmp_path / "_KICKSTART.md").write_text("scratch\n")
+
+    add_tool = agent._tools_by_name["git_add"]
+    result = add_tool.invoke({"paths": ["uv.lock", "_KICKSTART.md"]})
+
+    assert "Staged: uv.lock" in result, result
+    assert "_KICKSTART.md (untracked)" in result, result
+
+    staged = subprocess.run(
+        ["git", "diff", "--cached", "--name-only"],
+        cwd=tmp_path,
+        capture_output=True,
+        text=True,
+    ).stdout
+    assert "uv.lock" in staged, staged
+    assert "_KICKSTART.md" not in staged, staged
+
+
+def test_git_add_skips_unchanged_files(agent, tmp_path, monkeypatch):
+    _init_git_repo(tmp_path)
+    monkeypatch.chdir(tmp_path)
+    _commit_file(tmp_path, "uv.lock", "locked\n")  # committed, now unchanged
+
+    add_tool = agent._tools_by_name["git_add"]
+    result = add_tool.invoke({"paths": ["uv.lock"]})
+    assert "no changes" in result, result