feat(api): expand Decisions input and question types

.castiron.stats.yml

@@ -1,8 +1,8 @@
 schema_version: 1
-generation_id: 7b8e4f9d-66bd-465d-97d2-cbe0f41aadaf
-openapi_spec_hash: 28504532afa0c3f477f005e641ec7d6d
-openapi_transformed_spec_hash: 13422b63a47a5d25533cf55573de7632
-config_hash: 4446d9cc8e7a00d29ce72282aa5616f9
-codegen_sha: b231d2133bce32566450e5544a3205825be270b7
-codegen_hash: bafe248e46487a4eb8ea6868d7fa57e6453e489bf7522869c0ad8eb8125e247d
-public_codegen_sha: bb32fa596d2a5e59ed4b7a908aebcdf347cced9d
+generation_id: 13866b42-3537-41d4-9c12-f53214868c28
+openapi_spec_hash: 4a02922518092801c43f2526a9ced0f5
+openapi_transformed_spec_hash: b577364c156fa7f501df6fef87ae11ed
+config_hash: 07f8531f9ff20bc9f5156b5a258c76ff
+codegen_sha: e92d3226b583127c9519d4b89e52c20d6c596d0b
+codegen_hash: 7afac60a97214c8b2cd5a6684367ee3e19efa7bd30856d197a78779278534669
+public_codegen_sha: cf08e5bb49e8c3d1f4eadee5d4b517dd2a06cabc

.github/workflows/castiron-custom-code-comment.yml

@@ -70,6 +70,24 @@ jobs:
                   policy.max_custom_patch_lines < 0n) throw new Error('Invalid policy budget');
               return policy;
             }
+            async function supportsEffectivePinReview(ref) {
+              let file;
+              try {
+                ({data: file} = await github.rest.repos.getContent({
+                  ...context.repo, path: 'scripts/castiron/custom_code_policy.py', ref,
+                }));
+              } catch (error) {
+                if (error.status === 404) return false;
+                throw error;
+              }
+              if (file.type !== 'file' || file.encoding !== 'base64' || !Number.isSafeInteger(file.size) ||
+                  file.size < 0 || typeof file.content !== 'string') throw new Error('Invalid checker contract');
+              const content = Buffer.from(file.content, 'base64');
+              if (content.length !== file.size) throw new Error('Invalid checker content');
+              // Read data only from the effective checker, never import or execute it.
+              const declarations = content.toString('utf8').match(/^PIN_REVIEW_POLICY = .*$/gm) || [];
+              return declarations.length === 1 && declarations[0] === 'PIN_REVIEW_POLICY = "effective-policy-v1"';
+            }
             async function pinRequiresHuman(pr, headPolicy, mainSha) {
               const targetPolicy = await readPolicy(pr.base.sha);
               const pinSha = pin => pin?.repository === repo && /^[0-9a-f]{40}$/.test(pin.main_sha || '')
@@ -78,6 +96,9 @@ jobs:
               const previousChecker = targetPolicy.next_policy ? pinSha(targetPolicy.next_policy) : mainSha;
               if (!proposedChecker || !/^[0-9a-f]{40}$/.test(previousChecker || '') ||
                   !/^[0-9a-f]{40}$/.test(mainSha || '')) return true;
+              // Older checkers require human review for every pin edit. Retain that
+              // requirement until the protected checker explicitly supports the exemption.
+              if (!await supportsEffectivePinReview(previousChecker)) return true;
               const [previous, proposed, previousBase, proposedBase] = await Promise.all([
                 readPolicy(previousChecker),
                 readPolicy(proposedChecker), mergeBase(previousChecker, proposedChecker),