[askalf]

What changes, and why

#198 added the dario sidecar to hosted mode and said what it had not tested: a sidecar that reaches a registry and comes up ready. The stubbed tests in review.test.mjs hold the start step to its docker and curl lines; they cannot show that dario, started with nothing but the file the runner check writes, takes a seat from a lock service and answers /health.

This adds that test and a workflow to run it.

• scripts/redline/sidecar.live.test.mjs reads the Start the dario sidecar step out of redline-review.yml and runs its shell as written, with real docker, against the dario image pinned by digest in the test. The test process is the lock service: a small HTTP server that answers /accounts/list with one made-up seat, everything else with an empty object, and a wrong bearer with 401. The container reaches it on docker's bridge gateway.
• It checks that the step ends ready, that dario read the registry with the lock token and took the seat, that the container is published on 127.0.0.1:3456 only, that GET /accounts refuses a key that is not the run's and, with the run's key, lists the one seat. Then, with a lock token the service refuses, that the step fails and prints dario's last lines.
• No model is called and no request leaves the runner beyond the image pull: the key is checked against dario's own pool listing.
• .github/workflows/redline-sidecar-self-test.yml runs it on ubuntu-latest, on a pull request that changes redline-review.yml, the test or the workflow, weekly, and on demand. REQUIRE_DOCKER=1 there makes a missing daemon a failure; without it the test skips, so it is harmless to run by hand on a machine with no docker.

It is not a required check and not in test-all.mjs or the test job: it pulls an image and runs a container.

The image digest in the test is moved by hand with a dario release. The weekly run is there so an image that no longer pulls, or a dario that no longer starts this way, shows up without a pull request.

How it is tested: run locally with docker against ghcr.io/askalf/dario@sha256:6826f8f5…: 9 of 9 pass, the step ready in 2 s. node test-all.mjs passes (all 12). actionlint 1.7.12 reports nothing on the new workflow. This pull request changes the workflow's own paths, so its first run on a GitHub runner is on this pull request.

Callers: no. The test file matches the pin bump's *.test.mjs exclusion and the workflow is this repository's own, so no caller's pin moves.

[sprayberry-redline]

Verdict: approve. The live test exercises the workflow's actual sidecar startup script, checks registry access, loopback publishing and API-key enforcement, and covers startup failure with a refused lock token. The separate workflow uses pinned actions and read-only permissions, and requires Docker rather than silently skipping the test.