ci: allow reviewed action pins in Codex topics - #81
Merged
Conversation
The repository's Actions policy requires full commit IDs, but the controller rejects changes to the inherited CI workflows. The pinning topic therefore cannot enter the stable plan, leaving both lanes with action references that fail during job setup. Allow the reviewed before/after blobs for the CI, style, and whitespace workflows. Check their file modes as well as their contents, and apply the same check to topic source ranges and generated trees. Other workflow changes still require a controller review. Once admitted to the stable plan, the pinning topic also supplies the workflow replacements to codex-unstable through its codex base. Signed-off-by: Taylor Blau <ttaylorr@openai.com>
ttaylorr-oai
added
kind:controller
tnm-oai
approved these changes
Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The controller rejects the full-SHA action pins in #80, so the topic cannot enter the stable plan even though the repository's Actions policy requires those pins.
Allow the three exact before/after workflow blobs from that patch through the source-range and generated-tree checks. File modes must match too. Other workflow edits remain subject to controller review, and the existing topic approval and plan checks still apply.
Once the topic is admitted to
codex,codex-unstableinherits the pinned workflows from its stable base. The release workflow's six action pins already fit the existing release-workflow policy.Validation: syntax and whitespace checks pass. Checks against the real pinning patch accept the replacements and reject unpinning, extra edits, deletion, executable or symlink modes, and added workflows. All 136 tests in the existing controller regression suite pass.