Skip to main content

What You’ll Learn

  • How to upload a multi-file Python project into a sandbox
  • How to run unittest inside the sandbox and capture output
  • How to parse test results (pass/fail, test count, failure count) from stdout
  • How to demonstrate a regression by uploading a buggy version and re-running tests
  • The sandbox-as-CI-runner pattern for safe, isolated test execution

Prerequisites

  • Declaw running locally or in the cloud (see Deployment)
  • DECLAW_API_KEY and DECLAW_DOMAIN set in your environment
This example is available in Python. TypeScript support coming soon.

Code Walkthrough

1. Define the project files

Both the module under test and the test file are Python strings defined in the outer script and uploaded to the sandbox:

2. Upload files and run the test suite

The 2>&1 redirect sends stderr to stdout so test output is captured in result.stdout. unittest writes its summary to stderr by default.

3. Parse test results

4. Inject a bug and re-run

The example demonstrates a failing build by uploading a buggy version of the calculator:

Expected Output

Why Use Declaw for CI

Running tests directly on a CI runner (GitHub Actions, CircleCI, Jenkins) means:
  • Untrusted test code can access the runner’s environment variables, credentials, and filesystem
  • A compromised dependency in the test suite can exfiltrate CI secrets
  • A runaway test process can consume all runner resources and block other jobs
With Declaw:
  • Each test run gets its own isolated sandbox with no host access
  • Add allow_internet_access=False to prevent network access during tests
  • Add SecurityPolicy with PII scanning to prevent credential exfiltration even if a test makes outbound calls
  • Sandboxes are destroyed after each run — no state leaks between runs