What You’ll Learn
- How to upload a multi-file Python project into a sandbox
- How to run
unittestinside the sandbox and capture output - How to parse test results (pass/fail, test count, failure count) from stdout
- How to demonstrate a regression by uploading a buggy version and re-running tests
- The sandbox-as-CI-runner pattern for safe, isolated test execution
Prerequisites
- Declaw running locally or in the cloud (see Deployment)
DECLAW_API_KEYandDECLAW_DOMAINset in your environment
This example is available in Python. TypeScript support coming soon.
Code Walkthrough
1. Define the project files
Both the module under test and the test file are Python strings defined in the outer script and uploaded to the sandbox:2. Upload files and run the test suite
2>&1 redirect sends stderr to stdout so test output is captured in result.stdout. unittest writes its summary to stderr by default.
3. Parse test results
4. Inject a bug and re-run
The example demonstrates a failing build by uploading a buggy version of the calculator:Expected Output
Why Use Declaw for CI
Running tests directly on a CI runner (GitHub Actions, CircleCI, Jenkins) means:- Untrusted test code can access the runner’s environment variables, credentials, and filesystem
- A compromised dependency in the test suite can exfiltrate CI secrets
- A runaway test process can consume all runner resources and block other jobs
- Each test run gets its own isolated sandbox with no host access
- Add
allow_internet_access=Falseto prevent network access during tests - Add
SecurityPolicywith PII scanning to prevent credential exfiltration even if a test makes outbound calls - Sandboxes are destroyed after each run — no state leaks between runs