Skip to content

ci: allow reviewed action pins in Codex topics #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ttaylorr-oai merged 1 commit into from
Sep 7, 2026
+37 −4
Merged

ci: allow reviewed action pins in Codex topics #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/CODEX.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,12 @@ controller or workflow paths. A prerequisite change is deliberately not an
alter: retire and re-add the topic under a newly reviewed ancestry, or extend
the policy explicitly.

The three inherited CI workflows may take the exact full-SHA replacements
listed in `ci_workflow_pins_are_reviewed()`. Those entries allow the reviewed
action pins without admitting other workflow edits or mode changes. A stable
topic carries the replacements into both output lanes; changes to the
approved workflow contents require another controller review.

## Day-to-day commands

Start a production topic from `master`, or from its intended production
Expand Down
35 changes: 31 additions & 4 deletions .github/workflows/codex-branch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,6 +369,27 @@ legacy_control_paths_unchanged () (
t/t9905-codex-branch.sh
)

ci_workflow_pins_are_reviewed () (
base_oid=$1
head_oid=$2

# Permit only the reviewed full-SHA replacements of the inherited CI
# workflows. Comparing tree entries also rejects mode changes, symlinks,
# and deletions. New upstream workflow contents need a new review.
while read -r path old_blob new_blob
do
old=$(git ls-tree "$base_oid" -- "$path") || return 1
new=$(git ls-tree "$head_oid" -- "$path") || return 1
test "$old" = "$new" && continue
test "$old" = "100644 blob $old_blob$tab$path" &&
test "$new" = "100644 blob $new_blob$tab$path" || return 1
done <<-\EOF
.github/workflows/check-style.yml 108a2de903310cfd0f6327353ee700d99d54edc3 b265fe35cbfc51db4cd53729e602de5d36b6632e
.github/workflows/check-whitespace.yml ea6f49f742108e27812decc666e6839ab84080f1 3379f89a814abd439ac13efaa572264be5b75080
.github/workflows/main.yml 205325eb33b06444f24a11271a9e669841e29cb9 485e3be66581518bca55b62d97ebd2217be194b1
EOF
)

meta_control_paths_unchanged () (
base_oid=$1
head_oid=$2
Expand All @@ -388,7 +409,6 @@ meta_control_paths_unchanged () (
.github/workflows/codex-pr-state.yml \
.github/workflows/codex-topic.yml \
.github/workflows/codex-branch.sh \
.github/workflows/main.yml \
codex \
publish \
rebuild \
Expand All @@ -400,8 +420,12 @@ meta_control_paths_unchanged () (
git diff --quiet "$base_oid" "$head_oid" -- \
':(glob).github/workflows/*.yml' \
':(glob).github/workflows/*.yaml' \
':(exclude).github/workflows/check-style.yml' \
':(exclude).github/workflows/check-whitespace.yml' \
':(exclude).github/workflows/main.yml' \
':(exclude).github/workflows/codex.yml' \
':(exclude).github/workflows/codex-release.yml'
':(exclude).github/workflows/codex-release.yml' &&
ci_workflow_pins_are_reviewed "$base_oid" "$head_oid"
)

write_automation_workflow () {
Expand Down Expand Up @@ -8204,7 +8228,6 @@ topic_control_paths_unchanged () (
.github/workflows/codex-topic.yml \
.github/workflows/codex.yml \
.github/workflows/codex-branch.sh \
.github/workflows/main.yml \
codex \
publish \
rebuild \
Expand All @@ -8216,7 +8239,11 @@ topic_control_paths_unchanged () (
git diff --quiet "$base_oid" "$head_oid" -- \
':(glob).github/workflows/*.yml' \
':(glob).github/workflows/*.yaml' \
':(exclude).github/workflows/codex-release.yml'
':(exclude).github/workflows/check-style.yml' \
':(exclude).github/workflows/check-whitespace.yml' \
':(exclude).github/workflows/main.yml' \
':(exclude).github/workflows/codex-release.yml' &&
ci_workflow_pins_are_reviewed "$base_oid" "$head_oid"
)

verify_unstable_control_paths () (
Expand Down