From 44fcba0b3a8bebdf23fe44004dd94ab6f886262a Mon Sep 17 00:00:00 2001
From: Taylor Blau <ttaylorr@openai.com>
Date: Thu, 3 Sep 2026 20:19:48 -0500
Subject: [PATCH] ci: allow reviewed action pins in Codex topics

The repository's Actions policy requires full commit IDs, but the
controller rejects changes to the inherited CI workflows. The pinning
topic therefore cannot enter the stable plan, leaving both lanes with
action references that fail during job setup.

Allow the reviewed before/after blobs for the CI, style, and whitespace
workflows. Check their file modes as well as their contents, and apply
the same check to topic source ranges and generated trees. Other
workflow changes still require a controller review.

Once admitted to the stable plan, the pinning topic also supplies the
workflow replacements to codex-unstable through its codex base.

Signed-off-by: Taylor Blau <ttaylorr@openai.com>
---
 .github/CODEX.md                  |  6 ++++++
 .github/workflows/codex-branch.sh | 35 +++++++++++++++++++++++++++----
 2 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/.github/CODEX.md b/.github/CODEX.md
index 0af4a7f333161a..d6e0315b17e656 100644
--- a/.github/CODEX.md
+++ b/.github/CODEX.md
@@ -117,6 +117,12 @@ controller or workflow paths. A prerequisite change is deliberately not an
 alter: retire and re-add the topic under a newly reviewed ancestry, or extend
 the policy explicitly.
 
+The three inherited CI workflows may take the exact full-SHA replacements
+listed in `ci_workflow_pins_are_reviewed()`. Those entries allow the reviewed
+action pins without admitting other workflow edits or mode changes. A stable
+topic carries the replacements into both output lanes; changes to the
+approved workflow contents require another controller review.
+
 ## Day-to-day commands
 
 Start a production topic from `master`, or from its intended production
diff --git a/.github/workflows/codex-branch.sh b/.github/workflows/codex-branch.sh
index 1e7d2f28b2fe7b..634828bc7f9215 100755
--- a/.github/workflows/codex-branch.sh
+++ b/.github/workflows/codex-branch.sh
@@ -369,6 +369,27 @@ legacy_control_paths_unchanged () (
 		t/t9905-codex-branch.sh
 )
 
+ci_workflow_pins_are_reviewed () (
+	base_oid=$1
+	head_oid=$2
+
+	# Permit only the reviewed full-SHA replacements of the inherited CI
+	# workflows. Comparing tree entries also rejects mode changes, symlinks,
+	# and deletions. New upstream workflow contents need a new review.
+	while read -r path old_blob new_blob
+	do
+		old=$(git ls-tree "$base_oid" -- "$path") || return 1
+		new=$(git ls-tree "$head_oid" -- "$path") || return 1
+		test "$old" = "$new" && continue
+		test "$old" = "100644 blob $old_blob$tab$path" &&
+		test "$new" = "100644 blob $new_blob$tab$path" || return 1
+	done <<-\EOF
+	.github/workflows/check-style.yml 108a2de903310cfd0f6327353ee700d99d54edc3 b265fe35cbfc51db4cd53729e602de5d36b6632e
+	.github/workflows/check-whitespace.yml ea6f49f742108e27812decc666e6839ab84080f1 3379f89a814abd439ac13efaa572264be5b75080
+	.github/workflows/main.yml 205325eb33b06444f24a11271a9e669841e29cb9 485e3be66581518bca55b62d97ebd2217be194b1
+	EOF
+)
+
 meta_control_paths_unchanged () (
 	base_oid=$1
 	head_oid=$2
@@ -388,7 +409,6 @@ meta_control_paths_unchanged () (
 		.github/workflows/codex-pr-state.yml \
 		.github/workflows/codex-topic.yml \
 		.github/workflows/codex-branch.sh \
-		.github/workflows/main.yml \
 		codex \
 		publish \
 		rebuild \
@@ -400,8 +420,12 @@ meta_control_paths_unchanged () (
 	git diff --quiet "$base_oid" "$head_oid" -- \
 		':(glob).github/workflows/*.yml' \
 		':(glob).github/workflows/*.yaml' \
+		':(exclude).github/workflows/check-style.yml' \
+		':(exclude).github/workflows/check-whitespace.yml' \
+		':(exclude).github/workflows/main.yml' \
 		':(exclude).github/workflows/codex.yml' \
-		':(exclude).github/workflows/codex-release.yml'
+		':(exclude).github/workflows/codex-release.yml' &&
+	ci_workflow_pins_are_reviewed "$base_oid" "$head_oid"
 )
 
 write_automation_workflow () {
@@ -8204,7 +8228,6 @@ topic_control_paths_unchanged () (
 		.github/workflows/codex-topic.yml \
 		.github/workflows/codex.yml \
 		.github/workflows/codex-branch.sh \
-		.github/workflows/main.yml \
 		codex \
 		publish \
 		rebuild \
@@ -8216,7 +8239,11 @@ topic_control_paths_unchanged () (
 	git diff --quiet "$base_oid" "$head_oid" -- \
 		':(glob).github/workflows/*.yml' \
 		':(glob).github/workflows/*.yaml' \
-		':(exclude).github/workflows/codex-release.yml'
+		':(exclude).github/workflows/check-style.yml' \
+		':(exclude).github/workflows/check-whitespace.yml' \
+		':(exclude).github/workflows/main.yml' \
+		':(exclude).github/workflows/codex-release.yml' &&
+	ci_workflow_pins_are_reviewed "$base_oid" "$head_oid"
 )
 
 verify_unstable_control_paths () (