Goose's Rust test suite passed with no provider keys. The CI job took 1,121 seconds.

Goose is an open source AI agent that, by its GitHub description, can install, execute, edit and test with any LLM. Before trying any of that, we wanted to know whether its own Rust tests pass on a clean machine with no provider keys. We cloned Goose at commit 4811ae25f736 and ran the format check and crates test suite from its .github/workflows/ci.yml verbatim. The GitHub Actions job passed in 1,121 seconds, and the catch is that we could only run it there.

The catch

The upstream steps need Linux with sudo apt. The script installs libdbus-1-dev and libxcb1-dev, runs Goose's repair-v8-prebuilt.sh, sets GOOSE_DISABLE_KEYRING=1 and RUST_MIN_STACK=8388608, and runs cargo test --locked from inside crates/, the working directory upstream's workflow sets. Docker Desktop was down on our Mac when we shipped, so the heavy run exists only as the CI upstream job.

The report records that job's conclusion and duration and has no per-test counts. Treat it as a pass or fail on the pinned commit. A green keyless suite also tells you nothing about how Goose behaves with a live model. Provider keys (OPENAI_API_KEY, ANTHROPIC_API_KEY) stay commented out in .env.example and CI never reads them.

What we ran (keyless)

cp .env.example .env
export DISABLE_TELEMETRY=1 DO_NOT_TRACK=1
cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test --all
python3 scripts/check-banned-phrases
bash scripts/vendor-upstream.sh
bash scripts/upstream-goose.sh        # Linux with sudo apt; CI job upstream

scripts/upstream-goose.sh refuses to run if vendor/goose is not at the pin, then runs these steps from upstream CI in order:

1. cargo fmt --check
2. apt install libdbus-1-dev libxcb1-dev
3. repair-v8-prebuilt.sh
4. GOOSE_DISABLE_KEYRING=1 RUST_MIN_STACK=8388608
5. cd crates && cargo test --locked

From reports/gate.json, run on October 14, 2026, for lab commit e95688e and CI run 38514206203:

The four lab tests check the skill frontmatter and that the upstream script contains every step above with no provider secret requirements.

How it is wired

Goose runs as a local agent that talks to an LLM provider and to MCP extensions. This lab sits outside it and treats Goose as a dependency to verify: pin the commit, run upstream's own CI steps, and fail if they do not pass. The lab skill goose-keyless-ci covers the optional next step of running Goose with MCP and a live key, which stays out of CI.

Minilab (open source)

Upstream is aaif-goose/goose: 55,286 stars, Apache-2.0, Rust, as of October 14, 2026. On a Linux machine, run bash scripts/upstream-goose.sh and compare your timing with the 1,121 seconds above.

cargo test --all && bash scripts/vendor-upstream.sh && bash scripts/upstream-goose.sh